互联网高级持续性威胁分析取证手段及技术研究  

Research on internet advanced threat analysis and forensics system

作　　者：白浩 BAI Hao(China Mobile Information Technology Co.,Ltd.Inner Mongolia Branch,Huhehot 100050,China)

机构地区：[1]中移动信息技术有限公司内蒙古分公司

出　　处：《电信工程技术与标准化》2019年第12期70-76,共7页Telecom Engineering Technics and Standardization

摘　　要：本文主要对互联网高级威胁、原始流量分析手段及技术进行研究和分析,阐述了该方面研究的现状及主要技术手段,并说明了研究互联网高级威胁重点及难点主要是如何有效利用获取的信息进行全面分析。本文研究了一种新型的、典型的互联网威胁分析系统,该系统针对原始流量进行采集和监控,对流量信息进行深度还原、存储、查询和分析,发现网络安全事件的具体原因及可能存在的风险,对重大互联网安全威胁进行预警及预防提出了一种全新的解决思路,在保障重要信息系统的网络安全方面有了技术及理念性的创新。This paper mainly studies and analyzes the advanced threat of internet and the original traffic analysis methods and technologies,expounds the current situation and main technical means of the research in this area,and explains that the key and difficult point of the research on the advanced threat of internet is mainly the effective use of analysis methods.This paper studies a new and typical internet threat analysis system,which collects and monitors the original traffic,deeply restores,stores,queries and analyzes the traffic information,finds out the specific causes and possible risks of network security events,and puts forward a new solution to the early warning and prevention of major internet security threats.There are technological and conceptual innovations in the network security of important information systems.

关 键 词：威胁分析 高级持续性威胁 流量采集 

分 类 号：TN918[电子电信—通信与信息系统]