一种多维数据融合的网络威胁溯源迭代分析模型研究  

Research on an Iterative Analysis Model of Network Threat Traceability based on Multi-dimensional Data Fusion

作　　者：万抒[1] 王进 裴华[1] WAN Shu;WANG Jin;PEI Hua(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《通信技术》2021年第4期956-961,共6页Communications Technology

基　　金：国家自然科学基金(No.51803352)。

摘　　要：随着网络威胁向广域化、复杂化和组织化演进发展,站在防御的视角,如何完整复盘网络威胁的全过程,如何准确识别各类恶意网络行为,一直是智能安全领域的难点问题。利用多维融合的大数据分析技术,以网络资产为主线,通过寻找“同一网络威胁在不同维度的相似性表象和行为”,基于表象和行为的因果关系,逐次还原网络威胁全过程,并基于威胁情报实现多次的迭代验证和完善。As cyber threats evolve toward wide-area,complex,and organizational development,from the perspective of defense,how to fully review the entire process of restoring cyber threats and how to accurately identify various malicious cyber behaviors has always been the difficult problem in the intelligent security field.This paper uses multi-dimensional fusion of big data analysis technology and takes network assets as the main line.By searching for“similar appearances and behaviors of the same cyber threat in different dimensions”,based on the causality of appearances and behaviors,the whole process of cyber threats is restored successively,and then will be verified and improved many times based on threat intelligence.

关 键 词：网络威胁 网络资产 多维融合 溯源分析 

分 类 号：TN915.08[电子电信—通信与信息系统]