针对攻击链的安全大数据多维融合分析架构和机制研究  

Research on Security Big Data Multi-Dimensional Fusion Analysis Architecture and Mechanism for Attack Chains

作　　者：万抒[1] 冯中华[1] 余文杰 裴华[1] WAN Shu;FENG Zhonghua;YU Wenjie;PEI Hua(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《通信技术》2021年第8期1975-1980,共6页Communications Technology

基　　金：国家自然科学基金项目(No.51803352)。

摘　　要：全面、准确地发现不同维度、不同类型安全威胁或风险之间的关联和因果关系,准确认知攻击链各类恶意行为和安全威胁或风险之间的映射关系,是智能安全分析领域的难点问题。因此,提出了针对攻击链的安全大数据多维融合分析架构,规范了逻辑层次和总体框架,设计了单维融合分析、多维融合分析和迭代融合分析等运行机制,并说明了其对威胁图谱构建和攻击链复盘分析的支撑能力。Comprehensive and accurate discovery of the association and causal relationship between different dimensions and different types of security threats or risks, and accurate understanding of the mapping relationship between various malicious behaviors in the attack chain and security threats or risks are the most difficult points in the field of intelligent security analysis problem. Therefore, this paper proposes a security big data multi-dimensional fusion analysis architecture for attack chains, which standardizes the logic level and overall framework, designs single-dimensional fusion analysis, multi-dimensional fusion analysis, iterative fusion analysis, and also explains the support capabilities for threat map construction and attack chain review analysis.

关 键 词：攻击链 单维融合分析 多维融合分析 迭代融合分析 

分 类 号：TN915.08[电子电信—通信与信息系统]