基于网络安全知识图谱的天地一体化信息网络攻击研判框架  

Attack Analysis Framework of Space-Integrated-Ground Information Network Based on Cybersecurity Knowledge Graph

作　　者：亓玉璐 江荣[1] 荣星 李爱平[1] QI Yulu;JIANG Rong;RONG Xing;LI Aiping(National University of Defense Technology,Changsha 410073,China;China Electronic Device Systems Engineering Corporation,Beijing 100089,China)

机构地区：[1]国防科技大学,湖南长沙410073 [2]中国电子设备系统工程公司,北京100089

出　　处：《天地一体化信息网络》2021年第3期57-65,共9页Space-Integrated-Ground Information Networks

基　　金：广东省重点领域研发计划项目(No.2019B010136003);国家自然科学基金资助项目(No.62072131)。

摘　　要：天地一体化信息网络在实现全球覆盖、随遇接入、按需服务、安全可信的同时,也面临着更加复杂多变的安全威胁,相比于传统互联网,卫星网络具有拓扑的高动态变化、特有的数据传输协议和格式等特点。因此,将卫星网络攻击的规律融合到APT攻击的规律中,构建天地一体化信息网络安全知识图谱和攻击规则库,进而对天地一体化信息网络攻击进行综合研判。采用包含时空属性的数据模型表达攻击规律,在数据有非连续漏报和误报的情况下,可以进行攻击研判的补全。本文提出的攻击研判框架可以实时、准确地感知天地一体化信息网络的安全状态,并为其威胁响应提供决策支撑。While realizing global coverage,random access,on-demand service,security and credibility,the space-integrated-ground information network(SGIN) is confronted with more complex and variable security threats.Compared with the internet,satellite network has a lot of differences,such as highly dynamic changes of topology,transfer protocol and data format.In terms of these questions,it was necessary to integrated the rule of satellite network attacks into the rules of APT attacks,developed the cybersecurity knowledge graph and the attack rules library to analyzed the attscks of the SGIN. The pattern of attsck rules was expressed based on time-space data model,which was used to completed the attack chain when there were non-continuous missed data or false positives data.The attack analysis framework proposed in this paper could accurately perceived the security status of the SGIN in real time,and provided decision support for the SGIN.

关 键 词：天地一体化信息网络 网络安全知识图谱 攻击规则库 攻击研判框架 攻击链补全 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]