基于网络开源情报的威胁情报分析与管理  

Analysis and Management of Threat Intelligence Based on OSINT

作　　者：赵宁[1] 李蕾[1] 刘青春[1] 叶锐 Zhao Ning;Li Lei;Liu Qingchun;Ye Rui(Harbin Institute of Technology Library,Harbin 150001;Run Technologies Company Ltd,Beijing 100192)

机构地区：[1]哈尔滨工业大学图书馆,哈尔滨150001 [2]公安部北京锐安科技有限公司,北京100192

出　　处：《情报杂志》2021年第11期16-22,72,共8页Journal of Intelligence

基　　金：国家社会科学基金一般项目“产品化思维下的国内外开源情报开发与利用机制研究”(编号:20BTQ049)。

摘　　要：[研究目的]威胁情报是针对各类安全业务的态势感知信息,对保护企业关键资产和国家政治稳定都有重要的作用,作为信息安全领域重要分支受到广泛的关注。[研究方法]提出开源情报领域的情报收集需求,区分出开源情报的层次;建立相应威胁情报挖掘的系统框架,进行功能模块说明;提出面向OSINT的分析模式、设计威胁情报预警模型,进行情报分析研判和响应。[研究结论]在多层面上对威胁情报运营提供有价值的解决方案,需加强威胁情报生态能力建设,完善共享协同机制和产品服务机制,目前网络威胁情报服务市场不够成熟,可供选择的方案不够明朗,有待进一步发展和完善。[Research purpose]Threat intelligence is situation awareness information for all of security services,and plays an important role in protecting key assets of enterprises and national political stability.As an important branch of information security,threat intelligence has been widely concerned.[Research method]This paper puts forward the requirements of intelligence collection in the OSINT field,distinguishes the levels of OSINT.It establishes the framework of mining the threat intelligence system and explains the function modules.It proposes OSINT oriented analysis model and designs threat intelligence early warning model,carries on the intelligence analysis and judgment.[Research conclusion]In order to provide valuable solutions for threat intelligence operation at multiple levels,it is necessary to improve the ecological capability of threat intelligence,and establish a sharing and collaborative mechanism and product service mechanism.At present,the network threat intelligence service market is not mature enough,and the available solutions are not clear enough,which needs further development and improvement.

关 键 词：威胁情报 网络开源情报 情报预警 情报运行机制 

分 类 号：G203[文化科学—传播学] TP391[自动化与计算机技术—计算机应用技术]