电力网络空间测绘与渗透技术研究  

Research on Power Cyberspace Surveying and Penetration

作　　者：黄伟[1,3] 顾智敏 郭静 李斌 徐正治[2] 姜海涛 HUANG Wei;GU Zhimin;GUO Jing;LI Bin;XU Zhengzhi;JIANG Haitao(Jiangsu Electric Power Research Institute Co.,Ltd.,Nanjing 211103,China;Nanjing Institute of Technology,Nanjing 211167,China;Electric Power Research Institute,State Grid Jiangsu Electric Power Co.,Ltd.,Nanjing 211103,China)

机构地区：[1]江苏省电力试验研究院有限公司,江苏南京211103 [2]南京工程学院,江苏南京211167 [3]国网江苏省电力有限公司电力科学研究院,江苏南京211103

出　　处：《电力信息与通信技术》2021年第12期49-54,共6页Electric Power Information and Communication Technology

基　　金：江苏省电力试验研究院有限公司成果转化项目“网络安全自动化渗透技术研究及装备研制”(2020FZKJKF12)。

摘　　要：针对现有网络资产探测与网络安全渗透存在盲区、噪声及最新通用漏洞风险感知不及时的电力信息安全问题,文章面向电力信息的网络空间,架构了一套基于漏洞风险匹配识别的网络空间测绘与渗透测试系统。详细阐述了网络资产指纹识别的测绘过程,应用漏洞风险匹配识别和自动化渗透测试队列生成基于漏洞风险匹配识别的网络资产安全态势指引,达到提升安全感知精准度的目标。利用素数域原根分片处理并行优化,解决了电力信息资产全网段扫描的时效性与噪声问题。In view of the power information security problems such as the blind area,noise and the delay of the latest general vulnerability risk perception in the existing network asset detection and network security penetration,this paper constructs a set of cyberspace surveying and penetration test system based on vulnerability risk matching identification.The surveying process of fingerprint identification of network assets is described in detail,and the timeliness and noise problems of the whole network segment scanning of power information assets are solved by using the parallel optimization of prime number domain original root processing.Vulnerability risk matching identification and automated penetration test queue are used to generate security situation guidance of network assets based on vulnerability risk matching identification to improve the accuracy of security perception.

关 键 词：网络空间测绘 渗透测试 安全态势感知 网络安全 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]