基于本体和Web3.0洞悉网络威胁情报“盲盒”  

Unveiling Threat Intelligence“Blind Box”by Ontology and Web3.0 Integration

作　　者：车凌 杨宏[1] CHE Ling;YANG Hong(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《信息安全与通信保密》2022年第7期10-16,共7页Information Security and Communications Privacy

摘　　要：威胁情报通过关键网络空间安全内容的传递、交换和复用,促进企业、组织间形成协同防御信任联盟,以此共同识别、阻断和追踪入侵者,已经成为网络安全治理的重要基础。但随着情报生态的进一步发展,威胁情报管理、安全、收益与共享等方面的关键问题持续涌现,情报质量参差不齐的现状导致用户面对信息“盲盒”难以适从。基于Web3.0“下一代应用架构”和本体“下一代内容规范”,将去中心、强信任、防篡改、高一致、互认知的新型特征引入威胁情报共享范式中,将有望突破当前的技术与管理瓶颈,实现威胁情报在“供给—需求双侧”互牵互引、深度融合,实现安全主体间的无缝衔接和功能自治。Through the transmission,exchange and reuse of key cyberspace security content,threat intelligence promotes the formation of collaborative defense trust alliances between enterprises and organizations to jointly identify,block and track intruders,which becomes an important basis for cyber security governance.However,with the further development of the intelligence ecosystem,key issues in threat intelligence management,security,revenue and sharing continue to emerge,and the current situation of uneven intelligence quality makes it difficult for users to adapt to the“blind box”of information.Based on Web3.0’s“Next Generation Network Architecture”and Ontology“Next Generation Content Specification”,the new features of decentralization,strong trust,tamper resistance,high consistency,and mutual recognition are introduced into the threat intelligence sharing paradigm,which is expected to break through the current technology and management bottlenecks,and realize the mutual attraction and deep integration of threat intelligence on the“supply-demand side”,and achieve seamless connection and functional autonomy among security entities.

关 键 词：网络空间安全 本体 Web 3.0 威胁情报 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]