电信运营商威胁情报体系研究与应用探索  

Research and application exploration of threat intelligence system of telecom operators

作　　者：张海涛 蒋熠 竺士杰 陈琦 ZHANG Haitao;JIANG Yi;ZHU Shijie;CHEN Qi(China Mobile Communications Zhejiang Co.,Ltd.,Hangzhou 310051,China)

机构地区：[1]中国移动通信集团浙江有限公司,浙江杭州310051

出　　处：《电信科学》2022年第12期121-132,共12页Telecommunications Science

摘　　要：随着互联网时代网络攻防的不对等加剧,威胁情报成为缩小这种差距的重要工具之一。在研究分析了威胁情报国内外研究现状的基础上,提出了一套适用于电信运营商的威胁情报体系构建方法,包括制定计划、情报生产、情报分析、情报管理、情报共享和情报应用6个环节。基于该体系架构提出了一套多源情报融合评估机制,概述了情报聚合分析、情报信誉分析、情报关联分析和情报老化分析4个阶段涉及的技术和建设方法,帮助电信运营商构建情报融合分析能力。同时,针对入侵类和失陷类情报领域给出了情报生产和同步应用原则,为电信运营商应用威胁情报技术构建安全防护体系提供了有益的参考。With the increasing inequality of network attack and defense in the Internet era,threat intelligence has be-come one of the important tools to narrow this gap.Based on the analysis of the research status of threat intelligence at home and abroad,a set of construction methods of threat intelligence systems suitable for telecom operators were proposed,including six steps:intelligence planning,intelligence production,intelligence analysis,intelligence man-agement,intelligence sharing and intelligence application.Meanwhile a set of multi-source intelligence fusion as-sessment mechanisms was presented,and the technologies and methods were systematically expounded involved in the four stages of intelligence aggregation analysis,intelligence reputation analysis,intelligence correlation analysis and intelligence aging analysis,so as to help the telecom operators build the ability of intelligence fusion analysis.At the same time,the principles of intelligence production and synchronous application were given for intrusion and loss intelligence,which provided a useful reference for telecom operators to apply threat intelligence technology to build a security protection system.

关 键 词：威胁情报 情报分析 情报生产 情报应用 电信运营商 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]