攻防对抗视角下的网络安全主动防御体系研究  

Research on Active Defense System of Cyber Security from the Perspective of Attack-Defense Confrontation

作　　者：李庆华[1] 郭晓黎[1] 张锋军[1] 张小军 石凯 许杰[1] LI Qinghua;GUO Xiaoi;ZHANG Fengjun;ZHANG Xiaojun;SHI Kai;XU Jie(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《信息安全与通信保密》2024年第1期77-85,共9页Information Security and Communications Privacy

摘　　要：为了解决纵深防御体系中防御能力固化、灵活性不足等问题,从攻防对抗视角出发,提出一种网络安全主动防御体系。首先,基于情报收集、监测预警、防御指挥和防御行动等要素的详细描述,设计了用于规划主动防御系统的能力组成框架;其次,选择网络杀伤链、ATT&CK知识库和OODA循环法则,设计了一个以攻助防的防御模型,并分析了引入博弈论进行防御算法设计的优势;最后,以实现为目标,构想了一个典型应用场景,以期为安全能力的体系化设计提供有益借鉴。To address the problems of solidification of defense ability and insufficient flexibility in the defense-in-depth system,a cyber security active defense system is proposed from the perspective of attack-defense confrontation.First,based on the detailed description of the elements of intelligence collection,monitoring and early warning,defense command and defensive action,the ability composition framework for planning active defense system is designed.Then,network kill chain,ATT&CK knowledge base and OODA cycle rule are selected to design a defense model with attack to help defense,and the advantages of introducing game theory for defense algorithm design are analyzed.Finally,a typical application scenario is conceived with the goal of implementation,thus to provide useful reference for the systematic design of security abilities.

关 键 词：网络安全 攻防对抗 主动防御 ATT&CK OODA 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]