一种基于免疫学的信息安全威胁预警方法  

An information security threat warning method based on immunology

作　　者：李茹 杨慧锋 翟书颖 LI Ru;YANG Hui-feng;ZHAI Shu-ying(College of Information Engineering,Xi’an Mingde Institute of Technology,Xi’an 710124,China;Bank of Chang’an Co.,Ltd.,Xi’an 710075,China)

机构地区：[1]西安明德理工学院信息工程学院,西安710124 [2]长安银行股份有限公司,西安710075

出　　处：《信息技术》2024年第9期111-119,共9页Information Technology

基　　金：西安明德理工学院科研基金项目(2022XY01L02,2021-XY01L02);陕西省教育厅专项科研计划项目(21JK-0813);国家自然科学基金面上项目(61671379)。

摘　　要：为提升信息安全威胁预警准确度和事件响应速度,模拟生物免疫系统组织、结构、功能及识别自我排除非己等机制,提出一种信息安全威胁预警方法。首先部署入侵检测节点,设置关联规则;接着刻画信息系统正常行为轨迹,设置数据流转区域及路径规则,运用马尔科夫链、有限状态自动机等算法,设置数据流转时空规则;然后围绕资产脆弱性及中观态势,设置预警攻击向量。入侵与已设置规则匹配时,及时预警或处置威胁。实践表明,该方法可有效降低人员的技能依赖,提升人员的事件响应速度,具有一定推广价值。In order to improve the accuracy of information security threat warning and the speed of event response,an information security threat warning method is proposed to simulate the organization,structure and function of biological immune system and identify and exclude non-self mechanism.Firstly,the intrusion detection node is deployed and the association rules are set.Then,the information system’s normal behavior trajectory is described,the data flow area and path rules are set,and Markov chain,finite state automata and other algorithms are used to set the data flow space-time rules.Then,the early warning attack vector is set up around the asset vulnerability and the mid-view situation.If the intrusion matches the configured rules,the system timely alerts or handles threats.The practice shows that this method can effectively reduce the skill dependence of personnel and improve the incident response speed of personnel,which has a certain popularization value.

关 键 词：生物免疫系统 信息安全威胁预警 规则 马尔科夫链 有限状态自动机 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]