网络空间威胁情报感知、共享与分析技术综述

李建华

doi:10.11959/j.issn.2096-109x.2016.00028

您当前的位置：

首页 >

文章列表页 >

网络空间威胁情报感知、共享与分析技术综述

综述 | 更新时间：2024-06-03

- 网络空间威胁情报感知、共享与分析技术综述
- Overview of the technologies of threat intelligence sensing,sharing and analysis in cyber space
- 网络与信息安全学报 2016年2卷第2期页码：16-29
- 作者机构：
  
  上海交通大学信息安全工程学院，上海 200240
- 作者简介：
  
  [ "李建华（1965-），男，江西九江人，博士，上海交通大学信息安全工程学院院长、教授，主要研究方向为网络与信息安全技术包括网络信息安全管理理论及应用、内容安全管理理论及应用、电子政务理论及应用、网络攻防和信息系统安全评测理论及应用等。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61431008)
- DOI：10.11959/j.issn.2096-109x.2016.00028
  中图分类号： TP393
- 网络首发：2016-02，
  
  纸质出版：2016-02-15
- 稿件说明：
移动端阅览
李建华. 网络空间威胁情报感知、共享与分析技术综述[J]. 网络与信息安全学报, 2016,2(2):16-29.

Jian-hua LI. Overview of the technologies of threat intelligence sensing,sharing and analysis in cyber space[J]. Chinese Journal of Network and Information Security, 2016, 2(2): 16-29.
李建华. 网络空间威胁情报感知、共享与分析技术综述[J]. 网络与信息安全学报, 2016,2(2):16-29. DOI： 10.11959/j.issn.2096-109x.2016.00028.

Jian-hua LI. Overview of the technologies of threat intelligence sensing,sharing and analysis in cyber space[J]. Chinese Journal of Network and Information Security, 2016, 2(2): 16-29. DOI： 10.11959/j.issn.2096-109x.2016.00028.

摘要

在大数据、云计算、物联网等新型信息技术飞速发展的背景下，网络空间威胁也朝泛化和复杂化的趋势在发展，各类网络攻击也更加具有持续性和隐蔽性。基于威胁情报进行网络安全防御能够及时分析已发生的入侵，对未来威胁态势进行预判，并据此评估潜在的安全风险以指导用户制定有效的安全决策，系统化增强网络空间防御能力。威胁情报的范畴十分广泛，因此，介绍了威胁情报感知、共享和分析等方面的研究和发展。

Abstract

With a rapid development of information technologies including big data

cloud computing

Internet of things

etc.

the threats in cyber space also become more ubiquitous and complex.Moreover

more and more persis-tence and hidden features present in all kinds of network attacks.Threat intelligence based network defense can analyze the undergoing attacks and predict the threat situation in the future.Furthermore

based on the potential risk

users can define efficient security policy

thus the defense capabilities of the cyber space could be enhanced system-atically.Threat intelligence is a very wide research area.The research works and developments of the sensing

shar-ing and analysis for threat intelligence were studied and reviewed deeply.

关键词

Keywords

references

李建华 , 徐婧 . 信息安全内涵属性的系统性分析 [J ] . 信息网络安全 , 2007 ( 2 ): 70 - 78 .

LI J H , XU J . Systemic analysis of the connotation attributes of in-formation security [J ] . Netinfo Security , 2007 ( 2 ): 70 - 78 .

MITCHELL R , CHEN I R . Behavior rule specification-based intru-sion detection for safety critical medical cyber physical systems [J ] . IEEE Transactions on Dependable and Secure Computing , 2015 , 12 ( 1 ): 16 - 30 .

SHAKSHUKI E M , KANG N , SHELTAMI T R . EAACK-a secure intrusion-detection system for MANETs [J ] . IEEE Transactions on Industrial Electronics , 2013 , 60 ( 3 ): 1089 - 1098 .

陈华山 , 皮兰 , 刘峰 , 等 . 网络空间安全科学基础的研究前沿及发展趋势 [J ] . 信息网络安全 , 2015 ( 3 ): 1 - 5 .

CHEN H S , PI L , LIU F , et al . Research on frontier and trends of science of cybersecurity [J ] . Netinfo Security , 2015 ( 3 ): 1 - 5

HE H , LI R , DONG X , et al . Secure,efficient and fine-grained data access control mechanism for P2P storage cloud [J ] . IEEE Transac-tions on Cloud Computing , 2014 , 2 ( 4 ): 471 - 484 .

LIN Y D , LIN P C , YEH C H , et al . An extended SDN architecture for network function virtualization with a case study on intrusion prevention [J ] . IEEE Network , 2015 , 29 ( 3 ): 48 - 53 .

LIU A X , KHAKPOUR A R . Quantifying and verifying reachability for access controlled networks [J ] . IEEE/ACM Transactions on Networking , 2013 , 21 ( 2 ): 551 ~ 565 .

VALENZANO A . Industrial cybersecurity:improving security through access control policy models [J ] . IEEE Industrial Electron-ics Magazine , 2014 , 8 ( 2 ): 6 - 17 .

THIMMA M , LIU F , LIN J , et al . HyXAC:hybrid XML access control integrating view-based and query-rewriting approaches [J ] . IEEE Transactions on Knowledge and Data Engineering , 2015 , 27 ( 8 ): 2190 - 2202 .

CHEMINOD M , DURANTE L , SENO L , et al . Semiautomated verification of access control implementation in industrial net-worked systems [J ] . IEEE Transactions on Industrial Informatics , 2015 , 11 ( 6 ): 1388 - 1399 .

MITCHELL R , CHEN I R . Adaptive intrusion detection of mali-cious unmanned air vehicles using behavior rule specifications [J ] . IEEE Transactions on Systems,Man,and Cybernetics Systems , 2014 , 44 ( 5 ): 593 - 604 .

HAN S , XIE M , CHEN H H , et al . Intrusion detection in cy-ber-physical systems:techniques and challenges [J ] . IEEE Transac-tions on Dependable and Secure Computing , 2015 , 12 ( 1 ): 16 - 30 .

CHEN F , BRUHADESHWAR B , LIU A X . Cross-domain pri-vacy-preserving cooperative firewall optimization [J ] . IEEE/ACM Transactions on Networking , 2013 , 21 ( 3 ): 857 - 868 .

王鹃 , 王江 , 焦虹阳 , 等 . 一种基于OpenFlow的SDN访问控制策略实时冲突检测与解决方法 [J ] . 计算机学报 , 2015 , 38 ( 4 ): 872 - 883 .

WANG J , WANG J , JIAO H Y , et al . A method of OpenFlow-based real-time conflict detection and resolution for SDN access control policies [J ] . Chinese Journal of Computers , 2015 , 38 ( 4 ): 872 - 883 .

沈昌祥 , 张焕国 , 冯登国 , 等 . 信息安全综述 [J ] . 中国科学（E辑:信息科学） , 2007 , 37 ( 2 ): 129 - 150 .

SHEN C X , ZHANG H G , FENG D G , et al . Overview of cyber se-curity [J ] . Science in China (Series E) , 2007 , 37 ( 2 ): 129 - 150 .

中国信息通信研究院 . 网络与信息安全产业白皮书 [R/OL ] . http://www.catr.cn/kxyj/qwfb/bps/201512/P0201512233295442104 21.pdf http://www.catr.cn/kxyj/qwfb/bps/201512/P0201512233295442104 21.pdf

China Academy of Information and Communication Technology . White paper of network and information security industry [R/OL ] . http://www.catr.cn/kxyj/qwfb/bps/201512/P020151223329544210421.pdf http://www.catr.cn/kxyj/qwfb/bps/201512/P020151223329544210421.pdf .

GREECH J , HU J . A semantic approach to host-based intrusion detection systems using contiguous and discontiguous system call patterns [J ] . IEEE Transactions on Computers , 2014 , 63 ( 4 ): 807 - 819 .

MA X , CHEN Y . DDoS detection method based on Chaos analysis of network traffic entropy [J ] . IEEE Communications Letters , 2014 , 18 ( 1 ): 114 - 117 .

荆涛 , 李俊 . 基于相异度分析的网络通信异常行为识别方法 [J ] . 微电子学与计算机 , 2014 ( 6 ): 12 - 15 .

JING T , LI J . An identification method based on analysis of dis-similarity degree for network communication behavior [J ] . Microe-lectronics ＆ Computer , 2014 ( 6 ): 12 - 15 .

王慧强 , 赖积保 , 胡明明 , 等 . 网络安全态势感知关键实现技术研究 [J ] . 武汉大学学报：信息科学版 , 2008 ( 10 ): 995 - 998 .

WANG H Q , LAI J B , HU M M , et al . Research on the key realiza-tion technologies of network security situation awareness [J ] . Spec-troscopy and Spectral Analysis , 2008 ( 10 ): 995 - 998 .

赖积保 , 王颖 , 王慧强 , 等 . 基于多源异构传感器的网络安全态势感知系统结构研究 [J ] . 计算机科学 , 2011 , 38 ( 3 ): 144 - 149 .

LAI J B , WANG Y , WANG H Q , et al . Research on network secu-rity situation awareness system architecture based on multi-source heterogeneous sensors [J ] . Computer Science , 2011 , 38 ( 3 ): 144 - 149 .

唐勇 , 卢锡城 , 胡华平 , 等 . Honeypot技术及其应用研究综述 [J ] . 小型微型计算机系统 , 2007 ( 8 ): 1345 - 1351 .

TANG Y , LU X C , HU H P , et al . Honeypot technique and its ap-plications:a survey [J ] . Journal of Chinese Computer Systems , 2007 ( 8 ): 1345 - 1351 .

BRAGA R , MOTA E , PASSITO A . Lightweight DDoS flooding attack detection using NOX/OpenFlow[C]//The 38th Annual IEEE Conference on Local Computer Networks,Sydney . c 2010 : 408 - 415 .

FAYAZBAKHSH S K , SEKAR V , YU M , et al . FlowTags:enforc-ing network-wide policies in the presence of dynamic middlebox actions[C]//The Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking,Hong Kong,China . c 2013 : 19 - 24 .

HU Y L , SU W B , WU L Y , et al . Design of event-based intrusion detection system on OpenFlow network[C]//The 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks,Budapest . c 2013 : 1 - 2

TOOTOONCHIAN A , GHOBADI M , GANJALI Y . OpenTM:traffic matrix estimator for OpenFlow networks[C]//The 11th In-ternational Conference on Passive and Active Measurement,Zurich . c 2010 : 201 - 210 .

杨泽明 , 李强 , 刘俊荣 , 等 . 面向攻击溯源的威胁情报共享利用研究 [J ] . 信息安全研究 , 2015 ( 1 ): 31 - 36 .

YANG Z M , LI Q , LIU J R , et al . Research on the using of threat intelligence sharing facing attacking source [J ] . Journal of Informa-tion Security Research , 2015 ( 1 ): 31 - 36 .

. 2015 年网络安全威胁的回顾与展望 [EB/OL ] . http://www.antiy.com/response/2015_Antiy_Annual_Security_Report.html# http://www.antiy.com/response/2015_Antiy_Annual_Security_Report.html# .

Retrospect and prospect of network security threat in 2015 [EB/OL ] . http://www.antiy.com/response/2015_Antiy_Annual_Security_Report.html# http://www.antiy.com/response/2015_Antiy_Annual_Security_Report.html# .

Intelligence community information sharing strategy [EB/OL ] . Http://www.odni.gov/retorts/IC_Information_Sharing_Strategy.pdf Http://www.odni.gov/retorts/IC_Information_Sharing_Strategy.pdf .

LI J , LIU C , ZHOU R , et al . Quasi-SLCA based keyword query processing over probabilistic XML data [J ] . IEEE Transactions on Knowledge and Data Engineering , 2014 , 26 ( 4 ): 957 - 969 .

李玉翠 . 多源异构数据集成技术研究 [D ] . 西安:西安电子科技大学 , 2009 .

LI Y C . Research on multi-source heterogeneous data integration technologies [D ] . Xi’an:Xidian University , 2009 .

PADHYE V , TRIPATHI A . Scalable transaction management with snapshot isolation for NoSQL data storage systems [J ] . IEEE Trans-actions on Services Computing , 2015 , 8 ( 1 ): 121 - 135 .

LUO S , ZHANG G , WU G , et al . Boafft:distributed deduplication for big data storage in the cloud [J ] . IEEE Transactions on Cloud Computing , 2015 ( 12 ): 1 .

. 威胁情报共享的相关规范和标准 [EB/OL ] . http://www.secpulse.com/archives/34801.html?utm_source=tuicool＆utm_medium=referral http://www.secpulse.com/archives/34801.html?utm_source=tuicool＆utm_medium=referral .

Related specifications and standards of threat intelligence shar-ing [EB/OL ] . http://www.secpulse.com/archives/34801.html?utm_source=tuicool＆utm_medium=referral http://www.secpulse.com/archives/34801.html?utm_source=tuicool＆utm_medium=referral .

朱建明 , RAGHUNATHAN S . 基于博弈论的信息安全技术评价模型 [J ] . 计算机学报 , 2009 , 32 ( 4 ): 828 - 834 .

ZHU J M , RAGHUNATHAN S . Evaluation model of information security technologies based on game theoretic evaluation model of information security technologies based on game theoretic [J ] . Chi-nese Journal of Computers , 2009 , 32 ( 4 ): 828 - 834 .

宁烨 , 樊治平 , 冯博 . 知识联盟中知识共享的博弈分 [J ] . 东北大学学报（自然科学版） , 2006 , 27 ( 9 ): 1046 - 1049 .

NING Y , FAN Y P , FENG B . Game analysis of knowledge sharing in knowledge alliances [J ] . Journal of Northeastern Univer-sity(Natural Science) , 2006 , 27 ( 9 ): 1046 - 1049 .

LARSSON R , SPARKS J . The interorganizational learning dilemma:collective knowledge development in strategic alliances [J ] . Organization Science , 1998 , 9 ( 3 ): 285 - 305 .

杨威 , 班冬松 , 管东林 , 等 . 基于联盟构造博弈的认知无线电网络分布式多目标协作感知算法 [J ] . 计算机学报 , 2012 , 35 ( 4 ): 730 - 740 .

YANG W , BAN D S , GUAN D L , et al . Coalition formation based distributed algorithm for multi-objective cooperative sensing in cognitive radio networks [J ] . Chinese Journal of Computers , 2012 , 35 ( 4 ): 730 - 740 .

LANE P J , SALK J E , LYLES M A . Absorptive capacity,learning,and performance in international joint ventures [J ] . Strategic Man-agement Journal , 2001 , 22 ( 12 ): 1139 - 1161 .

SOEKIJAD M , ANDRIESSEN E . Conditions for knowledge shar-ing in competitive alliances [J ] . European Management Journal , 2003 , 21 ( 5 ): 578 - 587 .

伍佐福 . 能源消费国家间的能源国际合作：一种博弈的分析 [D ] . 上海：复旦大学 , 2007

WU Z F . A kind of game analysis of energy international coopera-tion between energy consumption countries [D ] . Shanghai:Fudan University , 2007 .

王永杰 , 鲜明 , 刘进 , 等 . 基于攻击图模型的网络安全评估研究 [J ] . 通信学报 , 2007 , 28 ( 3 ): 29 - 34 .

WANG Y J , XIAN M , LIU J , et al . Study of network security evaluation based on attack graph model [J ] . Journal on Communica-tions , 2007

肖道举 , 杨素娟 , 周开锋 , 等 . 网络安全评估模型研究 [J ] . 华中科技大学学报（自然科学版） , 2002 , 30 ( 4 ): 37 - 39 .

XIAO D J , YANG S J , ZHOU K F , et al . A study of evaluation model for network security [J ] . Journal of Huazhong University of Science and Technology (Nature Science) , 2002 , 30 ( 4 ): 37 - 39 .

BASS T . Multisensor data fusion for next generation distributed intrusion detection systems[C]//The Iris National Symposium on Sensor ＆ Data Fusion . c 1999 : 24 - 27 .

陈秀真 , 郑庆华 , 管晓宏 , 等 . 层次化网络安全威胁态势量化评估方法 [J ] . 软件学报 , 2006 , 17 ( 4 ): 885 - 897 .

CHEN X Z , ZHENG Q H , GUAN X H , et al . Research on a data classifying algorithm in threat assessment [J ] . Journal of Intelli-gence , 2006 , 17 ( 4 ): 885 - 897 .

王卓君 . 一种用于情报威胁评估的数据分类算法研究 [J ] . 情报杂志 , 2011 , 30 ( 10 ): 156 - 162 .

WANG Z J . Research on a data classifying algorithm in threat as-sessment [J ] . Journal of Intelligence , 2011 , 30 ( 10 ): 156 - 162 .

WU J , SHIMAMOTO S . Integrated UCON-based access control and adaptive intrusion detection for wireless sensor net-works[C]//The IEEE Global Communications Conference,Miami . c 2010 : 1 - 5 .

WU J , LIU S , ZHOU Z , et al . Toward intelligent intrusion predic-tion for wireless sensor networks using three-layer brain-like learn-ing [J ] . International Journal of Distribute Sensor Networks , 2012 , 27 ( 3 ): 327 - 352 .

卿斯汉 , 文伟平 , 蒋建春 , 等 . 一种基于网状关联分析的网络蠕虫预警新方法 [J ] . 通信学报 , 2004 , 25 ( 7 ): 62 - 70 .

QING S H , WEN W P , JIANG J C , et al . A new approach to fore-casting internet worms based on netlike association analysis [J ] . Journal of China Institute of Communications , 2004 , 25 ( 7 ): 62 - 70 .

孙钦东 , 张德运 , 高鹏 . 基于时间序列分析的分布式拒绝服务攻击检测 [J ] . 计算机学报 , 2005 , 28 ( 5 ): 767 - 773 .

SUN Q D , ZHANG D Y , GAO P . Detecting distributed denial of service attacks based on time series analysis [J ] . Chinese Journal of Computers , 2005 , 28 ( 5 ): 767 - 773 .

何清 , 李宁 , 罗文娟 , 等 . 大数据下的机器学习算法综述 [J ] . 模式识别与人工智能 , 2014 ( 4 ): 327 - 336 .

HE Q , LI N , LUO W J , et al . A survey of machine learning algo-rithms for big data [J ] . Pattern recognition and artificial intelligence , 2014 ( 4 ): 327 - 336 .

谢方军 , 唐常杰 , 元昌安 , 等 . 基于流数据分类和分形维分析的DoS 攻击检测 [J ] . 四川大学学报（工程科学版） , 2004 , 36 ( 6 ): 87 - 92 .

XIE F J , TANG C J , YUAN C A , et al . DoS attack detection based on classification of stream data and fractal dimension analysis [J ] . Journal of Sichuan University (Engineering Science Edition) , 2004 , 36 ( 6 ): 87 - 92 .

LIU M , MIAO L , ZHANG D . Two-stage cost-sensitive learning for software defect prediction [J ] . IEEE Transactions on Reliability , 2014 , 63 ( 2 ): 676 - 686 .

SHEPPERD M , BOWES D , HALL T . Researcher bias:the use of machine learning in software defect prediction [J ] . IEEE Transac-tions on Software Engineering , 2014 , 40 ( 6 ): 603 - 616 .

YANG X , TANG K , YAO X . A learning-to-rank approach to soft-ware defect prediction [J ] . IEEE Transactions on Reliability , 2015 , 64 ( 1 ): 234 - 246 .

HUANG W , SONG G , HONG H , et al . Deep architecture for traffic flow prediction:deep belief networks with multitask learning [J ] . IEEE Transactions on Intelligent Transportation Systems , 2014 , 15 ( 5 ).

JUANG C F , CHEN C Y . An interval type-2 neural fuzzy chip with on-chip incremental learning ability for time-varying data sequence prediction and system control [J ] . IEEE Transactions on Neural Networks and Learning Systems , 2014 , 25 ( 1 ): 216 - 228 .

CHAN K Y , DILLON T S . On-road sensor configuration design for traffic flow prediction using fuzzy nural networks and Taguchi method [J ] . IEEE Transactions on Instrumentation and Measurement , 2013 , 62 ( 1 ): 50 - 59 .

DING T , HIROSE A . Fading channel prediction based on combina-tion of complex-valued neural networks and chirp Z-transform [J ] . IEEE Transactions on Neural Networks and Learning Systems , 2014 , 25 ( 9 ): 1686 - 1695 .

LOPEZ-GARIA P , ONIEVA E , OSABA E , et al . A hybrid method for short-term traffic congestion forecasting using genetic algo-rithms and cross entropy [J ] . IEEE Transactions on Intelligent Transportation Systems , 2016 , 17 ( 2 ): 557 - 569 .

刘云龙 , 李人厚 . 发现和学习不可复位动态系统的预测状态表示的一种新算法 [J ] . 电子学报 , 2009 , 37 ( 1 ): 126 - 131 .

LIU Y L , LI R H . A new algorithm for discovery and learning of predictive state representations in dynamical systems without re-set [J ] . Acta Electronica Sinica , 2009 , 37 ( 1 ): 126 - 131 .

LUO X , LV Y , CHEN Y . Web service QoS prediction based on adaptive dynamic programming using fuzzy neural networks for cloud services [J ] . IEEE Access , 2015 , 3 : 2260 - 2269 .

浏览量

1408

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

网络威胁安全数据可视化综述

基于人工智能的期货交易风险评估与预警方法

金融数据安全治理智能化技术与实践

基于隐私风险评估的脱敏算法自适应方法

本科“机器学习”课程教学改革初探