数据与计算发展前沿 ›› 2024, Vol. 6 ›› Issue (1): 125-135.

CSTR: 32002.14.jfdc.CN10-1649/TP.2024.01.012

doi: 10.11871/jfdc.issn.2096-742X.2024.01.012

• 技术与应用 • 上一篇    下一篇

网络安全挂图作战实践

胡威1(),张海霞2,*(),夏昂1,魏家辉1,连一峰2   

  1. 1.国家电网有限公司信息通信分公司，北京 100761
    2.中国科学院软件研究所，可信计算与信息保障实验室，北京 100190
  • 收稿日期:2022-12-02 出版日期:2024-02-20 发布日期:2024-02-21
  • 通讯作者: * 张海霞（E-mail: haixia@iscas.ac.cn）
  • 作者简介:胡威，国家电网有限公司信息通信分公司网络安全监控中心，主任，长期从事网络信息安全态势感知与实时监控分析，主要研究方向为网络信息安全、态势感知。
    本文负责制定论文框架，撰写“技术架构”“小结”部分，负责论文修改、审定。
    HU Wei, director of Network Security Monitoring Center of Information and Communication Branch of State Grid Corporation of China, has been engaged in network information security situation awareness and real-time monitoring analysis for a long time. His main research direction is networks information security and situation awareness.
    In this paper, he is responsible for formulating the paper framework, writing “Technical Architecture” and “Summary”, and revising and approving the paper.
    E-mail: huw2022@126.com|张海霞，中国科学院软件研究所， 高级工程师，博士，长期从事网络及信息安全技术研究、规划设计与工程建设工作，主要研究方向包括信息安全测评技术、等级保护关键技术、网络安全监测预警技术等，先后承担国家863计划、国家发改委、公安部、国家测评中心、认证中心等国家级、部委级重要科技项目20余项，在核心学术期刊发表多篇论文，申请多项国家发明专利。
    本文中负责网络安全挂图作战关键技术研究，负责撰写“关键技术”“网络安全挂图作战应用”部分。
    ZHANG Haixia, Ph.D., is a senior engineer at Institute of Software, Chinese Academy of Sciences. She has long been engaged in cyber and information security technology research, planning, design and engineering construction. Her key research directions include information security evaluation technology, classified protection key technology, network security monitoring, and Pre-warning Technology, etc. She has successively undertaken the National 863 program, and more than 20 other national and ministerial level important science and technology projects from the national development and Reform Commission, Ministry of public security, and national evaluation center Certification Center. She has published many papers in core academic journals and applied for a number of national invention patents.
    In this paper, she is responsible for the research on key technologies of cyberspace security map warfare， and for writing “key technologies” and “application of cyberspace security map warfare”.
    E-mail: haixia@iscas.ac.cn
  • 基金资助:
    国家电网科技项目“面向挂图作战的可视化网络安全对抗关键技术研究”(529939220002);国家重点研发计划课题“基于网络空间地理图谱的网络安全行为智能认知技术研究”(2020YFB1806504)

Practice of Cyberspace Security Map

HU Wei1(),ZHANG Haixia2,*(),XIA Ang1,WEI Jiahui1,LIAN Yifeng2   

  1. 1. State Grid Information & Telecommunication Branch, Beijing 100761, China
    2. Trusted Computing and Information Assurance Laboratory, Institute of Software, Chinese Academy of Sciences, Beijing 100190, China
  • Received:2022-12-02 Online:2024-02-20 Published:2024-02-21

RichHTML

21

PDF

75

摘要：

【目的】随着当前网络空间与物理空间和社会空间逐步融合的趋势，重要行业部门在网络安全保护工作中积累了大量的网络安全数据，数据和业务驱动的网络安全挂图作战对掌握资产底数、改善数据治理成效、提升网络安全保护效能具有非常明显的作用，可全方位支撑网络安全保护和保障工作。【方法】本文以重要行业开展网络安全挂图作战能力建设为驱动，提出了包含要素抽取层、图谱设计层和智能认知层在内的整体技术架构，包括针对威胁情报信息的实体/关系抽取技术、针对网络资产的自动测绘技术、网络行为监测与建模技术、智能挖掘推理技术以及可视化表达技术等关键技术方法，并在电力行业某部门进行了实践应用。【结果】该技术框架可用于构建面向网络安全保护业务的网络空间地理图谱，支撑全方位、跨空间的网络安全监测发现、态势感知、事件处置和应急响应实战。【结论】基于网络安全地理图谱的挂图作战应用具有很好的应用价值和推广前景，能够直观展示跨空间的数据、要素和业务关系，但仍需要探索业务实战领域的新方法和新模型，以提升网络安全挂图的实战效能。

关键词: 网络空间安全, 网络安全挂图, 知识图谱, 资产测绘技术

Abstract:

[Objective] In the current trend of gradual integration of cyberspace, physical space, and social space, important industry departments have accumulated a large amount of network security data in network security protection. Cyberspace security map warfare driven by Data and Business plays a very significant role in grasping the base number of assets, improving the effectiveness of data governance, and enhancing the effectiveness of network security protection, and can support network security protection and security work in an omni-directional way. [Methods] Driven by the construction of cyberspace security map warfare capability in important industries, this paper proposes an overall technical framework including an element extraction layer, a map design layer, and an intelligent cognitive layer, including entity/relationship extraction technology for threat intelligence information, automatic mapping technology for network assets, network behavior monitoring and modeling technology, intelligent mining and reasoning technology, visual expression technology and other key technical methods. It has been applied at a certain department of the electric power industry. [Results] The technical framework can be used to build a cyberspace geographic map for network security protection services, and support an omni-directional, cross-space network security monitoring and discovery, situation awareness, event handling, and emergency response. [Conclusions] The application of the cyberspace security map based on the network security geographic map has good application value and promotion prospects, and can intuitively display cross-space data, elements, and business relationships. However, it is still necessary to explore new methods and models in the field of business practice to improve the actual combat effectiveness of the cyberspace security map.

Key words: cyberspace security, cyberspace security map, knowledge graph, surveying and mapping technology for cyberspace asset