Abstract:

[Objective] In the current trend of gradual integration of cyberspace, physical space, and social space, important industry departments have accumulated a large amount of network security data in network security protection. Cyberspace security map warfare driven by Data and Business plays a very significant role in grasping the base number of assets, improving the effectiveness of data governance, and enhancing the effectiveness of network security protection, and can support network security protection and security work in an omni-directional way. [Methods] Driven by the construction of cyberspace security map warfare capability in important industries, this paper proposes an overall technical framework including an element extraction layer, a map design layer, and an intelligent cognitive layer, including entity/relationship extraction technology for threat intelligence information, automatic mapping technology for network assets, network behavior monitoring and modeling technology, intelligent mining and reasoning technology, visual expression technology and other key technical methods. It has been applied at a certain department of the electric power industry. [Results] The technical framework can be used to build a cyberspace geographic map for network security protection services, and support an omni-directional, cross-space network security monitoring and discovery, situation awareness, event handling, and emergency response. [Conclusions] The application of the cyberspace security map based on the network security geographic map has good application value and promotion prospects, and can intuitively display cross-space data, elements, and business relationships. However, it is still necessary to explore new methods and models in the field of business practice to improve the actual combat effectiveness of the cyberspace security map.

Key words: cyberspace security, cyberspace security map, knowledge graph, surveying and mapping technology for cyberspace asset