基于APT攻击链的网络安全态势感知

Research of cyber security situation awareness base on APT attack chain

为提升应对APT攻击的安全防御能力,信息网络安全态势感知技术越来越被关注,以实现安全事件的预测与预防。文章从该角度出发分析网络安全态势感知研究的必要性,从网络安全态势感知研究框架出发,详细阐述目前国内外网络安全态势感知研究的体系结构和主要方法,对网络安全态势感知技术进行了归纳总结并对未来感知技术的趋势进行了展望。

In order to improve the defense ability of information security for APT attack, more and more attentions is put on the information network security situation awareness technology in order to realize the prediction and prevention of security events. This paper analyzes the necessity of studying the network security situation awareness technology. The architecture, methods and key algorithms in the existing domestic and overseas research works in this field are described in detail. Finally this paper summarizes the network security situation awareness technology and looks forward to its development trend.