面向行为的内网空间安全态势建模与分析

Behavior-oriented inside network security situation modeling and analysis

依据态势的一般理论,结合内网安全的特点,将内网空间划分为物理域、信息域、社会域,提出了面向行为的内网安全态势——PMDV模型。该模型抽象出内网空间物理域和信息域中人(P)、机(M)、数据(D)、虚拟实体(V)等4类行为主体,各类主体及其交互定义态势中的核心要素——行为,为面向行为的内网空间安全态势构建提供了依据。在此基础上,进一步给出了面向行为的内网空间安全态势分析平台的结构设计及其实现途径。

According to the situation awareness theory as well as the characteristics of the inside network security, a PMDV model for behavior-oriented inside network security situation modeling by dividing the inside network space into physical domain, information domain and social domain was proposed. A sound base for situation modeling of inside network security, which classified the entities inside the network space into the following 4 classes： person（P）, machine（M）, data（D） and virtual agent（V）, was provided and the core element ＂behavior＂ in situation model with the interactions between different PMDV entities was defined. The structure and implementation guideline of the situation analysis platform based on PMDV model were also presented and studied.