网络安全检测框架与方法研究

Frameworks and methods of cybersecurity detection

网络和信息系统已经成为关键基础设施乃至整个经济社会的核心,一旦遭受攻击破坏、发生重大安全事件,将严重危害国家经济安全和公共利益。如何检测网络攻击行为,保障网络基础设施的安全,是保障核心技术装备安全可控,构建国家网络安全保障体系的核心环节。系统地介绍了针对入侵检测框架、特征自动生成、安全检测理论及方法、网络拓扑监控与网络路由控制等问题已取得的若干创新成果,梳理出网络安全检测算法和框架、无线网络安全检测、网络监控和安全增强等若干科学发现,最后总结了网络安全检测与控制技术发展趋势。

Network and information systems are developed as the core of key infrastructures, econo-my and society. Once such systems are attacked by adversaries or severe security events, the security of national economy and the common value of the society can suffer from adverse impacts. Hence, how to detect network threats and how to ensure the security of network infrastructure are vital for protecting key technologies and constructing national cybersecurity assurance systems. We systematically review several studies on intrusion detection framework, automatic signature generation, security detection the-ories and methods, network topology monitoring and routing control. Furthermore, we summarize several scientific findings, such as cybersecurity detection algorithm and framework, wireless network secu-rity detection, network monitoring and security enhancement. Finally, we discuss several interesting future directions on cybersecurity detection and control.