本体论在网络安全态势感知中的应用

The Application of Ontology in Network Security Situation Awareness

网络安全态势感知是有效实施网络安全监管的重要途径,对网络做出准确、全面的描述,是进行网络安全态势感知的前提,但目前缺乏对网络安全态势知识的有效表示;本体论是知识表示的重要方法,但信息安全领域引入本体论的相关研究,主要集中在构建基本的安全本体、通用的方法,或针对特定子领域构建安全本体,缺乏推理规则,不能直接应用于网络安全态势感知。针对上述问题,本文提出使用本体论方法建立网络安全态势要素知识库,从而实现海量安全数据的有效融合和协同管理。

Network security situation awareness（NSSA） is an important way for network security supervision. Accurate and comprehensive description of network is a prerequisite for NSSA. However, it lacks effective representation of network security situation knowledge. Ontology is an important method of knowledge representation. But the related research on the ontology in the field of information security, mainly focuses on constructing basic security ontology and general methods, or constructing security ontology for specific sub-domains, lacking inference rules, and cannot directly apply to NSSA. In view of the above problems, this paper proposes to use ontologies to establish a knowledge base of network security situation elements, and achieve effective integration and collaborative management of massive security data.