基于大数据和威胁情报的网络攻击防御体系研究

Research on Cyber-Attack Defense System Based on Big Data and Threat Intelligence

网络攻击是利用网络存在的漏洞和安全缺陷对网络系统的硬件、软件及其系统中的数据进行的攻击,对网络系统具有极大的危害,越早在杀伤链中识别攻击并进行事件响应就越有机会最大降低网络攻击造成的损害.传统的网络入侵系统(intrusion detection systems,IDS)在监测网络攻击时,对网络攻击链中入侵后的行为进行识别,存在被动防护且威胁识别能力有限等局限性.威胁情报技术提供了一种对网络攻击行为进行威胁识别的更科学有效方法,利用对威胁情报进行各种汇聚关联并进行综合分析等大数据分析技术,实现主动防御、及时响应、覆盖网络攻击链的所有阶段,为网络攻击防御的全面性、综合性、相关性提供了综合保障模型.

Cyber-attacks are the use of network vulnerabilities and security flaws to attack the hardware,software and data of a cyber system. The earlier a cyber-attack is identified,the less adverse effect it has. The traditional network intrusion detection system (IDS) has some limitations in detecting cyber-attacks,such as passive protection and limited capability of threat identification. Threat intelligence technology provides a more scientific and effective method for identifying potential or actual cyber-attacks by using big data analysis,and provides a comprehensive and relevant cyber-attack defense model.