威胁体智能孪生技术及其在网络防御指挥控制上的应用

Threat Twin Technology and Its Applications in Cyber Defense Command and Control

针对持久性对抗下网络防御指挥控制的动态情报、快速响应以及协同机制等现实需求,基于平行智能理论提出威胁体智能孪生技术,以威胁认知建模框架作为威胁孪生模型的基础,以身份映射补全技术补全威胁特征,以威胁行为孪生技术探索多重平行数字空间.威胁体智能孪生技术以数字化形式动态耦合指挥控制流和情报流,重塑一种新的网络防御平行指挥控制模式,以支撑方案量化分析、实时风险评估以及持久性对抗下的体系防御,实现网络防御的平行智能.

Cyber defense requires dynamic intelligence,rapid response and coordination mechanism under persistent confrontation.Aiming at those requirements,threat twin technology is proposed which combines with parallel intelligence theory.Threat cognition modeling framework is the basic of threat twin model.Identity mapping completion technology is used to complete information of threats;The twin technology of threat behavior explores multiple parallel digital spaces.Threat twin technology dynamically couples the C2 flow and intelligence flow,reshaping a new cyber defense C2 parallel mode to support quantitative analysis of solutions,real-time risk assessment,and system defense under persistent confrontation,and realize the parallel intelligence of cyber defense.