面向电力网络战的威胁情报感知研究

Research on threat intelligence perception for Power-cyber warfare

随着全球网络空间的攻防博弈愈加频繁,针对电力系统等关键基础设施发起的攻击具有攻击目的明确、攻击方法多样且隐蔽、攻击识别难度大等特点.与情报在传统战争中的作用类似,威胁情报在电力网络战中的战略性地位不容小觑.本文以威胁情报为切入点,提出面向电力网络战的威胁情报技术框架,梳理威胁情报采集、处理、分析及应用等关键技术,旨在提升电力系统在高级威胁检测、攻击行为溯源以及攻击预测等方面的能力,为电力系统主动防御体系提供借鉴,以期有效应对电力网络战.

With the increasing frequency of offensive and defensive games in global cyberspace,attacks on critical infrastructure such as power systems have the characteristics of clear attack objectives,diverse and covert attack methods,and difficulty in identifying attacks.Similar to the role of intelligence in traditional warfare,the strategic position of threat intelligence in power network warfare cannot be underestimated.Taking threat intelligence as the starting point,this paper proposes a threat intelligence technical framework for power network warfare,and sorts out key technologies such as threat intelligence collection,processing,analysis and application,aiming to improve the power system's capabilities in advanced threat detection,attack behavior traceability and attack prediction,and pro⁃vide reference for the power system active defense system,in order to effectively deal with power network warfare.