关键词: 网络安全, 威胁情报, 威胁情报共享标准, 威胁情报标准建设

Abstract: Threat intelligence can help organizations to study the possible security situation and situation, and make security decisions and emergency response accordingly. However, in order to effectively utilize all kinds of threat intelligence, the expression of threat intelligence needs to be normalized and standardized. The United States has long established and operated a complete set of threat intelligence standard system, while the construction of China's standard system is still in its infancy. This paper summarizes the standardization work of some international countries (organizations) in the field of cyber threat intelligence, and makes a comparative analysis of China's national standard and the American STIX standard from four aspects, such as release history, model framework, information examples and platform application. This paper summarizes the advantages of the standardization of cyber threat intelligence in the United States in terms of project positioning, model construction and ecological construction, and puts forward three suggestions for the standardization of China in the future.

Key words: network security, threat intelligence, threat intelligence sharing standards, threat intelligence standard building