关键词: 网络安全, 入侵检测, 态势感知, 典型模型, 标准架构

Abstract: As the real-time guardian of the network security, network security situation awareness platform is the main means to realize "all-weather and all-round awareness of the network security situation". However, being different from the traditional firewall, intrusion detection, security audit and other functions of relatively fixed products, the concept and application of the network security situation awareness is much more complex. Based on the investigation of typical models of network security situation awareness at home and abroad, this paper presents the standard framework of network security situation awareness, focusing on the problems faced by organizations in building network security situation awareness capability and manufacturers in developing and designing network security situation awareness products. It can provide basis for the network security situation awareness R & D, production and testing units to carry out standardized scientific research, production and testing.

Key words:  , network security, intrusion detection, situation awareness, typical model, standard architecture