信息安全研究 ›› 2022, Vol. 8 ›› Issue (8): 845-.

• 学术论文 • 上一篇    

基于知识图谱的网络空间安全威胁感知技术研究

石波1于然1,2朱健2   

  1. 1(北京计算机技术及应用研究所北京100854)
    2(江苏航天七零六信息科技有限公司南京210012)
  • 出版日期:2022-08-08 发布日期:2022-08-08
  • 通讯作者: 石波 硕士,高级工程师.主要研究方向为信息安全、网络安全态势感知. shibookok@163.com
  • 作者简介:石波 硕士,高级工程师.主要研究方向为信息安全、网络安全态势感知. shibookok@163.com 于然 硕士,研究员.主要研究方向为物联网安全. yuran_ht706@casic.com.cn 朱健 硕士,工程师.主要研究方向为软件安全、软件工程. zhujian_ht706@casic.com.cn

  • Online:2022-08-08 Published:2022-08-08

摘要: 针对安全威胁情报存在来源复杂、不易理解、难以共享等问题,基于受限玻尔兹曼机实现威胁情报特征深度学习,将原始威胁情报特征从高维空间逐层向低维空间映射,构建网络空间安全威胁知识图谱.进而利用网络空间安全威胁知识图谱,结合当前上下文情境,基于事件流处理进行安全威胁路径演化和追踪溯源,精准感知网络空间安全威胁.实验验证了构建网络空间安全威胁知识图谱的可行性,并通过与传统威胁检测方法对比,验证了基于知识图谱的安全威胁感知方法更适用于对高强度安全威胁的感知.

关键词: 知识图谱, 威胁情报, 受限玻尔兹曼机, 安全威胁感知, 威胁检测

Abstract: Aiming at the problems of complex sources, difficult to understand and share security threat intelligence, this paper realizes deep learning of threat intelligence features based on restricted Boltzmann machine, which maps the original threat intelligence features from high dimensional space to low dimensional space layer by layer, and constructs the cyberspace security threat knowledge map. By using the cyberspace security threat knowledge map, and combining with the current context, the path evolution and tracing of security threats are carried out through event flow processing to accurately perceive cyberspace security threats. The experiment verifies the feasibility of constructing the cyberspace security threat knowledge map, and verifies the security threat perception method based on the knowledge map is more suitable for the perception of highintensity security threats by comparing with traditional threat detection methods.

Key words: knowledge map, threat intelligence, restricted Boltzmann machine, security threat perception, threat detection