关键词: 电力, 主动防御, 溯源, 网络安全, APT组织

Abstract: At present, the international situation is complex and changeable, new social conflicts and contradictions are constantly arising in the transition period of the domestic society, and hostile forces are trying in vain to destroy the Critical Information Infrastructures (CII) of our country,  resulting in adverse social impacts. The existing defense measures based on the existing network attack detection and defense are not flexible and require high comprehensiveness of the defense system. Therefore, this thesis proposes an active defense method for electric power industry network security based on attack behaviors. By analyzing the attack behavior of attackers, combines ATT&CK attack framework model to carry out intermittent attack attempts against Advanced Persistent Threat (APT) organizations through layer upon layer forwarding of a large number of springboard nodes. Until the breakthrough and springboard node are found, the attack behavior and problems that may occur before or during the attack. The springboard, organization or personal information of the attacker at all levels is discovered in advance, and the attack behavior is discovered and blocked in advance in the stage of the attacker’s reconnaissance, so as to realize the active defense against the attack behavior.

Key words: electric power, active defense, traceability, network security, APT organization