A Study of Big Data Platform Architecture to Address Cybersecurity Protection and Defense

Abstract

Abstract: The increasingly serious situation of cybersecurity keeps challenging the protection and defense of information systems against vulnerabilities and cyber attacks. The network flows and data with high volume and large variety bring even more issues to the information system protection in terms of cybersecurity situation awareness, crisis handling, etc. Thus, the cybersecurity technology and the information system architecture should have timely and continuous improvement in order to deal with situation changes. By analyzing the cybersecurity abilities of a information system and the big data technologies, this study proposes 3 main features of a big data platform for cybersecurity concerns: cybersecurity situation awareness, decision support for handling cybersecurity crises and cybersecurity system optimization, and therefore provides the technical architecture of the platform that aims at addressing cybersecurity protection and defense. A big data platform based on the proposed architecture can improve the foresight and the accuracy of the situation awareness, ensure the real-time performance and the effectiveness of the crisis handling and guarantee the technological advancement and the versatility of the information system architecture towards cybersecurity considering the timeliness in its optimization.

Key words: cybersecurity, big data, situation awareness, crisis handling, decision support, system optimization

摘要： 近年来，日益严峻的网络安全形势对信息系统的网络安全防御防护能力提出了更高的要求. 大量且多样的网络数据使得网络攻击的态势感知、应急处置等防御环节面临挑战. 因此，网络安全技术以及网络安全架构设计也应在此趋势下做出及时和持续的改进. 本文通过对网络安全防御防护能力和大数据技术的研究，提出了以态势感知、应急处置决策支持和网络安全系统智能优化为主的网络安全大数据平台功能需求，并设计了平台的技术架构. 基于该架构建设的网络安全大数据平台可以提高网络威胁态势感知的前瞻性和准确性、网络事件应急处置的实时性和有效性、网络安全体系架构的前沿性和全面性以及架构优化调整的及时性.

关键词: 网络安全, 大数据, 态势感知, 应急处置, 决策支持, 系统优化

王逸鹤黄亦芃. 面向网络安全防御防护的大数据平台架构研究[J]. 信息安全研究, 2021, 7(1): 75-80.

References

Demchenko Y, Laat C D, Membrey P. Defining architecture components of the big data ecosystem[C]//Proc of the 2014 Int Conf on Collaboration Technologies & Systems. Piscataway, NJ: IEEE, 2014: 104-112 [2] Stonebraker M, Cetintemel U, Zdonik S. The 8 requirements of real-time stream processing[J]. ACM SIGMOD Record, 2005, 34(4): 42-47 [3] Dua S, Du X. Data Mining and Machine Learning in Cybersecurity[M]. USA: CRC press, 2016 [4] Li Jianhua. Cyber security meets artificial intelligence: A survey[J]. Frontiers of Information Technology & Electronic Engineering, 2018, 19: 1462-1474 [5] Ten C W, Hong J, Liu C C. Anomaly Detection for Cybersecurity of the Substations[J]. IEEE Trans on Smart Grid, 2011, 2(4): 865-873 [6] 王建民. 领域大数据应用开发与运行平台技术研究[J]. 软件学报, 2017, 28(6): 1516-1528 [7] 管磊, 胡光俊, 王专. 基于大数据的网络安全态势感知技术研究[J]. 信息网络安全, 2016(9): 45-50 [8] 琚安康, 郭渊博, 朱泰铭. 基于开源工具集的大数据网络安全态势感知及预警架构[J]. 计算机科学, 2017, 44(5): 125-131 [9] Golovko V A. Deep learning: An overview and main paradigms[J]. Optical Memory and Neural Networks, 2017, 26(1): 1-17 [10] Dada E G. A hybridized SVM-kNN-pdAPSO approach to intrusion detection system[C]//Proc of the Faculty Seminar Series. Maiduguri, Nigeria: University of Maiduguri, 2017: 14-21 [11] Hong Y, Huang C, Nandy B, et al. Iterative-tuning support vector machine for network traffic classification[C]//Proceedings of the 2015 IFIP/IEEE Int Symp on Integrated Network Management. Piscataway, NJ: IEEE, 2015: 458-466 [12] Alrawashdeh K, Purdy C. Toward an online anomaly intrusion detection system based on deep learning[C]//Proc of the 2016 15th IEEE Int Conf on Machine Learning and Applications. Piscataway, NJ: IEEE, 2016: 195-200 [13] Staudemeyer R C. Applying long short-term memory recurrent neural networks to intrusion detection[J]. South African Computer Journal, 2015, 56(1): 136-154 [14] Yu Yang, Long Jun, Cai Zhiping. Network intrusion detection through stacking dilated convolutional autoencoders[J]. Security and Communication Networks, 2017

[1]	. A Method of User Behavior Analysis Based on Network Flow and Log in Private Network [J]. Journal of Information Security Research, 2020, 6(9): 0-0.
[2]	. Research on the mMTC Security of 5G New Infrastructure [J]. Journal of Information Security Research, 2020, 6(8): 710-715.
[3]	. Research on railway network security evaluation system [J]. Journal of Information Security Research, 2020, 6(8): 738-743.
[4]	. A Situation Awareness Conceptual Model for Advanced Persistent Threat [J]. Journal of Information Security Research, 2020, 6(6): 0-0.
[5]	. Research and application of remote mobile office security standard [J]. Journal of Information Security Research, 2020, 6(6): 0-0.
[6]	. Survey of Security Situation Prediction Technology Based on Artificial Intelligence [J]. Journal of Information Security Research, 2020, 6(6): 0-0.
[7]	. Application of Situation Awareness in E-government Information Security [J]. Journal of Information Security Research, 2020, 6(6): 0-0.
[8]	. A Study of Civil Aviation Network Security Situation Awareness Technology Based on "Business + Data" Perspective [J]. Journal of Information Security Research, 2020, 6(6): 0-0.
[9]	. Research on Security Architecture for Cloud Data Center [J]. Journal of Information Security Research, 2020, 6(6): 0-0.
[10]	. Research on Cloud Security System Based on Big Data Security Technology [J]. Journal of Information Security Research, 2020, 6(5): 404-420.
[11]	. Research on The Harm of Data Hegemony to Countries and Individuals and The Countermeasures [J]. Journal of Information Security Research, 2020, 6(5): 448-453.
[12]	. Research and Implementation of Security Model of Telecommuting System Based on Zero Trust [J]. Journal of Information Security Research, 2020, 6(4): 289-295.
[13]	. A cloud computing cybersecurity method based on security domain [J]. Journal of Information Security Research, 2020, 6(4): 362-366.
[14]	. Research on Security Situation Awareness Model Based on Payment Scenario of Financial Industry [J]. Journal of Information Security Research, 2020, 6(3): 235-243.
[15]	. Analysis of China's Personal Information Rrights Protection System in the Era of Big Data Based on the Background of Government Data Fusion [J]. Journal of Information Security Research, 2020, 6(12): 1088-1100.