Abstract: Threat intelligence can help organizations to study the possible security situation and situation, and make security decisions and emergency response accordingly. However, in order to effectively utilize all kinds of threat intelligence, the expression of threat intelligence needs to be normalized and standardized. The United States has long established and operated a complete set of threat intelligence standard system, while the construction of China's standard system is still in its infancy. This paper summarizes the standardization work of some international countries (organizations) in the field of cyber threat intelligence, and makes a comparative analysis of China's national standard and the American STIX standard from four aspects, such as release history, model framework, information examples and platform application. This paper summarizes the advantages of the standardization of cyber threat intelligence in the United States in terms of project positioning, model construction and ecological construction, and puts forward three suggestions for the standardization of China in the future.

Key words: network security, threat intelligence, threat intelligence sharing standards, threat intelligence standard building

摘要： 威胁情报能够帮助组织研判可能面临的安全现状与态势,并由此制定安全决策与应急响应.而面对威胁情报多样性内容导致情报素材本身的异构性问题,若要高效地利用各种威胁情报,首先需要对威胁情报的表达进行规范化和标准化.美国早已建立并运营起一套完整的威胁情报标准体系,而我国标准体系的建设尚处于起步阶段.本文总结概述了国际上部分国家(组织)在网络威胁情报领域开展的标准化工作,并从发布历程、模型框架、信息示例、平台应用等四个方面对我国国家标准与美国STIX标准进行了对比分析.归纳出美国网络威胁情报标准化工作分别在项目定位、模型建设、生态搭建上可借鉴的长处,并对我国今后的标准化建设提出三点建议.

关键词: 网络安全, 威胁情报, 威胁情报共享标准, 威胁情报标准建设