Abstract:

With the increasing inequality of network attack and defense in the Internet era, threat intelligence has become one of the important tools to narrow this gap.Based on the analysis of the research status of threat intelligence at home and abroad, a set of construction methods of threat intelligence systems suitable for telecom operators were proposed, including six steps: intelligence planning, intelligence production, intelligence analysis, intelligence management, intelligence sharing and intelligence application.Meanwhile a set of multi-source intelligence fusion assessment mechanisms was presented, and the technologies and methods were systematically expounded involved in the four stages of intelligence aggregation analysis, intelligence reputation analysis, intelligence correlation analysis and intelligence aging analysis, so as to help the telecom operators build the ability of intelligence fusion analysis.At the same time, the principles of intelligence production and synchronous application were given for intrusion and loss intelligence, which provided a useful reference for telecom operators to apply threat intelligence technology to build a security protection system.

Key words: threat intelligence, intelligence analysis, intelligence production, intelligence application, telecom operator