天地一体化信息网络安全动态赋能架构

doi:10.11959/j.issn.1000-436x.2021180

通信学报 ›› 2021, Vol. 42 ›› Issue (9): 87-95.doi: 10.11959/j.issn.1000-436x.2021180

天地一体化信息网络安全动态赋能架构

张玲翠¹^,², 许瑶冰¹^,², 李凤华¹^,², 房梁¹, 郭云川¹, 李子孚¹

¹ 中国科学院信息工程研究所，北京 100195
² 中国科学院大学网络空间安全学院，北京 100049

修回日期:2021-03-09 出版日期:2021-09-25 发布日期:2021-09-01
作者简介:张玲翠（1986− ），女，河北故城人，中国科学院信息工程研究所博士生、高级工程师，主要研究方向为网络与系统安全
许瑶冰（1996− ），女，湖北武汉人，中国科学院信息工程研究所博士生，主要研究方向为网络安全
李凤华（1966− ），男，湖北浠水人，博士，中国科学院信息工程研究所研究员、博士生导师，主要研究方向为网络与系统安全、信息保护、隐私计算
房梁（1989− ），男，山西太原人，博士，中国科学院信息工程研究所副研究员，主要研究方向为网络安全、访问控制
郭云川（1977− ），男，四川营山人，博士，中国科学院信息工程研究所正高级工程师、博士生导师，主要研究方向为访问控制、网络安全
李子孚（1992− ），女，内蒙古赤峰人，博士，中国科学院信息工程研究所工程师，主要研究方向为网络与系统安全、访问控制
基金资助:
国家重点研发计划基金资助项目(2016YFB0801001);国家自然科学基金资助项目(U1836203);山东省重点研发计划（重大科技创新工程）项目(2019JZZY020127)

Dynamic security-empowering architecture for space-ground integration information network

Lingcui ZHANG¹^,², Yaobing XU¹^,², Fenghua LI¹^,², Liang FANG¹, Yunchuan GUO¹, Zifu LI¹

¹ Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100195, China
² School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China

Revised:2021-03-09 Online:2021-09-25 Published:2021-09-01
Supported by:
The National Key Research and Development Program of China(2016YFB0801001);The National Natural Science Foundation of China(U1836203);Shandong Provincial Key Research and Development Program(2019JZZY020127)

摘要/Abstract

摘要：

天地一体化信息网络的安全需求动态变化、威胁动态变化、防护技术动态变化等特征导致已有的安全防护技术不再适用于天地网络。针对上述需求，提出了融合安全服务能力编排、安全态势分析、安全威胁处置指挥等于一体的天地一体化信息网络安全动态赋能架构，并形式化定义了该架构；然后提出了一种对威胁处置效果的双重判定方法，并基于信念熵证明了双重判定的可信性。

关键词: 天地一体化信息网络, 安全动态赋能, 安全服务能力编排, 安全威胁处置指挥, 双重判定, 安全态势分析

Abstract:

To satisfy the above requirements that due to the dynamic characteristics (e.g., the dynamic variability of threats, and the dynamic changes of protection technology) of space-ground integration information network (SGIIN), the existing security technologies were no longer applicable.Firstly, a security-empowering architecture for SGIIN was designed and formalized, which integrated capability orchestration unit of security service, analysis unit of security situation and the response unit of security threat measure.Then, a double judgment method for the effectiveness of threat measure was proposed.Finally the method is theoretically proved to be credible by using belief mini-entropy.

Key words: space-ground integration information network, dynamic security empowering, security service orchestration, security threat measure, double judgement, security situation analysis

中图分类号:

TN929

张玲翠, 许瑶冰, 李凤华, 房梁, 郭云川, 李子孚. 天地一体化信息网络安全动态赋能架构[J]. 通信学报, 2021, 42(9): 87-95.

Lingcui ZHANG, Yaobing XU, Fenghua LI, Liang FANG, Yunchuan GUO, Zifu LI. Dynamic security-empowering architecture for space-ground integration information network[J]. Journal on Communications, 2021, 42(9): 87-95.

图/表 4

参考文献 15

[1]	李凤华, 殷丽华, 吴巍 ,等. 天地一体化信息网络安全保障技术研究进展及发展趋势[J]. 通信学报, 2016,37(11): 156-168.
	LI F H , YIN L H , WU W ,et al. Research status and development trends of security assurance for space-ground integration information network[J]. Journal on Communications, 2016,37(11): 156-168.
[2]	LIU J J , SHI Y P , FADLULLAH Z M ,et al. Space-air-ground integrated network:a survey[J]. IEEE Communications Surveys ＆ Tutorials, 2018,20(4): 2714-2741.
[3]	DAS S , LIU Y , ZHANG W ,et al. Semantics-based online malware detection:towards efficient real-time protection against malware[J]. IEEE Transactions on Information Forensics and Security, 2016,11(2): 289-302.
[4]	AMBUSAIDI M A , HE X J , NANDA P ,et al. Building an intrusion detection system using a filter-based feature selection algorithm[J]. IEEE Transactions on Computers, 2016,65(10): 2986-2998.
[5]	SHAMELI-SENDI A , LOUAFI H , HE W B ,et al. Dynamic optimal countermeasure selection for intrusion response system[J]. IEEE Transactions on Dependable and Secure Computing, 2018,15(5): 755-770.
[6]	SCHMITZ C , PAPE S . LiSRA:lightweight security risk assessment for decision support in information security[J]. Computers ＆ Security, 2020,90:101656.
[7]	CINQUE M , DELLA C R , PECCHIA A . Contextual filtering and prioritization of computer application logs for security situational awareness[J]. Future Generation Computer Systems, 2020,111: 668-680.
[8]	KHRAISAT A , GONDAL I , VAMPLEW P ,et al. Survey of intrusion detection systems:techniques,datasets and challenges[J]. Cybersecurity, 2019,2(1): 20.
[9]	BRABRA H , MTIBAA A , GAALOUL W ,et al. Toward higher-level abstractions based on state machine for cloud resources elasticity[J]. Information Systems, 2020,90:101450.
[10]	YAO J Y , FAN X N , CAO N . Survey of network security situational awareness[M]. Berlin: Springer, 2019.
[11]	ZHENG G , PENG Y . GlobalFlow:a cross-region orchestration service for serverless computing services[C]// Proceedings of 2019 IEEE 12th International Conference on Cloud Computing. Piscataway:IEEE Press, 2019: 508-510.
[12]	SHIN S , YEGNESWARAN V , PORRAS P ,et al. AVANT-GUARD:scalable and vigilant switch flow management in software-defined networks[C]// Proceedings of the 2013 ACM SIGSAC Conference on Computer ＆ Communications Security. New York:ACM Press, 2013: 413-424.
[13]	SHIN S , PORRAS P , YEGNESWARAN V ,et al. FRESCO:modular composable security services for software-defined networks[C]// Proceedings of the Symposium on Network and Distributed System Security. Piscataway:IEEE Press, 2013: 1-16.
[14]	XU S P , ZHANG Y H , ZHOU Y ,et al. Design and application of a network security model[C]// Proceedings of the 2nd International Symposium on Computer,Communication,Control and Automation. Paris:Atlantis Press, 2013: 2773-2776.
[15]	DEMIRCI M , AMMAR M . Design and analysis of techniques for mapping virtual networks to software-defined network substrates[J]. Computer Communications, 2014,45: 1-10.

p_β	a_n=1	2≤a_n≤3	4≤a_n≤6	7≤a_n
优	0.60	0.40	0.10	0.05
良	0.30	0.50	0.30	0.05
中	0.05	0.05	0.50	0.10
差	0.05	0.05	0.10	0.80

p_σ	a_n=1	2≤a_n≤3	4≤a_n≤6	7≤a_n
优	0.50	0.47	0.05	0.05
良	0.40	0.43	0.25	0.05
中	0.10	0.05	0.40	0.20
差	0.00	0.05	0.30	0.70

天地一体化信息网络安全动态赋能架构

Dynamic security-empowering architecture for space-ground integration information network

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 4

参考文献 15

相关文章 6

Metrics

推荐阅读 0

[1]	张晨,张更新,王显煜. 基于跳波束的新一代高通量卫星通信系统设计[J]. 通信学报, 2020, 41(7): 59-72.
[2]	韩珍珍,赵国锋,徐川,周文涛,周洋洋. 基于时延的LEO卫星网络SDN控制器动态放置方法[J]. 通信学报, 2020, 41(3): 126-135.
[3]	杨增印,李贺武,吴茜,吴建平,刘君. 天地一体化信息网络域间协议实验平台[J]. 通信学报, 2019, 40(5): 1-12.
[4]	苏铓,史国振,付安民,俞研,金伟. 基于代理重加密的云端多要素访问控制方案[J]. 通信学报, 2018, 39(2): 96-104.
[5]	王睿,韩笑冬,王超,周晞,龙军. 天基信息网络资源调度与协同管理[J]. 通信学报, 2017, 38(Z1): 104-109.
[6]	李凤华,殷丽华,吴巍,张林杰,史国振. 天地一体化信息网络安全保障技术研究进展及发展趋势[J]. 通信学报, 2016, 37(11): 156-168.