【摘要】 基于面向服务的设计思想,提出了一种全新的信息安全威胁分析模型,模型以面向服务为中心,将安全威胁分析的工作分域治之,并通过服务的形式完成威胁分析域之间的信息交互。模型实现方法灵活,能充分利用威胁信息。使用上海2010年世界博览会期间信息安全管理系统接收到的告警及日志信息对威胁分析模型进行了测试,测试结果表明模型不仅有较高的告警准确率,而且对大时间尺度事件、多步事件的发现有明显的优势。更多还原

【Abstract】 Based on service-oriented architecture,this paper proposes a novel service-oriented model for threat analysis. The model divides the analysis work into different domains,and exchanges inter-domain information in form of service. This model could be flexibly implemented,and could take full advantage of threat information. Security alarms collected during Shanghai Expo 2010 are used to test the model,the testing result indicates that this model could achieve high alarm accuracy and has distinct advantages in discovering long time-scale and multi-steps events.更多还原