信息通信技术与政策

信息通信技术与政策

信息通信技术与政策 ›› 2020, Vol. 46 ›› Issue (2): 19-25.

上一篇    下一篇

基于区块链的威胁情报共享及评级技术研究

Research on threat intelligence sharing and rating technology based on Blockchain

  

  1. 1. 中国科学院大学网络空间安全学院,北京 100049; 2. 中国科学院信息工程研究所,北京 100093;
    3. 中国移动通信研究院安全技术研究所,北京 100053; 4. 中国移动通信集团网络事业部,北京 100033;
    5. 360 集团,北京 100015
  • 出版日期:2020-02-15 发布日期:2020-11-12
  • 作者简介:
    程叶霞:中国科学院大学网络空间安全学院博士研究生,中国移动通信研究院安全技术研究所工程师,主要从事网络安全、信息安全、威胁情报、区块链等方面的研究工作
    付俊:中国移动通信研究院安全技术研究所高级工程师,主要从事网络攻防、网络安全、物联网安全等方面的研究工作
    陈东:中国移动通信集团有限公司网络事业部工程师,主要从事全网网络安全监测、处置、规划、管理等方面的工作
    杜跃进:360 集团首席安全官,教授级高工,主要从事网络安全、安全智库、数据安全、移动互联网安全等方面的研究工作

  1. 1. School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049;
    2. Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093;
    3. Department of Security Technology, China Mobile Research Institute, Beijing 100053;
    4. Department of Network, China MobileCommunications Group, Beijing 100033;
    5. 360 Group, Beijing,100015
  • Online:2020-02-15 Published:2020-11-12

摘要: 随着计算机和网络技术的快速发展,网络安全事件频发,安全漏洞不断,威胁情报的作用和价值越来越大。基于区块链的开放、共识、自治和去中心、去信任、不可篡改、可追溯等特点,提出了通过区块链技术构建威胁情报信息的区块,包括IP 地址信息、域名信息、URL 信息、安全事件信息、漏洞信息、威胁情报源可信度、威胁情报源贡献率等;并设计了基于区块链的威胁情报共享和评级系统,给出了相应的基于区块链的威胁情报共享方法和评级方法,可以实现及时有效获取及分析出最新、最有价值的威胁情报信息,从而及时进行防护及应急响应,促进整个威胁情报生态的闭环持续有效开展。

关键词: 威胁情报, 区块链, 共享, 评级

Abstract: With the rapid development of computer and network technology, cyber security incidents occur frequently and security vulnerabilities are emerging endlessly, so the role and value of threat intelligence are increasing. Based on the characteristics of blockchain such as openness, consensus, autonomy and decentralization, trustlessness, nontampering, and traceability, the paper proposes using blockchain technology to build blocks of threat intelligence information, including IP address information, domain name information, URLs Information, security incident information, vulnerability information, threat intelligence source credibility, threat intelligence source contribution rate,etc. A threat intelligence sharing and rating system based on blockchain is designed in the paper, and the corresponding threat intelligence sharing method and rating method based on blockchain are given. It can acquire and analyze the latest and most valuable threat intelligence information timely and effectively, so as to perform protection and emergency response timely, and promote the continuous and effective development of the closed loop of the entire threat intelligence ecosystem.

Key words: threat intelligence, Blockchain, sharing, rating