网络安全数据采集关键技术研究

Research on Key Technologies of Data Collection for Cyberspace Security

摘要: 多源异构的网络安全数据是开展安全保护工作的基础。针对网络资产、安全漏洞、网络流量、软件代码等安全数据，需要通过不同类型的关键技术进行综合采集。本文提出了从数据来源维度对网络安全数据采集技术进行分类的方法，详细阐述了流量检测、行为分析和网络探测等典型的关键技术方法，分析相关技术的特点和关联性，为建立网络安全大数据平台，开展数据汇聚、治理、分析和挖掘提供参考。

Abstract: Multisource heterogeneous network security data is the foundation of security protection. In view of network assets, security vulnerabilities, network traffic, software code and other security data, it is necessary to conduct comprehensive collection through different types of technologies. This paper proposes a method to classify network security data collection technologies from the dimension of data source. It describes in detail the typical key technologies such as traffic detection, behavior analysis and network detection, analyzes the characteristics and correlation of relevant technologies, which contributes to establish the big data platform for data aggregation, governance and knowledge mining.