内部威胁发现检测方法研究综述
作者:
作者单位:

1.陆军工程大学指挥控制工程学院, 南京 210007;2.军事科学院战略评估咨询中心, 北京 100091;3.北京大数据先进技术研究院, 北京 100091;4.军事科学院国防科技创新研究院, 北京 100010

作者简介:

通讯作者:

基金项目:

国家自然科学基金面上项目(62076251); 国家重点研发计划(2017YFB0802801)。


Survey on Insider Threat Detection Method
Author:
Affiliation:

1.Command and Control Engineering College, Army Engineering University of PLA, Nanjing 210007, China;2.Evaluation Center, Academy of Military Science, Beijing 100091, China;3.Advanced Institute of Big Data, Beijing 100091, China;4.Defense Innovation Institute, Academy of Military Science, Beijing 100010, China

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
    摘要:

    组织内部网络不仅面临着外部攻击者的威胁,同时也面临以破坏组织网络结构、内部信息资料窃取以及各种诈骗手段为主的内部威胁。内部威胁因为其多元化、伪装性强等特点,对组织机构内部造成了严重影响,因此对于内部威胁发现检测方法的研究变得非常有必要。本文首先对内部威胁进行了描述,重点针对内部威胁发现检测方法的现实意义进行了论述。同时将现有的内部威胁发现检测方法分为3类:基于异常行为的检测方法、基于审计日志异常的检测方法和其他检测方法,分别介绍了现有3类方法的研究现状,并对它们的研究进展进行了总结、归纳和分析。最后对内部威胁发现检测方法的未来研究方向进行了展望。

    Abstract:

    The internal network of the organization is not only faced with the threat of external attackers, but also faced with the insider threat including destruction of the organization network structure, internal information theft and various means of fraud. Because of the characteristics of concealment, destructiveness and diversification of attack methods, the insider threat poses a serious threat to the internal network. Therefore, it is very necessary to study the detection methods of insider threat. This paper analyzes the characteristics of insider threat and expounds the significance of studying the detection methods of insider threat. The existing insider threat detection methods are divided into three categories, namely, detection methods based on abnormal behavior, detection methods based on abnormal audit diary, and other detection methods. The current research status of each aspect is introduced respectively, and the progress of the research status of each aspect is summarized and analyzed.At last, the future research direction of insider threat detection methods is prospected.

    参考文献
    相似文献
    引证文献
引用本文

郭世泽,张磊,潘雨,陶蔚,白玮,郑奇斌,刘艺,潘志松.内部威胁发现检测方法研究综述[J].数据采集与处理,2022,37(3):488-501

复制
分享
文章指标
  • 点击次数:
  • 下载次数:
历史
  • 收稿日期:2021-08-12
  • 最后修改日期:2022-04-24
  • 录用日期:
  • 在线发布日期: 2022-06-13