电信运营商威胁情报体系研究与应用探索

随着互联网时代网络攻防的不对等加剧，威胁情报成为缩小这种差距的重要工具之一。在研究分析了威胁情报国内外研究现状的基础上，提出了一套适用于电信运营商的威胁情报体系构建方法，包括制定计划、情报生产、情报分析、情报管理、情报共享和情报应用6个环节。基于该体系架构提出了一套多源情报融合评估机制，概述了情报聚合分析、情报信誉分析、情报关联分析和情报老化分析4个阶段涉及的技术和建设方法，帮助电信运营商构建情报融合分析能力。同时，针对入侵类和失陷类情报领域给出了情报生产和同步应用原则，为电信运营商应用威胁情报技术构建安全防护体系提供了有益的参考。

Research and application exploration of threat intelligence system of telecom operators

With the increasing inequality of network attack and defense in the Internet era, threat intelligence has become one of the important tools to narrow this gap.Based on the analysis of the research status of threat intelligence at home and abroad, a set of construction methods of threat intelligence systems suitable for telecom operators were proposed, including six steps: intelligence planning, intelligence production, intelligence analysis, intelligence management, intelligence sharing and intelligence application.Meanwhile a set of multi-source intelligence fusion assessment mechanisms was presented, and the technologies and methods were systematically expounded involved in the four stages of intelligence aggregation analysis, intelligence reputation analysis, intelligence correlation analysis and intelligence aging analysis, so as to help the telecom operators build the ability of intelligence fusion analysis.At the same time, the principles of intelligence production and synchronous application were given for intrusion and loss intelligence, which provided a useful reference for telecom operators to apply threat intelligence technology to build a security protection system.