关键词: 多源异构传感器, 网络安全, 运营平台设计, DS 证据, 攻击溯源分析

Abstract: In the process of network operation, it is easy to be invaded by external abnormal data or virus, which leads to network collapse or even failure to operate normally. Therefore, a network security operation platform based on multi-source heterogeneous sensors is designed. Firstly, the DS / AHP ( Dempster-Shafer/ Analytic Hierarchy Process) method is improved by combining rules of DS(Dempster/ Shafer)evidence demonstration, to fuse the security data submitted by multi-source heterogeneous sensors. Finally, through centralized log management, threat analysis, control analysis of security assets, asset identification management, attack traceability analysis, function analysis of threat intelligence and work order, intelligence driven security operation analysis, intrusion alarm can be realized and the source of intrusion can be traced to complete the design. The experimental results show that the platform can identify the intrusion data, trace the source of the intrusion successfully, and effectively ensure the security of the platform operation.

Key words: multi source heterogeneous sensor, network security, operation platform design, dempster/ shafer(DS) evidence, attack traceability analysis