面向泛在网环境的异常行为融合检测技术及判定方法

With the development of the ubiquitous network, various types of security incidents occur frequently, and the security situation cannot be optimistic. The existing network anomaly detection methods that are only applicable to specific network types are independent of each other. Due to lack synergies, it is difficult to form an effective protection system using the existing network anomaly detection methods. The existing network anomaly detection methods can no longer meet the real requirements of the ubiquitous network development. This project aims at major national requirements and scientific frontiers, and is directed by the fusion anomaly detection technologies and determination methods for ubiquitous network environment. Making use of basic theory research to drive breakthrough in key technologies, this project begins with three levels: basic models, theory and method supporting, system and typical application demonstration. The main research contents of this project include: efficient perception method of heterogeneous and multi-source behavior data in ubiquitous network space; efficient identification and utilization method of abnormal behaviors in IP networks; precise identification and utilization method of abnormal behaviors in air interface networks; cross-network anomaly fusion analysis and situational awareness. The main objectives of this project are, construct an anomaly fusion detection system and technical architecture for ubiquitous network environment; develop abnormity perception and blocking equipment of independent intellectual property rights; implement abnormal behavior recognition system oriented to ubiquitous network environment; and validate the effectiveness of the project by applying a demonstration. The project is expected to obtain a number of breakthroughs and original achievements in theoretical research, key technologies and system implementation.

随着泛在网建设与应用的不断推进，各类安全事件频发，安全形势不容乐观。原有的仅适用于特定网络类型的网络异常行为检测方法之间彼此相互独立，缺乏协同作用，难以形成有效的防护体系，已不能适应泛在网发展的现实需求。瞄准国家重大需求和科学前沿，项目以面向泛在网络环境的异常行为融合检测与判定方法研究为导向，利用基础理论研究带动关键技术突破，从基础模型、理论与方法支撑、系统与典型应用示范三个层次着手，系统深入地研究泛在网空间异构多源的行为大数据高效感知方法、IP网络异常行为高效识别与利用方法、空口网络异常行为精准识别与利用方法、跨网系异常行为融合分析与态势感知等相关问题。构建面向泛在网环境的异常行为融合检测体系及技术架构，开发自主知识产权的异常行为感知与阻断设备，实现面向泛在网络环境的异常行为识别系统，并通过应用示范验证项目的有效性。项目预期在理论研究、关键技术和系统实现等方面取得若干突破和原创性的成果。

随着泛在网建设与应用的不断推进，各类安全事件频发，安全形势不容乐观。原有的仅适用于特定网络类型的网络异常行为检测方法之间彼此相互独立，缺乏协同作用，难以形成有效的防护体系，已不能适应泛在网发展的现实需求。本项目瞄准国家重大需求和科学前沿，以面向泛在网络环境的融合异常行为检测与判定方法研究为导向，利用基础理论研究带动关键技术突破，从基础模型、理论与方法支撑、系统与典型应用示范三个层次着手，系统深入的研究了泛在网空间异构多源的行为数据高效感知方法、IP网络异常行为高效识别与利用方法、空口网络异常行为精准识别与利用方法、跨网系异常行为溯源与态势感知等相关问题。构建了面向泛在网环境的融合异常行为检测体系及技术架构，开发了自主知识产权的异常行为感知与阻断设备，实现了面向泛在网络环境的异常行为识别系统，并实现了研究成果在国家安全部门、国家电网等领域的应用。本项目研究期间，共发表高水平论文40篇，授权国家发明专利10项，软件著作权5项，项目负责人入选了国家级重要人才计划，培养博士/硕士研究生19人，部分成果获得中国电子学会科技进步一等奖。项目负责人与联合研究单位（中国通用技术研究院）共同申报的全国重点实验室于2022年立项建设。