GB/T 28517-2012Network incident object description and exchange format (English PDF)

Foreword

This standard was drafted in accordance with GB/T 1.1-2009 given rules.

This standard is mainly with reference to IETF (Internet Engineering Task Force) RFC5070, combined with Computer Network Emergency Response System in China The actual situation developed.

The standard proposed by the Ministry of Industry and Information Technology of the People's Republic of China. The standard by the China Communications Standards Association.

Introduction

With the development of the Internet, a computer network security incidents to break the boundaries of the country or region, across multiple organizations, Emergency Response Team Cooperation between the organizations also broke the borders, language and cultural constraints. In this context, China set up a special National Computer Network Emergency Response Technical Department Li Coordination Center (CNCERT/CC), responsible for coordinating domestic Computer Security Emergency Response Team work together on the National Public Security on the Internet Full event; related telecom companies, security service providers, large state-owned companies, educational and research institutions and national authorities have gradually established Computer Security Incident Response Team (referred to as the Emergency Response Team or CSIRT). In order to improve the ability to respond to various emergency response groups for security incidents And prevention capabilities, between our various specification describes the Emergency Response Team security incidents and interchange format standard is formulated (IODEF).

IODEF mainly used for the exchange of information between the Emergency Response Team event handling system (IHS), it is a representation of the communication protocol layer, Application environment shown in Figure 1.

Under normal circumstances, the emergency response team needs a software tool to generate security event-related information IODEF incident reports, and then Sent via a communication protocol (such as HTTP, SMTP, etc.) to other relevant organizations; when the CSIRT receive additional CSIRT, network service providers, When a user or other organizations sent over IODEF documents generally require event handling system IODEF parsing module or independent The IODEF parser generate consistent internal CSIRT defined data format, and then save it to a local event reporting database, and enter Event handling process.

1 Scope

This standard specifies a description of the computer network security incidents of a common data format to facilitate inter-Computer Security Emergency Response Team into Line switching network security events, and provides a reference implementation of XML.

This standard applies to computer security emergency response between groups of computer network security incidents exchange, but also for the construction and maintenance of computer Network security event handling system reference.

2 Normative references

The following documents for the application of this document is essential. For dated references, only the dated version suitable for use herein Member. For undated references, the latest edition (including any amendments) used in the present document.

GB/T 12406-2008 Codes for the representation of currencies and funds (ISO 4217:2001, IDT)

IETFRFC1305 specification and implementation of the Network Time Protocol (NetworkTimeProtocol (Version3) Specification, Implementation)

IETFRFC2030 for IPv4, IPv6 and OSI Simple Network Time Protocol Version 4 (SimpleNetworkTime Protocol (SNTP) Version4forIPv4, IPv6andOSI)

IETFRFC2256 For LADPv3 the X.500 user program overview (ASummaryoftheX.500 (96) UserSchemaforusewithLDAPv3)

IETFRFC2396 uniform resource identifier (URI). General Syntax (UniformResourceIdentifiers (URI). Generic Syntax)

IETFRFC2822 Internet Message Format (InternetMessageFormat)

3 Terms and definitions, abbreviations