GB/T 36643-2018Information security technology—Cyber security threat information format (English PDF)

3.1 Cybersecurity

The maintenance of confidentiality, integrity and availability of information in cyberspace. [ISO /IEC 27032:2012, definition 4.20]

3.2 Threat

Potential causes of undesired events that may cause harm to the system or organization. [GB/T 29246-2017, definition 2.83].

3.3 Threat information

A kind of evidence-based knowledge, used to describe existing or possible threats, so as to realize the response and prevention of threats.

Note: Threat information includes information such as context, attack mechanism, attack indicators, and possible impact.

3.4 Vulnerability

Weaknesses in assets or controls that may be exploited by one or more threats. [GB/T 29246-2017, definition 2.89]

3.5 Cyber kill chain

A multi-step attack model used to describe multiple attack steps.

Note: Common multi-step attack models include information collection, tool development, tool release, vulnerability utilization, backdoor installation, command and control, attack target achievement, etc. Seven steps.

5.1 Overview

This standard provides a structured method to describe cybersecurity threat information, with the purpose of achieving the sharing of cybersecurity threat information among organizations. Sharing and utilization, and supporting network security threat management and application automation. To achieve these goals, a common model is needed to achieve The unified description of cybersecurity threat information ensures the consistency of the description of cybersecurity threat information, thereby improving the efficiency of threat information sharing, Interoperability, and improve the overall cyber security threat situation awareness.

5.2 Threat Information Dimensions

This standard defines a general cyber security threat information model (hereinafter referred to as "threat information model"). Threat information model from The three dimensions of image, method, and event are divided into cybersecurity threat information, including observable data (Observation), attack Indicator (Indicator), security incident (Incident), attack activity (Campaign), threat subject (ThreatActor), attack target (ExploitTarget), attack methods (TTP), countermeasures (CourseOfAction), including eight threat information components that describe cybersecurity threats.

Threat information. The 8 components in the threat information model can be divided into 3 domains.

a) Object domain. describes the participating roles of cybersecurity threats, including two components. "threat subject" (usually the attacker) and "attack target" (usually the victim);

b) Method domain. describe the method elements in cybersecurity threats, including two components. "attack method" (the attacker uses the Methods, techniques and processes used), and "response measures" (including early warning, detection, protection, and response actions against attacks) Make);

c) Event domain. describe events related to cybersecurity threats at different levels, including four components. "attack activities" (in economic or political Is the target of attack), "security incident" (the act of penetrating information systems), "attack indicators" (the single Step attacks) and "observable data" (basic events captured at the network or host level).

5.3 Threat Information Component

Figure 1 shows the threat information model, which includes 8 threat information components, and each component contains the attributes of the element itself and the relationship with other components.

Relational information is the key element of the threat information model. among them.

a) "Observable data", stateful attributes or measurable events related to the host or network, is the most basic threat information model Components;

b) "Attack indicator", a technical indicator used to identify a specific "attack method", which is a combination of multiple "observable data" To detect "security incident" detection rules;

c) "Security incidents", based on the corresponding indicators ("attack indicators") detected network attacks that may affect a specific organization, a Specific cyber attack events may involve information such as "threat subject", "attack method" and "countermeasure";

d) "Attack activity", "threat subject" adopts specific "attack methods" to achieve a series of attack actions with specific attack Attacks will generate a series of "security incidents";

e) "Threat subject", the subject that initiates the activity in the "attack activity", and the "threat subject" uses related methods ("attack methods") to achieve the attack intention;

f) The "attack target", the software, system, and network vulnerabilities or weaknesses used by the "attack method", for each attack target, there are Corresponding effective measures ("countermeasures") to suppress;

g) "Attack method", a description of the method used in the attack process of the "threat subject", each "attack method" will take loopholes Use the way to exploit the type of vulnerability or weakness on the "attack target";

h) "Response measures", effective measures to deal with specific "attack targets". When a security incident occurs, corresponding "response measures" may also be taken "Implementation" for post-event security incident handling.

The threat information model defined in this standard should be flexible and extensible, mainly in the threat information groups defined in the threat information model The software is optional. It can be used independently or combined in any way. For example, in a specific application scenario, you can only use threat information. Related components in the information model without using all components. The flexible and extensible characteristics of the threat information model make it suitable for various Used in independent application scenarios.

The specific format specifications of the 8 threat information components should meet the detailed requirements given in Chapter 6: Network security threats using this standard See Appendix A for examples of complete cybersecurity threat information in information format.

6.1 Overview

This chapter specifies the format of the eight threat information components in the threat information model, including the attributes and attribute values of each component. format. The format of each component attribute is represented by the JSON data type, including String (string), JSONArray (JSON array) and Data types such as JSONObject (JSON object).

6.2 Observable data

6.2.1 Overview

In the threat information model, "observable data" is the most basic component, which is used to describe various stateful data related to the host or network. Data or measurable events. "Observable data" is a logical expression in form, and its logical relationship is organized according to the following rules.

a) The expression of "observable data" is organized in a tree structure;

b) Each non-leaf node represents the relationship of child nodes, including two kinds of "or" relationship and "and" relationship;

c) Each leaf node is a discriminant, which represents a specific check item. For example, does the file name contain the specified string, does the registry key For the specified content, etc. There are 4 types of discrimination methods that are equal to, not equal to, inclusive and not included.

6.2.2 Field description

The observable data defined by this standard includes. DNS basic records, email basic records, file download basic records, file information Basic record, basic record of process information, basic record of website access, basic record of registry information, basic record of user information, system information Basic records, etc. Observable data includes the following.

a) Identification number, a globally unique identification within the shared scope;

b) Quoting the identification number, quoting "observable data" elsewhere;

c) Timestamp, used in conjunction with the identification number to specify the version of the local entry, or used in conjunction with the reference identification number to specify the external entry version of;

d) Version, the standard version used;

e) Name, the simple name of "observable data";

f) Description, using text to describe this entry in detail;

g) Brief description, using text to briefly describe this entry;

h) Relationship, the relationship between "observable data" and other components;

i) Discriminant, using a discriminant with a logical budget relationship to represent a single "observable data" or a combination of multiple observable data, which The combination relationship is shown in 6.2.1;

j) Object type, the type name of "observable data", in addition to corresponding to all object types in 6.2.3, it can also be based on actual The scene is expanded.

The description of each field of the observable data is shown in Table 1.

6.2.3 Specific observable data

6.2.3.1 DNS basic records

Basic DNS records mainly record observations related to DNS domain name resolution, including the following.

a) Domain name resolution host, the name of the server that provides domain name resolution services;

b) Domain name resolution record, DNS service can provide mapped IP address information for a given domain name, that is, domain name resolution record;

c) DNS record type, DNS service can provide a variety of query and anti-query services, including host records describing IPv4 address information Record, describe the name server record of the server, describe the mail exchange record of the mail server, etc. This field indicates the specific record Record type.

The description of each field of the basic DNS record is shown in Table 2.

6.2.3.2 Basic E-mail Record

Basic email records mainly record observations related to emails, including the following.

a) The multi-purpose Internet mail extension type for mail attachments, and the multi-purpose Internet mail extension type for email attachments can indicate the appropriate Which application to use to open the file;

b) The name of the email attachment, the file name of the email attachment, and the file name and type of the attachment file;

c) The content of the email attachment and the content of the email attachment indicate all the information in the attached file;

d) Bcc address, email Bcc address, indicating all recipients of email Bcc;

e) The text of the email body, the text of the email body, indicating the entire text content of the body;

f) Email CC address, email CC address, indicating all recipients of email CC;

g) The sender of the email, the sender of the email, indicating the email address of the sender of the email;

h) Email quotation, the original text quoted when replying to the email, indicating the content of the original email body;

i) The subject of the email, the subject of the email, indicating the iconic information of the email content;

j) Mail recipients, email recipients, indicate the email addresses of all recipients.

See Table 3 for the description of the basic email record fields.

6.2.3.3 Basic record of file download

The basic record of file download mainly records observations related to file download, including the following.

a) File download history name, file download history file name, indicating the file name and type of the downloaded file;

b) The name of the file download browser and the name of the browser used for file download, indicating the method of file download;

c) The number of bytes of file download, the number of bytes of file download, indicate the size of the downloaded file;

d) File download name, file name of file download;

e) File download start time, the start time of the recorded file download, usually accurate to the second.

See Table 4 for the description of the basic record fields for file download.

6.2.3.4 Basic record of file information

The basic record of file information mainly records observations related to file information, including the following.

a) File name, file name, indicating the file name and file type;

b) File path, file path, indicating the name of the folder where the file is located;

c) The full path of the file, the full path of the file, indicating the absolute path where the file is stored;

d) The MD5 value of the file, the MD5 value of the file. If there are any changes to the file, its MD5 value will also change;

e) The issuer of the document certificate, the organization that issued the certificate of this standard;

f) File export function, file export function, file export function provided to third parties;

g) File import function, file import function, used to realize the data import of third-party files;

h) File import name, file import name, indicating the name of the imported third-party file;

i) File compilation time, file compilation time, usually accurate to the second;

j) PE file resource information name, PE file resource information name. Resources contain various forms of data, such as strings and pictures and many more;

k) PE file resource information size, total bytes of PE file resource information;

l) The file section name, the name of the file section, is a string composed of ANSI characters;

m) File PE type, the PE type to which the file belongs, such as EXE, DLL, OCX, SYS, COM, etc.;

n) PE version company name, the company name indicated in the PE file version information;

o) PE version standard description, the description information given in the PE file version information;

p) PE version standard version, the file version number indicated in the PE file version information;

q) The legal copyright of the PE version, the legal copyright notice indicated in the PE file version information;

r) The original file name of the PE version, the original file name indicated in the PE file version information;

s) PE version product name, product name information indicated in the PE file version information;

t) PE version product version, product version number information indicated in the PE file version information;

u) File SHA1, SHA1 value of the file. The SHA1 value has the same function as the MD5 value, which is a kind of file fingerprint;

v) File SHA256, the SHA256 value of the file. The SHA256 value has the same function as the MD5 value, which is a kind of file fingerprint;

w) File size, the number of bytes of the file, indicating the size of the storage space occupied by the file;

x) Document digital signature description, document digital signature description, used to verify the source and integrity of the document.

The basic record field description of file information is shown in Table 5.