GB/T 42583-2023 in English

Technical architecture design

The government network security monitoring platform adopts a seven-layer modular architecture:

• Data collection layer: supports 6 types of collection methods such as traffic mirroring and log collection
• Data analysis layer: integrates 5 analysis technologies such as machine learning and correlation analysis
• Threat intelligence module: requires intelligence data to be updated within 24 hours

Comparison of key technical indicators

Data collection deployment suggestions

According to the requirements of Appendix C, the key deployment locations include:

1. The deployment density of probes in the core switching nodes of the government WAN is ≥ 2/province
2. Dedicated traffic probes need to be deployed at the boundaries of the government cloud VPC
3. Mail system inlet and outlet SMTP traffic collection delay <500ms

Threat intelligence management specifications

A three-level intelligence management system needs to be established:

Typical test scenarios

• Data bus test: Verify cascade interface encrypted transmission (AES-256)
• Attack detection test: Simulate APT attack chain to verify detection rate
• Emergency response test: Timeliness evaluation of the entire process from alert to disposal

Key points for security protection connection

Level 3 systems need to pay special attention to the following:

1. Meet all enhanced requirements in Appendix B (23 items in total)
2. The threat intelligence module must support APT organization identification
3. Establish a two-factor authentication mechanism (6.7.5c)