SecDOAR：一种用于安全数据编排、分析和报告的软件参考架构
SecDOAR: A Software Reference Architecture for Security Data Orchestration, Analysis and Reporting
AI总结：
本文提出了用于安全数据编排、分析和报告的软件参考架构SecDOAR，通过文献与标准设计元模型及组件，并经商业方案对比与原型实例化验证，为各领域网络安全监控与报告系统的设计提供标准化结构方法。
摘要：
软件参考架构（SRA）是一种有用的工具，用于标准化特定领域内的现有架构，并通过实例化SRA和将SRA用作开发新系统的基准，来促进具体的架构设计、开发和评估。在本文中，我们提出了一种用于安全数据编排、分析和报告（SecDOAR）的SRA，以提供安全数据平台的标准化，从而促进安全数据的安全编排、分析和报告工具的集成。SecDOAR SRA是利用现有的科学文献和安全数据标准设计的。我们从设计方法论、关联安全数据架构中不同概念的元模型，以及SRA不同元素和组件的细节等方面，对SecDOAR SRA进行了记录。我们通过将其与现有商业解决方案进行比较，评估了SecDOAR SRA的有效性和完整性。我们通过将SecDOAR SRA实例化为一个原型平台，以支持选定工具集的安全编排、分析和报告，从而证明了所提出的SecDOAR SRA的可行性。所提出的SecDOAR SRA包含用于安全数据、安全事件和安全数据管理过程的元模型，以及安全指标和相应的测量方案、安全数据集成模型，以及对SecDOAR SRA组件的描述。所提出的SecDOAR SRA可供研究人员和从业者作为一种结构化方法使用，用于在各种领域内设计和实施网络安全监控、分析和报告系统。
英文摘要：
A Software Reference Architecture (SRA) is a useful tool for standardising existing architectures in a specific domain and facilitating concrete architecture design, development and evaluation by instantiating SRA and using SRA as a benchmark for the development of new systems. In this paper, we have presented an SRA for Security Data Orchestration, Analysis and Reporting (SecDOAR) to provide standardisation of security data platforms that can facilitate the integration of security orchestration, analysis and reporting tools for security data. The SecDOAR SRA has been designed by leveraging existing scientific literature and security data standards. We have documented SecDOAR SRA in terms of design methodology, meta-models to relate to different concepts in the security data architecture, and details on different elements and components of the SRA. We have evaluated SecDOAR SRA for its effectiveness and completeness by comparing it with existing commercial solutions. We have demonstrated the feasibility of the proposed SecDOAR SRA by instantiating it as a prototype platform to support security orchestration, analysis and reporting for a selected set of tools. The proposed SecDOAR SRA consists of meta-models for security data, security events and security data management processes as well as security metrics and corresponding measurement schemes, a security data integration model, and a description of SecDOAR SRA components. The proposed SecDOAR SRA can be used by researchers and practitioners as a structured approach for designing and implementing cybersecurity monitoring, analysis and reporting systems in various domains.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
