[1]杨 乐,吴 峥,李继赓,等.国家地震预警专网下基于XDR网端协同的未知威胁自适应复测与降噪机制[J].华南地震,2026,46(05):208-216.[doi:10.13512/j.hndz.2026.05.26]
　YANG Le,WU Zheng,LI Jigeng,et al.An Adaptive Retesting and Noise Reduction Mechanism for Unknown Threats Based on XDR Network-Endpoint Collaboration Within the National Earthquake Early Warning Private Network[J].,2026,46(05):208-216.[doi:10.13512/j.hndz.2026.05.26]
点击复制

国家地震预警专网下基于XDR网端协同的未知威胁自适应复测与降噪机制()

华南地震[ISSN:1006-6977/CN:61-1281/TN]

卷:
46
期数:
2026年05期
页码:
208-216
栏目:
应急管理与实践
出版日期:
2026-09-07

文章信息/Info

Title:
An Adaptive Retesting and Noise Reduction Mechanism for Unknown Threats Based on XDR Network-Endpoint Collaboration Within the National Earthquake Early Warning Private Network
文章编号:
1001-8662（2026）05-0208-09
作者:
杨 乐; 吴 峥; 李继赓; 张宇轩
中国地震台网中心，北京 100045
Author(s):
YANG Le; WU Zheng; LI Jigeng; ZHANG Yuxuan
China Earthquake Networks Center, Beijing 100045, China
关键词:
可扩展检测响应(XDR); 网端协同; 自适应复测; 高保真降噪; 地震预警工程
Keywords:
Extended detection and response (XDR);  Network-endpoint collaboration;  Adaptive retesting;  High-fidel‐ity noise reduction;  Earthquake early warning project
分类号:
TP393.08
DOI:
10.13512/j.hndz.2026.05.26
文献标志码:
A
摘要:
国家地震烈度速报与预警工程在巨震应急与演练等高并发时期，极易因传统单点设备高误报引发“告警风暴”，干扰防灾业务，且面临跨国、省两级异构数据难以评估等痛点。为此，设计并实现了一套基于可扩展检测响应（ExtendedDetectionandResponse,XDR）网端协同架构的自适应复测与高保真降噪机制。该机制依托国—省两级分布式大数据底座，构建了以网络侧人工智能分析引擎（Network-sideAIAnalysisEngine,WISE）为核心，端侧轻量化感知代理（Agent）为状态验证的多维交叉验证网络。系统流式接入全网异构遥测数据，利用ApacheFlink复杂事件处理（ComplexEventProcessing,CEP）引擎进行二次关联校验，并引入动态业务流量基线，对主机脆弱性、网络连接、进程及系统行为开展动态复测，实现对网页后门（Webshell）加密通道、高级持续性威胁（AdvancedPersistentThreat,APT）漏洞试探及内网横向移动等高隐蔽威胁的精准鉴别。实际部署与演练结果表明，该机制在保障端侧极低计算开销的前提下，将全网无效误报率压降超96%，显著提升了安全研判信噪比，在确保预警业务连续性的同时，实现了防灾减灾专网的闭环级联响应与秒级安全增效。
Abstract:
During high-concurrency periods like major earthquake emergencies and drills, the National Earthquake Intensity Rapid Reporting and Early Warning Project suffers from "alarm storms" caused by high false positives of traditional single-point devices and faces challenges in cross-national and provincial two-level heterogeneous data evaluation. To address these issues, this paper implements an adaptive retesting and high-fidelity noise reduction mechanism based on an Extended Detection and Response (XDR) network-endpoint collaborative architecture. Le‐veraging a national-provincial distributed big data foundation, the mechanism builds a cross-verification network us‐ing a network-side AI Analysis Engine (WISE) for core analysis and lightweight endpoint Agents for state verifica‐tion. By streaming network-wide telemetry data and performing secondary correlation via Apache Flink Complex Event Processing (CEP), the system introduces a dynamic traffic baseline to conduct dynamic retesting on host vul‐nerabilities, connections, processes, and system behaviors. This enables precise detection of covert threats, including Webshell encrypted channels, Advanced Persistent Threat (APT) probing, and intranet lateral movement. Empirical deployment and drill results show that, with minimal endpoint overhead, this mechanism reduces the network-wide invalid false positives rate by over 96%, significantly enhancing the security signal-to-noise ratio, ensuring early-warning business continuity, and achieving closed-loop cascading response and second-level security efficiency im‐provement for the disaster prevention and mitigation private network.

参考文献/References:

[1]欧阳龙斌,黄文辉,康英,等.地震监测数据实时传输与汇聚系统[J].华南地震,2022,42(1):23-30.
[2]寇曼曼,郭慧,何香玲,等.基于NPMD技术的地震预警系统运行质量监测管理工具研究与应用[J].华南地震,2024, 44(3):145-152.
[3]赵志柔,庄严,吴艳梅,等.云南地震预警紧急叫应叫醒机制设计与实现[J].华南地震,2025,45(4):143-148.
[4]胡丽娜,蒋凯元,姜静.关键信息基础设施系统安全防护前沿技术研究[J].信息安全研究,2025,11(12):1075-1080.
[5]邱崇峻.扩展检测与响应技术的安全防护分析[J].中国科技信息,2025(9):73-75.
[6]徐庆富,李旭.工业控制系统网络边界安全防护与异常行为检测[J].网络安全和信息化,2025(10):34-36.
[7]李凤华,李子孚,李凌,等.复杂网络环境下面向威胁监测的采集策略精化方法[J].通信学报,2019,40(4):49-61.
[8]李宏宇,李思帆,王浩翔,等.面向枢纽通航关基设施业务场景的安全防护技术研究综述[J].物联网学报,2026,10 (1):52-68.
[9]章毅晨.网络全流量行为分析下的加密流量威胁检测技术[J].通讯世界,2025,32(5):49-51.
[10]李杰,周路,李华欣,等.基于生成对抗网络的网络流量特征伪装技术[J].计算机工程,2019,45(12):119-126.
[11]周鑫,夏雨潇,王海峰,等.一种面向大数据平台容器的轻量化安全防护方法[J].微型电脑应用,2024,40(2):110-114+121.
[12]祝少斌,申士博.网络安全等级保护测评中的自动化渗透测试方法[J].智能物联技术,2025,57(5):106-110.
[13]杨希磊,易小云,肖达,等.面向低轨卫星网络的零信任微隔离架构[J].航天技术与工程学报,2026,3(2):71-84.
[14]高桐,宋刚,白洋.基于DeepSeek的运营商网络安全态势感知告警降噪方法研究与应用[J].中国宽带,2025,21 (7):46-48.
[15]孔簇簇,李宪玲,刘璐.基于智能技术的计算机网络安全防御系统分析[J].中国宽带,2026,22(7):95-97.
[16]段刘祺,熊唯韬,尹子硕,等.面向有向网络下异构多智能体系统的抗毁性优化机制研究[J].移动通信,2026,50 (1):87-95+102.

备注/Memo

备注/Memo:
收稿日期：2026-03-10
作者简介：杨乐（1983-），男，高级工程师，主要从事地震信息化研究。E-mail: yangle@seis.ac.cn
更新日期/Last Update: 2026-09-20