[目的/意义]为有效应对多元化、隐蔽式、高强度、大规模、高持续的网络空间安全威胁，必须构建一体化、全方位、智能化的网络空间安全情报服务架构。[方法/过程]文章以改进型霍尔模型为分析框架，遵循网络空间安全为中心和安全情报服务化的思想，详细刻画网络空间安全情报服务架构，深入透视其运行机理。[结果/结论]网络空间安全情报服务架构由流程子模块、逻辑子模块、认知子模块三部分组成，其中服务流程面向网络空间安全感知、网络空间安全判断、网络空间安全执行三类需求，服务工作体现了“攻击场景溯源-事件关联识别-危机应对升级”的运行逻辑，服务认知主要体现在价值共识、技术支撑、能力保障三个方面。网络空间安全情报服务架构的构建可为我国网络空间安全保障体系中的情报服务工作提供参考。

[Purpose/significance] To effectively respond to diversified, concealed, high-intensity, large-scale, and persistent cyberspace security threats, it is imperative to construct an integrated, comprehensive, and intelligent cyber⁃space security intelligence service architecture. [Method/process] Using the enhanced Hall model as the analytical framework and adhering to the principles of centering on cyberspace security and security intelligence as a service, this study constructs a cyberspace security intelligence service architecture and deeply analyzes its operating mechanism.[Result/conclusion] The cyberspace security intelligence service architecture consists of three components: process submodule, logic submodule, and cognition submodule. The service processes cater to three types of demands: cyber⁃space security perception, cyberspace security judgment, and cyberspace security execution. The service work reflects the operating logic of " attack scenario traceability-event correlation identification-crisis response escalation". The
cognition of cyberspace security intelligence services is mainly embodied in three aspects: value consensus, technical support, and capability guarantee. The construction of the cyberspace security intelligence service architecture can pro⁃ vide a reference for intelligence service work in China's cyberspace security guarantee system.