Network risk analysis method

Abstract

The invention provides an analysis method of network risks. Firstly, informations, such as topology, weaknesses, services, etc., are collected in order to structure a network attack map; secondly, according to the network attack map, the probability that each weakness is successfully utilized by attackers is calculated; thirdly, the probability of the successful utilization of each weakness is combined with the influence of the weaknesses affecting the services and data of hosts in order to calculate the risks of each weakness affecting the availability, security and integrality of the hosts; fourthly, considering the security requirement of each host, the comprehensive risk of each host is calculated; fifthly, according to the comprehensive risk of each host, the comprehensive risk of a network is calculated. The invention has the advantages of that the influence of the association among weaknesses, which affects the security of hosts and networks, is sufficiently considered and that the quantitative evaluation of the risk states of hosts is carried out according to security requirements, so that the results of evaluation are more real and reliable.

Description

(1) Technical field [0001] The invention relates to a network security evaluation technology, in particular to a quantitative evaluation technology for network risk. (2) Background technology [0002] The scale of the network is gradually expanding, the structure is becoming more and more complex, especially the continuous emergence of various new attack methods aimed at system weaknesses, which makes the risks faced by the network increasingly serious. In order to ensure the normal operation of the network, it is necessary for managers to conduct security assessments on the network, actively discover potential system security risks, and formulate effective security measures based on this. [0003] According to the data source, network security assessment methods can be divided into: 1) Dynamic assessment, which evaluates the security of the network according to the frequency of attack events and the threats they pose to the system. Most of these methods are quantitative an...

AI Technical Summary

Problems solved by technology

[0005] In a nutshell, the existing quantitative evaluation methods for network security generally have the following shortcomings: 1) Lack of analysis of the correlation between weaknesses

Due to the high interconnection of hosts in the network and the existence of penetrating attack methods, some hosts originally protected by firewalls also have the risk of being attacked. Existing quantitative evaluation methods often ignore such risks, resulting in inaccurate evaluation results

2) Does not consider security requirements

Each network or even each host under the same network has different security requirements for confidentiality, integrity, and availability. If the security requirements are not considered during the security assessment, the assessment results obtained must be inaccurate

Images