Macro network security status assessment method based on exception measurement

Abstract

A macro network safety state grade method based on abnormal measurement comprises: defining modeling parameter and grade standard, collecting sample data, extracting index variable for describing network safety state; extracting regularity factor capable of reflecting network operation state, filtering contingency factor, establishing network normal operation state model according to index variable extracted from sample data; collecting data to be detected, computing intensity of abnormality of detecting data and normal model; computing the normalized grade of the index according to intensity of abnormality of every index variable , giving the normalize grade of network integral state according to significance of the index variable. The invention can regulate modeling parameter and grading standard of every index variable, describe present state of important index variable of present network and integral state of network according to different involvement of every index variable in different network environment; the invention has merits of real time, accuracy, quantification and configurability.

Description

technical field [0001] The invention relates to the field of information security, in particular to a method for evaluating the security status of a macro network based on anomaly metrics. Background technique [0002] With the development of the Internet, the information and network security of the computer network are facing an unprecedented severe situation. The assessment of the security status of computer networks is becoming more and more important. In terms of the evaluation of network security status, at present, it mainly focuses on the risk assessment of important network assets in a local area, and there are very few research results involving the evaluation of the overall security status of the macro network. [0003] Among the technologies used in current risk assessment, whether it is the network risk status assessment model based on the analytic hierarchy process or the immune-based network intrusion risk assessment method, it is aimed at a specific network e...

AI Technical Summary

Problems solved by technology

The data collection range of this method is the simulated host address, not the real IP address on the backbone network; its main purpose is to evaluate the impact of Internet worm outbreaks, and it is difficult to evaluate the daily operation status of the macro network

Images