Method and system for evaluating network safety situation

Abstract

The invention relates to a method for evaluating the security situation of a network and a system thereof. The system has a two-surface three-level framework and is provided with a public service surface and a service management surface for executing uniform coordinated management on each functional module of the system; according to a service logic processing flow, the system is divided into three levels: an acquisition level, an analysis level and an exhibition level for completing four evaluating operations of assets, frangibility, threat and security situation; the invention is based on the characteristic of service operation in the network, combines the prior risk evaluation method, the prior flow and the prior security detection tool and provides a set of a novel dynamic real-time evaluation method. The system can analyze the assets and service of the network and the risk of the whole network and carries out the evaluation of the security situation. The system can provide the security state of the whole network in macroscopy, can deepen to specific service and assets and know the specific security problem, thereby effectively helping network security personnel to analyze the root of the security problem and assisting to provide a security solution proposal and implement a defense measure.

Description

technical field [0001] The invention relates to a dynamic, expandable network security situation assessment method and system thereof, belonging to the technical field of network security. Background technique [0002] With the continuous expansion of the network scale, the current network has played an increasingly important role in social life; at the same time, network security issues have become increasingly prominent, and have gradually become the key issues that need to be solved urgently for the further development of network services and applications . In addition, with the development of network intrusions and attacks toward distribution, scale, complexity, and indirection, the threats and losses caused by network viruses and Dos / DDos attacks are increasing. Many researchers and Organizations have begun to realize that it is impossible to monitor the entire network security situation in real time only by relying on existing network security products. [0003] Netw...

AI Technical Summary

Problems solved by technology

[0008] From the above explanations, it is not difficult to find that there are still some problems in the research at home and abroad: (1) The existing tools are not real-time: the network security situation is to monitor the network security situation in real time, but the existing monitoring system is generally The problem is that the real-time performance is not strong

(2) Single data source: The relevant factors of the network security situation are complicated, and the current data source selection is too single

(3) The display of the security situation does not highlight the key points and is too ordinary

(4) The extraction of risk data is too simplistic, such as only focusing on threats, etc.

This will naturally introduce new functional entities and new protocols, and also introduce new security risks

Images