Internal threat model establishing method based on layered mapping

Abstract

The invention provides a method for establishing an internal threat model based on layered mapping. The method comprises the following steps: establishing a partial ordering relation by using resource access control authority of a user defined by an access control relation of a system on resources, and establishing hierarchical models of a subject and an object according to the partial ordering relation; establishing mapping between the subject hierarchical model and the object hierarchical model according to the access control relation between the subject and the object so as to form a hierarchical quantized model which overall describes internal threat characteristics of the system from the subject aspect and the object aspect; quantizing the internal threat characteristics related to the subject and the object by using an analytic hierarchy process, and interrelating the internal threat characteristics of the subject and the internal threat characteristics of the object according to the mapping relation between the subject model and the object model to realize fusion of the internal threat characteristics of the subject and the object. The fusion realizes simultaneously monitoring of the internal threat characteristics of the subject and the object, so that a system security administrator can comprehensively observe a variation regulation of the threat inside the system from real-time evaluation and detection data of the system internal threat, and discover the internal threat in time.

Description

technical field [0001] The invention belongs to the technical field of information security and control and decision-making, and relates to technologies such as security management, access control, control and decision-making, in particular to an internal threat model based on subject-object hierarchical mapping, which is applied to the security management of networks and information systems and security controls. Background technique [0002] With the development of social networking and informatization, how to comprehensively ensure the security of information systems has become a common problem faced by people. The current security threats faced by the system can be divided into security threats from inside the system InsiderThreat (referred to as internal threats) and security threats from outside the system Out Threat (external threats) according to the source of the threats. [0003] Security threats from outside the system exploit the vulnerabilities of the system to...

AI Technical Summary

Problems solved by technology

[0014] The present invention aims at security issues such as misuse and deliberate destruction of internal legal personnel in the current system security field, and aims at threats brought by internal personnel with legal authority in the system, and proposes an internal system based on subject-object layered mapping. threat model

Images