Network security situation evaluating method

Abstract

The invention discloses a network security situation evaluating method, and belongs to the technical field of network security. The method comprises the following steps of: 1) performing correlation analysis on input alarm information to obtain a host attack graph; 2) performing association analysis on the host attack graph according to input host vulnerability information to obtain a host expectation state graph; 3) calculating a host threat value by utilizing intrusive expectant threat and the host expectation state graph; 4) calculating a host comprehensive security situation by utilizing weight information of services provided by hosts and threat values of the hosts; 5) calculating a network component comprehensive security situation by utilizing network component performance information and weight values of network components; and 6) performing weighted calculation by utilizing the host comprehensive security situation and the network component comprehensive security situation toobtain a network security situation. The method can more accurately analyze the actual influence of attacks on the network hosts and the network components, analyzes threat caused by unknown attacks,and reflects the network security situation more accurately compared with the traditional method.

Description

Technical field [0001] The invention belongs to the technical field of network security, and specifically relates to a method for evaluating network security situation. Background technique [0002] With the rapid development of computer technology and communication technology and the continuous increase of user needs, computer networks have been used more and more widely. The network has the characteristics of resource distribution and sharing, user decentralization, and management decentralization, which provide the foundation for the realization of large-scale parallel computing and information services. However, the current network is facing a severe information security situation, and security issues have become a major obstacle to its development. Security situation assessment technology can reflect the dynamic security situation of the network as a whole, and predict and warn the development trend of the security situation. Therefore, the security situation assessment mod...

AI Technical Summary

Problems solved by technology

[0003] At present, there are mainly four types of methods for network security situation assessment: The first type is the visualization method. Allow administrators to have an intuitive understanding of the current network status, and use experience to judge whether the network is threatened by attacks, but the network security indicators reflected by this method are relatively single, and require a high level of experience for administrators

The second category is the method of data fusion based on the distributed sensors of the intrusion detection system, which evaluates the security situation of the computer network, and evaluates the security of the computer network through data fusion and data mining, but does not implement a specific prototype system

The fourth category is the hierarchical network security threat situation quantitative assessment method, which uses the intrusion detection system alarm information and network performance indicators, and combines the vulnerability information of the host to perform hierarchical security quantitative assessment on services, hosts, and networks to obtain intuitive security threats. situation map, but the selected situation assessment indicators are not comprehensive enough, and the quantitative algorithm results are not accurate enough

Images