Network security situation evaluation method and system

Abstract

The invention discloses a network security situation evaluation method and a network security situation evaluation system for improving the application range and accuracy of network security situation evaluation. The method comprises: classifying all security events in a preset time period according to attack type to form at least one event collection; accumulating the attack risk grades of the security events in each event collection respectively, and determining the accumulated values as the rise degree values of the event collections; substituting the risk degree values of the event collections as independent variables into empirical functions fi() corresponding to the event collections to obtain the values of the credibility of the fact that the event collections render a network in an unsecure state; and using the values of the credibility of the event collections as weights of evidences, combining the weights of evidences by using a synthesis rule of the theory of evidence, and obtaining the credibility of the fact that the network is in an unsecure state in the preset time period. Thus, the technical scheme realizes the quantitative evaluation of the security situation of the whole network and improves the application range and accuracy of the network security situation evaluation.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network security situation assessment method and system. Background technique [0002] Network security situation assessment is an important research content in the field of information security. The so-called network security situation assessment refers to the use of assessment algorithms to comprehensively analyze each security element in cyberspace, and present the influence relationship and degree of influence between elements to the administrator in the form of a macro index, so that the administrator can perceive and perceive the network from a global perspective. The security situation of the system can then prompt administrators to make reasonable and accurate decisions. Network security situation assessment is the basis of the entire security management. [0003] At present, the quantitative and grading technology based on static weighting is widely used in network se...

AI Technical Summary

Problems solved by technology

[0006] However, since the quantitative and grading technology of static weighting follows the system level, host level, and then to the service level to merge and classify events combined with the target address of the event, this scheme has at least the following disadvantages: First, due to the classification and division of events Reliance on the target address such that the method will not apply if the target address does not exist or is not unique

For example, using ICMP messages to carry out flooding attacks without a clear target address, this method will not be applicable at this time and has obvious limitations

In addition, when multiple types of attack activities occur in the network at the same time, their processing characteristics only stay at the static weighting level, so that the fusion process of this technology cannot reflect the difference between the behavior characteristics of different attack activities, making the evaluation of the final result difficult. decreased accuracy

Images