Network security situational awareness method

Abstract

The invention discloses a network security situational awareness method in the technical field of information security, which comprises the steps of: acquiring data from security defect software and / or hardware, preprocessing data, and using the preprocessed data as data samples; carrying out characteristic extraction and dimension reduction on the data samples by using manifold learning to obtain output values of the data samples; clustering the output value of the data samples by using a core matching integration clustering algorithm; fusing the clustered results by adopting DS (Data Set) evidential reasoning; estimating network security situation and threat by adopting a hierarchical model; predicting network security situation in a set future time length by using historical data and the current network security situation; and judging that the network security is threatened according to a set threshold. According to the invention, the real time and the accuracy of the network security situational awareness are enhanced.

Description

A Network Security Situational Awareness Method technical field The invention belongs to the technical field of information security, and in particular relates to a network security situation awareness method. Background technique The network has penetrated into every aspect of modern life, but there are huge hidden dangers in the network security that people pay close attention to. Traditional network defense methods such as firewalls, anti-virus software, and intrusion detection systems (IDS) are all passive network defenses, which cannot meet people's current requirements for network security. Network security situational awareness is a proactive network defense method. It can not only reflect the current network security situation, but also predict potential attacks in the network, so as to make active defense against potential attacks. Network security situation awareness is to obtain a large amount of log data from software and hardware such as firewalls, security a...

AI Technical Summary

Problems solved by technology

Due to the huge amount of data obtained from firewalls, security audits, and anti-virus software, this seriously restricts the real-time performance of network security situation assessment and prediction

Images