System and method for estimating network security situation based on index logarithm analysis

Abstract

The invention discloses a system and method for estimating network security situation based on index logarithm analysis. The system is characterized by comprising a data acquisition sub-system, a network security situation understanding sub-system, a network security situation estimation sub-system and a security reinforcement scheme sub-system. The method comprises the following steps: A, carrying out statistical data fusion and correlation analysis on data of a network system in the aspects of asset, threat and vulnerability so as to obtain standardized data, wherein the data is acquired by a transducer; and B, carrying out the network security situation estimation on the fused standardized data in the step A based on the index logarithm analysis. The confidentiality, the integrity and the availability of the network security situation are estimated in the aspects of the asset, the threat and the vulnerability, and the estimation result is output. The system and method provided by the invention can be applied to the situation estimation and risk estimation. According to the system and method provided by the invention, the linear increment of the security situation can be avoided with the increment of network size, thus not only highlighting influences on security incidents with high hazard and significant assets, but also considering influences on security incidents with low hazard and nonsignificant assets, thereby complying with practical situations.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to a network security situation assessment system and method based on logarithmic analysis. Background technique [0002] Situation Awareness (SA) is the perception and understanding of environmental factors and the prediction of its future development trend under certain time and space conditions. [0003] Network security situation awareness is to acquire, understand, evaluate and predict the future development trend of many factors affecting network security in a large-scale network environment. Fine Metrics. [0004] Situation assessment is the core of situation awareness, and it is a qualitative and quantitative description of network security status. Network security situation assessment is the foundation and key part of the whole network security situation awareness. [0005] Based on relevant information security technology and management standard...

AI Technical Summary

Problems solved by technology

[0006] The risk assessment method based on GB / T 20984-2007 can be used for reference in the assessment of network security situation, but the matrix method is only used in the situation where one element value is determined by two element values, the calculation process is not intuitive, and it cannot be calculated well From a single asset, threat, vulnerability to multiple assets, threats, vulnerabilities

Images