Intrusion process layering online risk assessment method

Abstract

The invention discloses an intrusion process layering online risk assessment system and a method, which are used for assessing the risk condition produced on three layers of the service, the host and the network of an occurrent intrusion process in real time. In the invention, on the layer of the service, an evidence theory is used for fusing multi vectors in an alarm thread to compute a risk index, wherein the vectors can response risk change conditions, the objective condition of intrusion risks is reflected by the risk index, and simultaneously, with target risk distribution reflected by subjective safety awareness, the risk condition of a target is comprehensively assessed; on the layer of the host, a risk assessment method based on a cask principle is provided; and on the layer of the network, a safety dependence network concept is provided, and an improved risk spreading algorithm is utilized so as to complete the risk assessment of the layer of the network. According to the invention, the alarm processes of alarm verification, aggregation and correlation as well as alarm confidence learning are closely combined with the risk assessment, so that the subjectivity, the fuzziness, the uncertainty and other problems in the risk assessment are better processed.

Description

technical field [0001] The present invention relates to an online risk assessment method for an intrusion process, especially a method for assessing the risk of an intrusion process by using the analytic hierarchy process, especially using the alarm calculation risk of various security devices collected in real time on the security management platform. The service layer, the host layer, and the network layer carry out risk assessment on the intrusion process, which belongs to the field of computer information security. Background technique [0002] As an important means of network defense, IDS (intrusion detection system) can identify intruders and intrusion behaviors, detect and monitor successful intrusions, and respond to intrusions. However, the existing IDSs generally have the problems of high false alarm rate, false negative rate, and a large number of repeated alarms. Most of the attacks detected by IDS are single attack actions during the intrusion process, and the d...

AI Technical Summary

Problems solved by technology

Most of the risk assessment models and methods proposed by researchers are offline, focusing on system vulnerability assessment at various levels, but there are few real-time and online risk assessment methods and models for intrusion.

Images