Network security situation fuzzy evaluation method based on uncertain data

Abstract

The invention provides a fuzzy evaluation method used for evaluating a network security situation value of a hierarchical model, and the method comprises the steps that: an evaluation factor set and a judgment set used for evaluating network security situation indexes of a top-level node of the hierarchical model are determined; a membership function is established, and the probability that attribute data of each child node in the evaluation factor set belong to different judgment ranks in the judgment set is determined according to the membership function; a fuzzy evaluation matrix is established on the basis of the determined probability that each child node belongs to different judgment ranks; the importance weight of each child node over the top-level node of the hierarchical model isdetermined; and the network security situation indexes of the top-level node is calculated according to the established fuzzy evaluation matrix and the determined importance weight of each child nodeover the top-level node of the hierarchical model, and thereby the network security situation value of the hierarchical model is finally calculated. The fuzzy evaluation method has the advantages that the security situation of a network is evaluated through introducing fuzzy mathematics and a fuzzy analytical hierarchy process (FAHP) into the fuzzy evaluation method, and thereby the problem of data uncertainty during the evaluation of the network security situation is well solved.

Description

technical field [0001] The invention relates to a network security situation fuzzy assessment method, in particular to a network security situation fuzzy assessment method based on uncertain data. Background technique [0002] With the widespread promotion of network applications, various security incidents emerge in an endless stream, causing different degrees of harm to the network. Common network security facilities such as firewalls, intrusion detection systems, etc., can only obtain network information in the form of logs, which can only explain what network attacks some hosts have encountered, and it is difficult to describe the network security situation of the entire network. The network security situation refers to the current state and changing trend of the security of the entire network composed of various network equipment operating conditions, network behaviors, and user behaviors. It is worth noting that situation emphasizes the environment, dynamics, and the ...

AI Technical Summary

Problems solved by technology

[0009] Since based on figure 1 The network security situation evaluation system of the model shown involves a lot of uncertainty, so only the system administrator can directly assign quantitative values ​​to the attributes according to the detected attribute data and map them to the corresponding security levels, so that the subjective factors are not suitable for the calculation of the above methods. relatively large impact

That is to say, in this hierarchical network threat situation assessment method, the mapping between each attribute value and the network security situation and the determination of the importance of each attribute is a dynamic, multi-variable, and human factor plays a major role. , so there are many uncertain factors and complex logical relations

Moreover, although the above method combines objective statistical information and subjective empirical knowledge to give a specific importance measure, it ignores the ambiguity between attribute data and network security status and the uncertainty between the importance of network security attributes.

Images