A matrix multi-granularity network security threat situation assessment method

Abstract

The invention relates to a matrix multi-granularity network security threat situation assessment method, which belongs to the technical field of network information security. According to the multi-stage characteristics of the current network attack, based on the topology of the protected network and different types of attack information collected by the intrusion detection system, and the vulnerability information collected by the network scanning device, combined with the gradual and in-depth attack stages in the complete attack process, for the first time Corresponding various attack information and attack stages, a matrix network security threat situation model is constructed, and the corresponding quantitative evaluation algorithm is given. The evaluation method proposed by the invention can provide more granular and detailed situation information. In particular, the threat situation formed by each stage of attack on each host and the comprehensive threat situation formed by each stage of attack cannot be given by all current hierarchical evaluation models.

Description

technical field [0001] The invention relates to a matrix multi-granularity network security threat situation assessment method, which belongs to the technical field of network information security. Background technique [0002] The so-called network security threat situation refers to the state and trend of threats faced by the network. A practical and effective network security threat situation assessment can enable security managers to grasp the security status and trends of the network in real time and accurately, fully understand the risks existing in the network, take timely and effective security precautions, and eliminate security risks in the bud. [0003] The research on network security threat situation assessment mainly involves three core technologies including network security threat situation assessment model, assessment algorithm and visualization of assessment results. It is a new direction in the field of network security, and the research is difficult and t...

AI Technical Summary

Problems solved by technology

[0013] 1. The host (Host) in the model refers to the server that can provide network services (Service), and does not include other devices in the network. Therefore, the evaluation of the status of the host is limited to the evaluation of the status of the server that provides network services. The evaluation is Incomplete; Furthermore, the model's assessment of the network system (System) situation only considers the impact of devices such as servers on the network system situation, and the assessment is not comprehensive, so the assessment accuracy is not high enough