A network security situation assessment method

Abstract

The invention provides a network security situation assessment method, including: generating a vulnerability list, an atomic attack list, and an attack evidence list according to the collected vulnerability information, network attack information, and attack evidence; establishing a Bayesian network; obtaining atomic attack posterior Probability; detect whether the causal relationship between atomic attack and attack evidence in Bayesian network is true; establish network attack system architecture, generate Bayesian attack graph; obtain atomic attack node attack probability; obtain vulnerability threat degree, and It is divided into three levels: Root authority level, User authority level, and None authority level; according to the three levels of vulnerability threat levels and the corresponding early warning values ​​of the three levels, it displays the overall assessment results of the network security situation. When the vulnerability threat level Alarm when exceeding the warning value corresponding to the three levels. The invention has the characteristics of simple model, accurate evaluation result, wide application range and the like, and can be widely used in the field of network security.

Description

technical field [0001] The invention relates to assessment technology, in particular to a network security situation assessment method. Background technique [0002] With the development of science and technology, network security issues have already become the focus of attention. In recent years, the number of network attack incidents has continued to increase. Various scientific research units study various security technical measures, evaluate network security situation, and prevent or even solve network attack problems. In the network security situation assessment technology, vulnerability exploit threat assessment technology has always been a key technology in the field of security situation assessment. [0003] Vulnerability utilization threat assessment methods include vulnerability severity assessment method and global security situation assessment method. The vulnerability severity assessment method mainly evaluates the severity of each vulnerability based on the ...

AI Technical Summary

Problems solved by technology

The global security situation assessment method first establishes a vulnerability assessment model based on the attack graph or Bayesian network, and then evaluates the overall security status of the system according to the status of all vulnerabilities in the system, and based on experience or vulnerability assessment system (CVSS, Common Vulnerability Scoring System) to obtain the probability of each vulnerability being successfully exploited; however, the vulnerability assessment model of the existing global security situation assessment method is relatively complex, and the accuracy of the assessment results is low

[0004] It can be seen that in the prior art, the network security situation assessment method has problems such as low accuracy of assessment results.

Images