Network security situation evaluation method

Abstract

The invention discloses a network security situation evaluation method. The method comprises the following steps: 1) determining the importance weights of network devices and hosts; 2) separately evaluating the network devices and hosts; and 3) integrating the evaluation results of the network devices and hosts into an evaluation result of the whole network system. According to the network security situation evaluation method disclosed by the invention, with the device assets as the center, the evaluation process is divided into three stages: the first stage is to determine the importance weights of network devices and hosts; the second stage is to separately evaluate the network devices and hosts; and the third stage is to integrate the evaluation results of the network devices and hosts into the security situation of the whole network. For the evaluation of a single device asset, the evaluation factors are divided into 8 categories, which are attacker capability, attack consequences, vulnerability damages, vulnerability transmission, security measures, security configuration correctness, security strategy and security strategy implementation, and the security situation is quantified from the perspective of threat and defense.

Description

technical field [0001] The invention relates to a network security situation assessment method, which belongs to the technical field of network security. Background technique [0002] With the popularization of Internet applications, the scale of the network is getting larger and more complex. Correspondingly, network attacks are also developing in the direction of distribution, scale, and complexity. For network administrators, there is an urgent need for security products that can display the overall situation of network security. [0003] The so-called network security situation refers to the network security status composed of various factors such as network attack behavior and network defense measures, which can be expressed, and displayed in the form of numerical quantification. Network security situation assessment can help network managers understand the current state of network security and take targeted security measures to prevent potential risks. [0004] At p...

AI Technical Summary

Problems solved by technology

However, there are two problems in the current method: one is that when the network system is divided into individual hosts, the weight of the hosts is not easy to determine; the other is the factors that affect the security situation, that is, the evaluation elements are not comprehensive enough

These issues affected the accuracy of the final assessment of the security posture

Images