Quantitative evaluation method of network security situation based on attack graph

Abstract

The invention relates to a quantitative evaluation method of a network security situation based on an attack graph, and belongs to the field of information security technology. The method specifically comprises the following steps: step 1, generating the attack graph; step 2, evaluating the importance of nodes in the attack graph G; step 3, on the operation basis of step 1, calculating the maximum probability that the nodes in the attack graph G are successfully permeated; and step 4, obtaining an evaluation value of the network security situation. Compared with the prior art, the method provided by the invention has the following advantages: (1) by adoption of the evaluation method based on the attack graph, the intention of multi-step attacks of an attacker using the loopholes in the network can be reflected. (2) The data used in the evaluation method are easy to collect and are operable. (3) The protection conditions of the nodes in the network obtained in the evaluation process reflect the protection conditions of the nodes in the network. (4) In the evaluation method, the topological information of the network, loophole association information and the attack intention of the attacker are comprehensively considered, and thus the precision of the evaluation result is high.

Description

technical field [0001] The invention relates to a quantitative evaluation method of a network security situation based on an attack graph, and belongs to the technical field of information security. Background technique [0002] With the rapid development of computer networks, security loopholes and hidden dangers in network information systems are also emerging one after another. The types and numbers of network attacks have doubled, and basic networks and information systems are facing severe security threats. In this context, it is of great significance to study the quantitative assessment of network security situation. [0003] In recent years, the evaluation of network security situation has gradually developed from stand-alone, local, and qualitative analysis to distributed, global, and objective analysis. At present, most network security assessment methods are mostly qualitative assessments. The disadvantage is that researchers have different definition standards fo...

AI Technical Summary

Problems solved by technology

At present, most network security assessment methods are mostly qualitative assessments. The disadvantage is that researchers have different definition standards for network security, which brings uncertainty to assessment and emergency response, and the assessment results are subjective. sex

The main problems of existing quantitative evaluation research programs are: operational difficulties and non-scalability

For example, the application of Bayesian network to quantitatively evaluate network vulnerabilities proposed by Lian YiFeng et al. This method is a quantitative evaluation calculation method, and its disadvantage is that it cannot overcome the problem of obtaining a large number of prior probabilities in the calculation process of Bayesian network.

Images