Threat data processing method for information system

Abstract

The invention discloses a threat data processing method for an information system. The method comprises the steps that an obtained information security incident is mapped into a potential threat index and an existing threat index; threat frequency calculation is performed on the existing threat index, the result of the frequency calculation is assigned to the security index threat index related to the information security incident; according to a preset period, information collection, formation and correlation are performed on the potential threat index according to a preset threat source to obtain a threat multi-component system; each threat element in a log of a target information system is indexed, the threat multi-component system is used for working out the occurrence probability of the multi-component system on the basis of an indexation calculation method, and assignment and mapping are performed to obtain a threat value; according to the security domain threat index and the threat value, a corresponding data model is generated so as to evaluate the security of the information system. By building the data model, a user can conveniently and visually observe the occurrence probability of each threat in the information security incident, and the threat with which the information system is faced can be evaluated objectively.

Description

technical field

[0001] The invention relates to the technical field of information security, in particular to a threat data processing method for an information system. Background technique

[0002] With the interconnection and interoperability of the network, the application of information business is getting closer and closer, and the security threats faced by an organization's information system are more and more showing the situation of "internal and external attack". The threats in the virtual network world tend to be consistent with the physical threats.

[0003] In order to ensure the security of information, it is necessary to identify and classify threats and take corresponding countermeasures. Threat identification requires the analysis of potential causes of accidents. There are various reasons for threats, which can be roughly divided into two categories: human factors and environmental factors. Power system information resources are attractive enough, and they ...

Images