Network security situation assessment method based on evidence reasoning rule

Abstract

The invention discloses a network security situation assessment method based on an evidence reasoning rule. The method comprises the following steps: determining a basic structure of network securitysituation assessment; acquiring and preprocessing network data; determining an assessment rule of the network situation; extracting characteristics of the network data and calculating the trust of a basic attribute; calculating the final trust of a generalized attribute; and calculating the network security situation. According to the network security situation assessment method based on the evidence reasoning rule provided by the invention, a network behavior is divided into a normal behavior and an aggressive behavior; and the security situation of a network is analyzed through the changes of network resources such as traffic, a memory, a CPU and a disk, and the security level of the network is assessed through the above security factors and the evidence reasoning rule. In addition, quantitative analysis is performed on the obtained security situation; and through the change of a network security situation value, the change of the network security situation can be reflected. An experimental result shows that the method is effective and feasible, and has a good situation assessment effect.

Description

technical field [0001] The invention belongs to the technical field of information security, and relates to a network security situation assessment method, in particular to a network security situation assessment method based on evidence reasoning rules. Background technique [0002] Network security situational awareness is a new type of network security technology. It evaluates the network security situation in real time from a macro perspective, and predicts the development trend of the network security situation, providing a basis for administrators' decision-making analysis. Situation assessment is the core part of it, which reflects the overall security status of the network by comprehensively analyzing security factors in all aspects of the network. TimBass introduced situational awareness into the field of network security for the first time, after which many scholars conducted a series of research on network security situation. [0003] Frigault, Wen Zhicheng and o...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the problem that the traditional method ignores the threat of normal behavior peaks to the network, the present invention provides a network security situation assessment method based on evidence reasoning rules, which accurately reflects the network security situation and has good use value

Images