Attack occurrence confidence-based network security situation assessment method and system

Abstract

The invention belongs to technical fields characterized by protocols and discloses an attack occurrence confidence-based network security situation assessment method and system. According to the attack occurrence confidence-based network security situation assessment method and system, a machine learning technology is adopted to analyze network stream data and calculate a probability that networkstreams belong to attack streams; a D-S evidence theory is used to fuse the information of multi-step attacks to obtain the confidence of attack occurrence; and a network security situation is calculated by means of situational factor integration on the basis of security vulnerability information, network service information and host protection strategies; and therefore, the accuracy of assessmentis effectively improved. Since the confidence information of detection equipment is added to the assessment system, the influence of false negatives and false positives can be effectively reduced. Anensemble learning method is adopted, so that the accuracy of confidence calculation can be improved. A network attack is regarded as a dynamic process, and merging processing is performed on the information of the multi-step attacks. Information fusion technology is adopted, so that network environment characteristics such as vulnerabilities, service information and protection strategies are comprehensively considered.

Description

technical field [0001] The invention belongs to the technical field characterized by protocols, and in particular relates to a network security situation assessment method and system based on the confidence of attack occurrence. Background technique [0002] At present, the existing technologies commonly used in the industry are as follows: In order to evaluate the network security situation accurately and efficiently, the current idea is mainly to use data fusion to directly use the log or alarm information output by the security monitoring equipment for fusion processing to obtain the overall security situation of the network. The evaluation result of the security situation is very dependent on the accuracy of network attack identification by intrusion detection equipment or log inspection equipment. Due to the complexity of network attacks and the continuous evolution of attack methods, security detection equipment often has deviations in the identification of attacks, a...

AI Technical Summary

Problems solved by technology

However, due to the complexity and concealment of attack methods, the boundary between normal behavior and attack is often blurred, and simple divisions based on thresholds will result in false negatives and false negatives

[0003] In summary, the problems in the prior art are: The proliferation of false negatives and false negatives makes the data source of security situational awareness unreliable, affecting the accuracy of the entire quantitative evaluation system

The continuous evolution of network attacks and the complexity of the network environment have increased the difficulty of research in this field

Images