A Quantitative Network Security Evaluation Method and Evaluation System

Abstract

The invention provides a quantitative network security evaluation method and evaluation system. The method of the present invention includes: using the network flow data acquisition module to monitor the network flow in each network node in the target system, and collecting the network flow data of the network node and sending it to the model parameter calculation module and the network security evaluation module; using the model parameter calculation module Calculate the network communication analysis model parameters according to the network flow data and send them to the network security assessment module; use the network security assessment module to receive the network communication analysis model parameters, establish a network communication analysis model according to the network communication analysis model parameters, and pass the network communication analysis model Calculate the security level assessment report of the target system based on the network flow data. The evaluation method and evaluation system of the present invention calculate the non-directly measurable security level through the measurable network flow data, solve the problem that the network security confidentiality ability cannot be directly measured, and can provide scientific basis for data security protection.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a quantitative network security evaluation method and evaluation system. Background technique [0002] Network security confidentiality assessment is very important for data security protection. Generally speaking, it is impossible to directly measure the network security and confidentiality capabilities in a real system, but different levels of network security and confidentiality capabilities will be displayed through its global network flow. For example, in a system with weak network security and confidentiality capabilities, information from The possibility of high-trust level security domains flowing to low-security-level security domains, the number of network flows, and the scope of occurrence are relatively large. In systems with high network security and confidentiality capabilities, information flows from high-trust level security domains to low-security le...

AI Technical Summary

Problems solved by technology

[0003] Traditional network security and confidentiality analysis is difficult to quantitatively analyze the real security and confidentiality of the network

For example, traditional system security risk assessment methods include benchmarking inspection, security vulnerability scanning, analysis and evaluation based on intrusion detection results, and network security situation analysis based on network flow detection, among which benchmarking inspection is a static security Standard comparative evaluation cannot reflect the actual functions and effects of various security control measures in the system. The evaluation method based on security vulnerability scanning cannot explain the actual threat and the possibility of the threat faced by the system, that is, it cannot reflect the real risk level of the system. Based on intrusion detection The risk analysis and evaluation of the results are affected by the accuracy rate and false negative rate of the intrusion detection system, and the results are not reliable. On the one hand, the security situation analysis based on network flow detection faces the same security effects and security efficiency problems as the former. On the other hand, there is no evaluation mechanism specifically for system security capabilities

Images