Network intrusion situation intention evaluation method based on alarm integration

Abstract

The invention belongs to the technical field of the network security, and especially relates to a network intrusion situation intention evaluation method based on alarm integration. The method comprises the following steps: collecting network environment information, generating a Bayes attack graph model, wherein the network environment information at least comprises network connectivity, networkservice loopholes, host network configuration and access policy information, and the Bayes attack graph model comprises an attack state node, an atom attack node and an alarm evidence node; setting alarm confidence and association strength through the Bayes attack graph model, extracting effective alarm evidence; respectively computing the alarm confidence of the effective alarm evidence for eachattack state node; and evaluating the intruded probability of the effective node, and outputting the threaten order of all situation intention nodes. The method disclosed by the invention is low in computation complexity, not overly dependent on the historic data, simple and convenient for operation, capable of improving the node attack probability prediction accuracy, thereby providing reliable and effective data reference for defense decision and providing reliable guidance for the safety defense decision of the auxiliary network.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to a method for evaluating network intrusion situation intentions based on alarm fusion. Background technique [0002] In today's era of globalization, network technology is like the nerves of the entire society, profoundly affecting the development of international politics, economy, culture, society, military and other fields. As the network structure becomes more and more complex and the scale becomes larger and larger, the intrusion process is also developing towards a large-scale, concealed and camouflaged trend. The intrusion intention assessment technology integrates and correlates the alarm data, combines the super-alarm after alarm aggregation and alarm confirmation with the actual background knowledge of the network, digs out the real network threats and security events in it, and reveals the surface of each security event. The logical association behind it calcu...

AI Technical Summary

Problems solved by technology

However, there are two difficult problems in the evaluation of intrusion intention based on causal correlation: the detection of false positives and the setting of correlation strength. Accuracy of assessment

Images