An attack detection method oriented to network system security metrics

Abstract

The invention relates to an attack detection method oriented to network system security metrics, which relates to the network security field. From the network system itself, and starting from networksystem security metrics, by establishing a baseline of network information system security utility, by measuring and evaluating the identification characteristic, traffic characteristic and utility influence of network system, comparing the actual utility with the expected utility, we can find the abnormity of network system, detect and discover the network attack in time, make up the deficiency of detection based on attack characteristic, and improve the veracity of attack detection. By effectively using metrics in a network system environment, a suitable set of metric is selected and data iscollected in a real project according to that set of metrics, According to the collected data to determine whether a network attack has occurred, through the use of network system measurement resultsto provide decision-making support for the detection of network attacks, for the evaluation object to actively find security issues, detection and judgment of network attacks to provide a basis.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an attack detection method oriented to network system security measurement. Background technique [0002] Network system security measurement refers to first establishing the security baseline of the network information system (the network information system has baselines of different security levels), and by measuring and evaluating the identification characteristics, traffic characteristics, and utility impact of the network system, the actual evaluation utility and expected Compare the security baselines to discover the abnormalities of the network system, detect and discover network attacks in a timely manner, and provide accurate guidance for network security decisions. [0003] In network system security, risk, attack and defense are interrelated, restricted and co-evolved. At present, the mainstream method of network attack detection is: by monitoring the origina...

AI Technical Summary

Problems solved by technology

However, this approach has two defects and deficiencies: on the one hand, it is impossible to perform effective attack detection on encrypted network traffic; on the other hand, this attack detection capability relies heavily on known attack characteristics