A Vulnerability Analysis Method for Network Operation and Maintenance

Abstract

The invention discloses a network operation and maintenance vulnerability analysis method. The method comprises the following steps: step 1, collecting network basic information; step 2, establishinga network operation and maintenance basic information representation model; step 3, establishing a user deserved permission matrix; step 4, establishing a permission change rule set; step 5, establishing a user actual permission matrix; and step 6, calculating a network operation and maintenance vulnerability index. According to the network operation and maintenance vulnerability analysis method disclosed by the invention, the vulnerability additionally introduced to a network in a network operation and maintenance activity is focused on discovering a security gap between the specific implementation of the network and a network planning design; when the network operation and maintenance vulnerability is discovered, the information in the traditional network domain is not only used, and a large amount of semantic information in a physical domain and an information domain are also used, so that a vulnerability analysis result is more specific and true; and the difference between the actual permission and the deserved permission of each user in a target network is used as the measurement of the network vulnerability, and the impact of the current network operation and maintenance activity on the network vulnerability is focused on.

Description

technical field [0001] The invention relates to network security analysis technology, in particular to a measurement and analysis method for network operation and maintenance vulnerability. Background technique [0002] In computer networks, vulnerability-related research can be divided into several problem domains, including definition of vulnerability, identification of vulnerability and analysis and assessment of vulnerability. From the perspective of the object of vulnerability analysis, the existing network vulnerability analysis methods are mainly divided into two categories, one is to evaluate a certain part of the network, such as the vulnerability assessment of network communication protocols, and the network hardware equipment or software system. Vulnerability assessment, which analyzes its possible potential damage, does not involve the overall properties of the network; the other is to conduct qualitative or quantitative assessments on the overall characteristics...

AI Technical Summary

Problems solved by technology

[0005] Second, the object of vulnerability analysis is different

[0006] Third, the measurement and analysis methods of vulnerability are different

Images