Network security situation assessment method

Abstract

The invention discloses a network security situation assessment method. Each index in a network is used as a basis; a node situation and a link situation in the network are separately computed according to the threat degree of an attack suffered by the node, the occurrence rate of the attack risk, the loss value of the node, and the delay, congestion degree and packet loss probability of the linkby using the index information collected by the node and the index information collected by the link; then the two situations are integrated to form the final security situation of the whole network.The method provided by the invention can effectively measure the state of the network according to the instant information of the network, and is simple and effective.

Description

technical field [0001] The invention belongs to the field of network security anomaly detection and relates to a network security situation assessment method. Background technique [0002] The research on network security situation assessment technology started earlier. In 1999, Tim Bass first proposed the concept of Cyberspace Situation Awareness (CSA). Situational Awareness Functional Model. With the increasing number of Internet security incidents, network security situational awareness has become a major research direction in the field of information security. Foreign scholars have been known to carry out long-term research on network security situational awareness and have achieved many results. Stephen Lau's "The Spinning Cube of Potential Doom" system at the Lawrence Berkeley National Laboratory in the United States has greatly improved network situational awareness. SILK developed by the NetSA group of SEI (Software Engineering Institute) of Carnegie Mellon Univer...

AI Technical Summary

Problems solved by technology

For example, there is a lack of comprehensive consideration of network security factors, and the data source used for evaluation is single

SILK and "The Spinning Cube of Potential Doom" system have relatively single influencing factors, which cannot accurately assess the network security situation

The method proposed by Srihari R, the method proposed by Chen Xiuzhen et al. and the method proposed by Wei Yong et al. do not include the link threat, which makes the overall assessment incomplete. The method proposed by Chen Hong et al. and the method proposed by Liu Shiwen et al. Threat assessment method, but its link threat assessment method is too complicated and the effect is not very good

Images