Network security situation awareness model and method based on attack graph

Abstract

The invention discloses a network security situation awareness model and method based on an attack graph. The model comprises a data preprocessing module, an attack feature library construction module, an attack state identification module, a security situation evaluation module and a security situation prediction module. The method comprises: firstly, collecting data sets of different sources, and obtaining asset vulnerability threat data and asset attack threat data after preprocessing; further analyzing and training by utilizing the asset attack threat data and the principal component dataof the attack information, and establishing an attack feature library; matching the attack portrait, and determining the attack state of the current equipment; then, calculating a security situation value of the whole network by utilizing the asset attack threat data; and finally, predicting the next attack state through the attack and defense game matrix of the attack state diagram so as to predict the network security situation. A good situation awareness effect and a network security situation evaluation and prediction function are realized, and the model and the method have relatively goodpracticability, high efficiency and expansibility.

Description

Technical field: [0001] The invention relates to the field of computer network security, in particular to an attack graph-based network security situation awareness model. Background technique: [0002] With the rapid development of computer networks, network attacks are increasing year by year, and network security issues have become the focus of people's current attention. Usually, the network security situation is predicted, so that the network security status can be grasped before the network attack occurs. Therefore, corresponding protective measures are taken to avoid unnecessary attacks and losses. [0003] However, the research on the network security situation started relatively late in China, and most of them are researches on the network threat quantification process and intrusion detection process, which can only analyze the past or current network security situation, and cannot predict the network security situation; and there are a few Prediction models can on...

AI Technical Summary

Problems solved by technology

[0003] However, the research on the network security situation started relatively late in China, and most of them are researches on the network threat quantification process and intrusion detection process, which can only analyze the past or current network security situation, and cannot predict the network security situation; and there are a few Prediction models can only be applied to specific standard systems and application scenarios. The vulnerability warning information published by some security vulnerability library websites is highly random and discrete, and ordinary situation analysis models can only obtain some information based on statistical methods. The distribution of attributes, analyzing the current network security status, cannot make effective and reasonable situation prediction

Images