Network safety event hazard index evaluation method and system based on multi-dimensional association

Abstract

The invention discloses a network safety event hazard index evaluation method based on multi-dimensional association, and also discloses a network safety situation awareness system adopting the network safety event hazard index evaluation method. The method is established on the basis of an asset database and a vulnerability database. The harm of the attack event to the safety network is calculated by using threat modeling; threats brought to a safety system by specific threat attacks are quantified, factors influencing network safety, including safety events, host vulnerabilities, provided services and the like, are considered, the hazard degree of the activities is analyzed according to the corresponding relationship between the safety activities and assets, vulnerabilities and the like,and the evaluation result is more accurate and credible.

Description

technical field [0001] The present invention relates to a network security assessment method, in particular to a network security incident hazard index assessment method based on multi-dimensional association, and also relates to a network security situation awareness system using the network security incident hazard index assessment method, which belongs to the network security technical field . Background technique [0002] At present, the global network security environment and situation have undergone profound changes. The main problem to be solved is: when an attacker launches an attack and a security incident occurs, can it be detected and warned in the shortest time, and can it have time to prepare? and disposal. As a proactive network defense technology, network security situation awareness can not only reflect the current network security situation, but also predict potential attacks in the network, so as to make active defense against potential attacks. [0003] ...

AI Technical Summary

Problems solved by technology

[0002] At present, the global network security environment and situation have undergone profound changes. The main problem to be solved is: when an attacker launches an attack and a security incident occurs, can it be detected and warned in the shortest time, and can it have time to prepare? and disposal

[0005] However, the existing technology represented by the above-mentioned patent application has the following problems: the lack of linkage and interoperability in the true sense and comprehensive cross-analysis capabilities based on various logs

Due to the lack of more scientific qualitative and quantitative analysis methods, it is impossible to accurately assess the threat level of security incidents, to propose practical emergency prevention measures, and to be unable to meet the tasks and goals of security early warning.

Images