Network situation quantitative evaluation method based on attack chain factors

Abstract

The invention discloses a network situation quantitative evaluation method based on an attack chain factor. The method comprises the following steps: identifying evaluation indexes of each stage of network attack, and constructing a situation evaluation index system; establishing an evaluation model from bottom to top in a manner of firstly local and then integral; defining the weight or score ofeach evaluation index in the situation factor layer of the evaluation model to establish a scoring criterion; acquiring safety logs and flow data in a preset period, and acquiring all secondary indexscore data in the evaluation model according to a scoring criterion; performing calculation according to the second-level index score data to obtain first-level index score data; and calculating to obtain a network overall situation value according to the first-level index score data. Through the technical scheme of the invention, the attack threat condition of the network can be more accurately and comprehensively quantified, so that the security weakness is quickly found, targeted countermeasures are taken, and a strong support is provided for improving the active defense capability of knownthreats and unknown threats.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a quantitative assessment method of network situation based on an attack chain factor. Background technique [0002] At present, with the increasing expansion, dynamic and complexity of the network information system, the security threats from the network are also increasing exponentially. Hackers use various vulnerabilities to conduct multi-stage attacks on the network, which makes network security risk assessment more and more important. In order to reduce the risk of network systems, many network security scanning tools have appeared in the field of network risk assessment, such as IDS, NESSUS, ISS, etc., and their stand-alone inspection functions are relatively strong. The application services that are configured and run securely can detect security vulnerabilities in time, but the overall analysis function is relatively weak, and it is impossible to correlate vario...

AI Technical Summary

Problems solved by technology

In order to reduce the risk of the network system, many network security scanning tools have appeared in the field of network risk assessment, such as IDS, NESSUS, ISS, etc., and their stand-alone inspection functions are relatively strong. Safely configured and running application services can detect security vulnerabilities in a timely manner, but the overall analysis function is relatively weak, and it is impossible to conduct correlation analysis on various configuration vulnerabilities, software vulnerabilities, security incidents and the relationship between them, resulting in inaccurate evaluation results. Precise and lack of integrity

Images