Quantitative assessment method of network situation based on attack chain factor

Abstract

The invention discloses a network situation quantitative evaluation method based on attack chain factors, which includes: identifying evaluation indicators of each stage of network attack, and constructing a situation evaluation index system; establishing an evaluation model from bottom to top, first partly and then overall; Define the weight or score of each evaluation index in the situation factor layer of the evaluation model to establish scoring criteria; collect security logs and traffic data within a preset period, and obtain all secondary index score data in the evaluation model according to the scoring criteria; The score data of the first-level indicators is calculated to obtain the score data of the first-level indicators; the overall situation value of the network is calculated according to the score data of the first-level indicators. Through the technical solution of the present invention, it is possible to more accurately and comprehensively quantify the attack and threat situation of the network, so as to quickly find security weaknesses, take targeted countermeasures, and provide a powerful solution for improving the active defense capabilities of known threats and unknown threats. support.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network situation quantitative evaluation method based on an attack chain factor. Background technique [0002] At present, with the increasing expansion, dynamics and complexity of the network information system, the security threats from the network are also increasing exponentially. Hackers use various loopholes to carry out multi-stage attacks on the network, which makes network security risk assessment more and more people's attention. In order to reduce the risk of the network system, many network security scanning tools have appeared in the field of network risk assessment, such as IDS, NESSUS, ISS, etc., and their stand-alone inspection functions are relatively strong. Safely configured and running application services can detect security vulnerabilities in a timely manner, but the overall analysis function is relatively weak, and it is impossible to conduct c...

AI Technical Summary

Problems solved by technology

In order to reduce the risk of the network system, many network security scanning tools have appeared in the field of network risk assessment, such as IDS, NESSUS, ISS, etc., and their stand-alone inspection functions are relatively strong. Safely configured and running application services can detect security vulnerabilities in a timely manner, but the overall analysis function is relatively weak, and it is impossible to conduct correlation analysis on various configuration vulnerabilities, software vulnerabilities, security incidents and the relationship between them, resulting in inaccurate evaluation results. Precise and lack of integrity

Images