Network safety state evaluation and attack prediction method

Abstract

The invention discloses a network safety state evaluation and attack prediction method, which comprises the following steps of: 1) selecting representative IDS alarms from alarms generated by an intrusion detection system IDS in a set observation period, and taking each selected representative IDS alarm as an attack step; arranging the representative IDS alarms belonging to the same class of attacks according to a time sequence to obtain an attack step sequence of the class of attacks; 2) respectively extracting an attack event from the attack step sequence of each type of attack; 3) generating a training sequence to train a Markov model (HMM) by utilizing attack events extracted from the attack step sequence of the mth attack, and storing each trained HMM and a corresponding training sequence S; and 4) for an observation sequence, matching the observation sequence with the training sequence S corresponding to each HMM, selecting the most matched HMM, inputting the observation sequenceinto the most matched HMM, and evaluating the network safety state corresponding to the observation sequence.

Description

technical field [0001] The invention relates to a network security state evaluation and attack prediction method based on a semi-Markov conditional random field, and belongs to the technical field of computer network security. Background technique [0002] A multi-step attack is a common form of cyber attack today, which consists of a group of related malicious activities performed by the same attacker to achieve a specific goal. Due to the extreme sophistication of the techniques attackers use to attack computer systems and networks, many techniques, such as intrusion detection systems (IDS), have been developed to detect attacks. As the complexity and size of the network grows, IDS generate a large amount of alarm data. In general, an attack phase includes several associated attack events. The present invention can analyze these massive IDS alarm data, identify and extract information about attack events, and such information can be used for security state assessment and...

AI Technical Summary

Problems solved by technology

In [Udaya Sampath K. Perera Miriya Thanthrige, Jagath Samarabandu, and Xianbin Wang. "Intrusion Alert Prediction Using a Hidden Markov Model." arxiv:1610.07276, 2016.], the number of hidden states in the HMM model is uncertain, so The model can only predict attack types and categories, and lacks assessment of "attack phase" and security status

Images