Network security early warning method and device based on situation awareness

Abstract

The invention discloses a network security early warning method and device based on situation awareness, and the method comprises the steps: obtaining the security scene information depending on the activity of a network, analyzing the security scene information through a processor, and determining a security guarantee value; extracting network information of each device from the weblog, wherein the network information comprises an identifier of the device, the number of attacks suffered by the device and historical operation data; for each node in the network topology, determining the security situation of the node according to the degree of the node and the network information of the equipment at the node; and determining whether the network is safe or not according to the security situation of each node, and if not, performing security early warning. The network situation is predicted by analyzing the required security guarantee value of the security scene information and then through the security of the nodes in the network topology and the vulnerability of the passing degree response, and then the security alarm is performed, so that the mode is more flexible and accurate, and the accuracy of network security early warning can be improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network security early warning method and device based on situational awareness. Background technique [0002] With the rapid development of computer and communication technology, the application of computer networks is becoming more and more extensive, and its scale is becoming larger and larger, and the multi-level network security threats and security risks are also increasing. Network viruses, Dos / DDos attacks, etc. Threats and losses are increasing, and network attacks are developing toward distributed, large-scale, and complex trends. Relying only on single network security protection technologies such as firewalls, intrusion detection, antivirus, and access control can no longer meet the needs of network security. There is an urgent need for new technologies to detect abnormal events in the network in a timely manner, grasp the network security situation in real...

AI Technical Summary

Problems solved by technology

[0003] The inventor found in the process of realizing the present invention that: the prior art usually adopts a unified security early warning strategy for different activity scenarios, and different activity scenarios have different network security requirements, and following the unified security early warning strategy may cause Security guarantees are too strict or too loose, and the accuracy of security warnings is poor. Existing technologies cannot meet the needs of network security warnings in different activity scenarios

Images