Network security situation assessment method and system based on security knowledge graph

Abstract

The invention discloses a network security situation assessment method and system based on a security knowledge graph, and the method comprises the steps: building the security knowledge graph based on an obtained energy e-commerce network security situation, taking the security knowledge graph as input, determining a threat assessment model, and carrying out the attacker threat assessment of the energy e-commerce knowledge graph through the threat assessment model to obtain the threat assessment result; and based on the threat assessment result, performing security situation awareness analysis in combination with the security knowledge graph and the energy e-commerce network data. According to the method and system, more semantic information related to attacks can be mined by constructing the security knowledge graph, taking the security knowledge graph as input and combining the threat assessment model, so that the causal relationship of attack behaviors can be described, and more accurate threat identification and network security situation assessment are realized through rich context information.

Description

technical field [0001] The present invention relates to the technical field of network security, and more specifically, to a network security situation assessment method and system based on a security knowledge map. Background technique [0002] A very important functional point in the security situation awareness system is to evaluate the network security situation, which is a technical difficulty of the security situation awareness system. [0003] The traditional network security situation assessment method generally constructs a corresponding attack graph for the attack target to realize the assessment and quantification. The assessment process is usually as follows: first, conduct a security assessment based on a single asset, and then perform a weighted calculation on the asset score according to the importance of the asset to obtain Network security situation score, so as to realize network security situation assessment. [0004] However, the process of constructing ...

AI Technical Summary

Problems solved by technology

[0004] However, the process of constructing an attack graph based on large-scale data is highly complex, prone to errors in the construction process, and the dimensions considered by the attack graph are relatively limited. Therefore, the accuracy of existing network security situation assessment methods is not high.

Images