Network attack situation peacetime and wartime status assessment method and device based on CBA algorithm and Bayesian network

Abstract

The present invention discloses a network attack situation peacetime and wartime status evaluation method and device based on CBA algorithm and Bayesian network, firstly, continuous numerical data of network security related monitoring indicators are obtained to construct sample data; data are discretized and association rules are mined; Bayesian network topology is constructed, the sample data after discretization is applied to perform structure learning of Bayesian network, pessimistic error rate is introduced to prune directed edges in network topology, and the final Bayesian network model is obtained; finally, the indicator is monitored based on the final Bayesian network model, whether it is abnormal or not is determined, the peacetime and wartime status rating is obtained, and multiple key indicators are set, when any key indicator is abnormal, the peacetime and wartime status rating is improved. The present invention is helpful to conduct real-time dynamic evaluation of the network security situation of government and enterprise units, so as to realize the agile switching of "peacetime" strategy and implement systematic response to sudden network threats.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method and device for evaluating the peacetime and wartime status of network attack situations based on a CBA algorithm and a Bayesian network. Background Art

[0002] In response to the demand for dynamic assessment of the peacetime and wartime status of network attack situations in government and enterprise units, the present invention designs a method for mining association rules for non-Boolean data, and proposes a peacetime and wartime assessment method for enterprise network attack situations in combination with Bayesian network technology. Dynamic and real-time assessment of the enterprise network security situation is carried out to provide a basis for the autonomous switching of security operation strategies and enhance the enterprise's emergency threat response capabilities. That is, based on the key indicator data of the peacetime and wartime status obtained through long-term monitoring, the CBA algorithm and Bayesian network technology are used for in-depth data analysis, and combined with key parameter correction, a peacetime and wartime status assessment model is established to achieve dynamic assessment of the peacetime and wartime status of the enterprise network attack situation based on real-time data monitoring results, providing support for the enterprise's rapid and autonomous switching of "peacetime and wartime" and the implementation of systematic agile responses to sudden threats. Summary of the invention

[0003] The purpose of the present invention is to address the deficiencies of the prior art and to propose a network attack situation peacetime and wartime status assessment method and device based on CBA algorithm and Bayesian network.

[0004] The objective of the present invention is to achieve the following technical solution: a network attack situation peacetime and wartime state assessment method based on CBA algorithm and Bayesian network, the method comprising the following steps:

[0005] (1) Obtain continuous numerical data of network security-related monitoring indicators, construct sample data, and mark wartime samples;

[0006] (2) Calculate the class information entropy in the sample data, divide the boundaries, and complete the discretization of the data; mine association rules based on the CBA algorithm;

[0007] (3) Construct the Bayesian network topology based on association rules, apply the discretized sample data to perform Bayesian network structure learning, introduce the pessimistic error rate to prune the directed edges in the network topology, and obtain the final Bayesian network model;

[0008] (4) Based on the final Bayesian network model, the indicators are monitored to determine whether they are abnormal, obtain the peacetime and wartime status rating, and set multiple key indicators. When any key indicator is abnormal, the peacetime and wartime status rating is improved.

[0009] Furthermore, the monitoring indicator data includes seven dimensions: WEB attacks, emails, high-risk applications, host security, threat modeling, honeypots, and antivirus. The time nodes for collecting each monitoring indicator data are recorded to establish a monitoring indicator system.

[0010] Furthermore, the trial and error method is used to test multiple combinations of minimum support and minimum confidence, and the number of strong association rules mined under each combination is counted; the strong association rule mining process is as follows:

[0011] (2.1) Taking each indicator as the classification target, the strong association rules are mined based on the CBA algorithm to obtain a set of strong association rules;

[0012] (2.2) Process all the strong association rules in the class strong association rule set, remove the attribute values ​​of all indicators, and then get the corresponding strong association rule set;

[0013] (2.3) Aggregate the rules of each strong association rule set and remove duplicates;

[0014] (2.4) Delete conflicting rules and obtain the final strong association rules.

[0015] Furthermore, the conflict rules specifically include:

[0016] a) retain those with higher support;

[0017] b) If the support is the same, the one with higher confidence is retained;

[0018] c) If the support and confidence are the same, keep the first generated rule.

[0019] Furthermore, the specific process of step (3) is as follows:

[0020] (3.1) Construct the initial topological structure of the Bayesian network based on association rules, and use the discretized sample data to learn the Bayesian network structure;

[0021] (3.2) Sort the strong association rules in descending order according to support and confidence;

[0022] (3.3) Sequentially select each strong association rule, take the index in the antecedent of each strong association rule as the starting point and the index in the posterior as the end point, draw directed edges in the initial network topology, and in the case of directed edges forming a loop, discard the directed edges represented by the rules with the later order, and obtain the full edge network topology;

[0023] (3.4) Based on the full edge network topology, sample data is used to learn the Bayesian network parameters to obtain the Bayesian network model, and the first rating error rate of the model for network attack situations in peacetime and wartime under the sample data is calculated;

[0024] (3.5) Taking the full edge network topology as the starting point, delete its first directed edge and perform parameter learning to obtain the model , calculate the second rating error rate of the model in peacetime and wartime network attack situation; Processing: If the second rating error rate is less than the first rating error rate, the first directed edge is cut off, otherwise it is retained, thereby obtaining a new network topology after processing;

[0025] (3.6) Taking the new network topology outputted in step (3.5) as the starting point, repeat step (3.5) to traverse all directed edges in the full edge network topology to obtain the final Bayesian network topology;

[0026] (3.7) Based on the final Bayesian network topology, the sample data is used to learn the Bayesian network parameters and obtain the Bayesian network model for network attack situation monitoring in peacetime and wartime.

[0027] Furthermore, the key indicators include the number of non-false alarm reports of intranet honeypots, the number of complex non-false alarm reports with manual responses, and the number of HIDS alarm disposals.

[0028] Furthermore, the network security situation peacetime and wartime status monitoring process is as follows:

[0029] S1: Dynamically collect data other than peacetime and wartime status ratings through security equipment;

[0030] S2: Process the monitoring data into discretized level data;

[0031] S3: Substitute the discretized monitoring values ​​of each indicator into the Bayesian network model as the initial state of each node to obtain the initial evaluation results of the peacetime and wartime states;

[0032] S4: Based on the initial evaluation results of S3, the evaluation results are revised according to key indicators to obtain revised results;

[0033] S5: Adjust the security operation peacetime and wartime strategies based on the revised peacetime and wartime status assessment results.

[0034] In the second aspect, the present invention provides a network attack situation peacetime and wartime status assessment device based on the CBA algorithm and the Bayesian network, comprising a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it implements the network attack situation peacetime and wartime status assessment method based on the CBA algorithm and the Bayesian network.

[0035] In a third aspect, the present invention provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, the method for evaluating the peacetime and wartime status of a network attack situation based on a CBA algorithm and a Bayesian network is implemented.

[0036] In a fourth aspect, the present invention provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the method for evaluating the peacetime and wartime status of a network attack situation based on a CBA algorithm and a Bayesian network.

[0037] Beneficial effects of the invention: Aiming at the needs of enterprises to dynamically evaluate the peacetime and wartime status of network attack situations, the invention introduces two technologies, namely, the CBA algorithm and the Bayesian network, establishes a peacetime and wartime status evaluation model driven by data, and designs a peacetime and wartime monitoring method for network attack situations of government and enterprise units. This helps to conduct a real-time and dynamic evaluation of the network security situation of government and enterprise units, thereby realizing the agile switching of the "peacetime" and "wartime" strategies and implementing a systematic response to sudden network threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0039] Figure 1 It is a schematic diagram of the strong association rule mining process of the present invention.

[0040] Figure 2 This is a schematic diagram of the network topology obtained after pruning of the present invention.

[0041] Figure 3 It is a schematic diagram of the Bayesian network model for network attack situation peacetime and wartime monitoring of the present invention.

[0042] Figure 4 It is a schematic diagram of the network security situation peacetime and wartime status monitoring process of the present invention.

[0043] Figure 5 It is a schematic diagram of the peacetime and wartime state evaluation results of the present invention.

[0044] Figure 6 It is a structural diagram of a network attack situation peacetime and wartime state assessment device based on CBA algorithm and Bayesian network of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with the accompanying drawings and implementation examples. It should be understood that the specific implementation examples described herein are only used to explain the present invention and are not used to limit the present invention.

[0046] The present invention provides a network attack situation peacetime and wartime status assessment method based on CBA algorithm and Bayesian network, which specifically includes the following steps:

[0047] 1. Establishment of monitoring indicator system

[0048] In the scenario of network security situation monitoring and automatic switching between peacetime and wartime, in wartime, when the enterprise is attacked suddenly or the defense boundary has been breached, it is necessary to enhance threat discovery and response strength and improve emergency coordination efficiency to respond to emergencies. The present invention defines the enterprise network security situation in peacetime and wartime as three levels, namely:

[0049] (1) The “normal” state, represented by the enterprise’s daily stable operation time, is subject to a small number of routine scanning detection attacks;

[0050] (2) The “heavy protection” state, represented by the key protection period, is characterized by a further increase in domestic and foreign detection scans, and there may be a large-scale scanning situation through the proxy pool;

[0051] (3) A “wartime” state, represented by periods of targeted attacks from real attackers, where the enemy is subjected to a variety of complex and high-intensity attack methods.

[0052] Based on the above definition, it is necessary to dynamically monitor multi-dimensional data related to network security, so as to conduct a comprehensive assessment of the network security situation, distinguish between peacetime and wartime states, and assist enterprises in taking targeted measures to respond.

[0053] Considering the data availability and network security situation assessment characteristics, the present invention selects monitoring content from seven dimensions: WEB attack, email, high-risk application, host security, threat modeling, honeypot, and antivirus. At the same time, considering the business volume of the enterprise, and the network attacks and email attacks suffered are highly correlated with time and whether it is a working day, it is also necessary to record the time nodes of data collection of various monitoring indicators. Therefore, a monitoring indicator system as shown in Table 1 is established.

[0054] According to the established monitoring indicator system, each indicator data within a certain time window is periodically counted through each security device. The time window selected by the present invention is 1 hour, and all indicator data collected each time are defined as a group of samples, and the relative time of sample collection is marked. The samples cover real wartime periods such as industry network protection operations and internal attack and defense drills of enterprises. The samples collected in these periods are marked as wartime samples. The samples of other periods are judged by professional security operators to determine whether there is a wartime state, thereby completing data collection.

[0055] Table 1

[0056]

[0057] 2. Mining Association Rules for Continuous Data

[0058] Traditional association rule mining algorithms can only process Boolean data sets and cannot effectively mine association rules for continuous data represented by network attack data. To this end, the present invention designs a method for mining strong association rules for continuous data based on the CBA algorithm, which is used to prune the Bayesian network topology structure.

[0059] (1) Data preprocessing

[0060] In the monitoring data, except for relative time, the rest are continuous numerical data. In view of the fact that the CBA algorithm and Bayesian network cannot process continuous numerical data, the minimum entropy partitioning method is applied to complete the data discretization process. , and its dataset , let its discretization boundary be , defined by The class information entropy under the partition caused by is defined as:

[0061]

[0062] in, For the dataset The information entropy of is defined as:

[0063]

[0064] In the formula, represents the number of classes after the data is decentralized. Indicates the index data set The probability of a class appearing. and its dataset , find the partition boundary that minimizes the class information entropy , as the binary partition boundary of this round of partitioning. If and only if the data partition recursively satisfies the following conditions:

[0065]

[0066] The recursion stops when:

[0067]

[0068]

[0069] The indicator data set to be discretized The number of elements in Representation dataset The number of samples in . At this point, the continuous data is discretized. By using the above method, the discretization processing of data other than relative time and peacetime and wartime status is completed.

[0070] (2) Association rule mining based on CBA algorithm

[0071] On the basis of discretization of original data, the CBA algorithm in association rule mining is used for data mining to obtain strong association rules between monitoring indicators and between monitoring indicators and peacetime and wartime status, thus laying the foundation for the subsequent Bayesian network model.

[0072] An association rule looks like this: ,in It is called the LHS (Left Hand Side) or antecedent of the rule. It is called the RHS (Right Hand Side) or consequent of the rule.

[0073] In contrast, a class association rule looks like this: ,say is the LHS (Left Hand Side) or antecedent of the rule, where This pair consisting of an indicator and its attribute value is called a ;say is the RHS (Right Hand Side) or consequent of the rule, where This pair consisting of an indicator and its attribute value is .

[0074] In order to obtain the best mining results, that is, to ensure that a large number of low-quality rules are not generated and that important correlations between factors are not missed, it is necessary to tune the key parameters in the mining algorithm, that is, to find the best minimum support and minimum confidence. The present invention uses a trial-and-error method to test multiple combinations of minimum support and minimum confidence, and evaluates the effectiveness of the mining results by counting the number of strong association rules mined under each combination, and comparing the obtained strong association rules with the opinions of field experts and related results. Finally, the minimum support is set to 0.5 and the minimum confidence is set to 0.5. Figure 1 As shown in the figure, the strong association rule mining process is as follows:

[0075] 1. Take indicator A1 as the CBA classification target to mine class strong association rules and obtain the class strong association rule set ;

[0076] 2. Similarly, each indicator is used as the classification target for mining, and the corresponding class strong association rule set is obtained. ;

[0077] 3. Yes Process the strong association rules of the full volume class and remove all , Attribute values, from which to the corresponding strong association rule set ;

[0078] 4. Summarize the strong association rules into centralized rules and remove duplicates;

[0079] 5. Delete conflicting rules according to the following strategy to obtain the final strong association rules: For conflicting rules (i.e., two rules with swapped antecedents and consequents), a) retain the one with higher support; b) if the supports are the same, retain the one with higher confidence; c) if the supports and confidences are the same, retain the rule generated first.

[0080] Through the above process, the strong association rules (partial) shown in Table 2 are mined.

[0081] Table 2

[0082]

[0083] 3. Bayesian Network Construction

[0084] On the basis of association rule mining, the Bayesian network topology structure is initially established according to the obtained strong association rules, and this structure is used as the initial structure. The discretized case data set is used for structural learning of the Bayesian network, and the pessimistic error rate is further introduced to prune the directed edges in the network topology to obtain the final Bayesian network structure. According to this structure, the case data is used for parameter learning to determine the parameters of the network conditional probability table. The specific process is as follows:

[0085] (1) Use the discretized sample data to learn the Bayesian network structure. The learning algorithm is Bayesian Search. The algorithm parameters are:

[0086] Max Parent Count: 8

[0087] Iterations: 20

[0088] Sample Size: 50

[0089] Link Probability: 0.1

[0090] Prior Link Probability: 0.01

[0091] Get the initial network topology .

[0092] (2) Sort the strong association rules in descending order according to support and confidence.

[0093] (3) Sequentially select each strong association rule, with the index in the previous item as the starting point and the index in the next item as the end point, in the initial network topology Draw the directed edges in the graph. If the directed edges form a loop, discard the directed edges represented by the rules with the lower sorting order to obtain the full edge network topology. .

[0094] (4) Based on the sample data, the Bayesian network parameters are learned, and the training parameter confidence is set to 1 to obtain the Bayesian network model. , calculate the error rate of the model in the peace and war rating under the sample data .

[0095] (5) As the starting point, delete its first directed edge, and perform parameter learning to obtain the model , calculate the error rate of the model's peacetime and wartime ratings .right Processing: such as , then the directed edge is cut off, otherwise it is retained. Thus, the processed new network topology is obtained .

[0096] (6) Starting from the new network topology output in step (5), repeat this step to traverse All directed edges in the network are obtained, and the final network topology is obtained ,like Figure 2 shown.

[0097] (7) The final Bayesian network topology Based on the sample data, the Bayesian network parameter learning is carried out to obtain the Bayesian network model for network attack situation monitoring in peacetime and wartime. ,like Figure 3 shown.

[0098] 4. Key indicator revision

[0099] For some monitoring indicators, when their monitoring values ​​are abnormal, that is, when the monitoring values ​​are not 0, it is highly likely that the enterprise network boundary has been breached and the enterprise internal network has begun to be attacked. In this case, the rating of the enterprise's current peacetime and wartime status should be adjusted immediately to take systematic and targeted measures to deal with the threat.

[0100] The present invention selects three indicators in the monitoring indicator system, namely, the number of non-false alarm reports of intranet honeypots, the number of complex non-false alarm reports of manual responses, and the number of HIDS alarm disposals. When the monitoring value of any one of the indicators is greater than 0, the peacetime and wartime status rating is increased by one level.

[0101] 5. Peacetime and Wartime Assessment Process

[0102] like Figure 4 As shown in the figure, the process of monitoring the enterprise network security situation in peacetime and wartime is as follows:

[0103] (1) Dynamically collect data other than peacetime and wartime status ratings through various types of security equipment;

[0104] (2) According to the data preprocessing process, the monitoring data is processed into discrete level data;

[0105] (3) Substitute the discretized monitoring values ​​of each indicator into the Bayesian network model as the initial state of each node, and take the state with the highest probability among the three states of the peacetime and wartime nodes as the evaluation result, such as Figure 5 As shown:

[0106] (4) Based on the evaluation results of step (3), the evaluation results are corrected according to the key indicator correction strategy to obtain the corrected results;

[0107] (5) The enterprise shall adjust the safety operation strategy in peacetime and wartime according to the revised assessment results of peacetime and wartime status. If the assessment result is "heavy security", the safety operation strategy can be automatically switched to the "heavy security" status; if the assessment result is "wartime", the safety operation status should be switched to the more intense "wartime" status after manual review.

[0108] Corresponding to the aforementioned embodiment of a method for evaluating the peacetime and wartime status of a network attack situation based on a CBA algorithm and a Bayesian network, the present invention also provides an embodiment of a device for evaluating the peacetime and wartime status of a network attack situation based on a CBA algorithm and a Bayesian network.

[0109] See also Figure 6 An embodiment of the present invention provides a network attack situation peacetime and wartime status assessment device based on a CBA algorithm and a Bayesian network, comprising a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement a network attack situation peacetime and wartime status assessment method based on a CBA algorithm and a Bayesian network in the above-mentioned embodiment.

[0110] An embodiment of a network attack situation peacetime and wartime status assessment device based on a CBA algorithm and a Bayesian network provided by the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the internal memory for execution. From a hardware perspective, if Figure 6 As shown in FIG. 1 , a hardware structure diagram of a network attack situation peacetime and wartime state assessment device based on a CBA algorithm and a Bayesian network provided by the present invention is provided in any device with data processing capability, except Figure 6 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0111] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0112] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0113] An embodiment of the present invention further provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, a network attack situation peacetime and wartime status assessment method based on a CBA algorithm and a Bayesian network in the above embodiment is implemented.

[0114] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0115] The present invention also provides a computer program product, including a computer program. When the computer program is executed by a processor, the method for evaluating the peacetime and wartime status of network attack situations based on the CBA algorithm and the Bayesian network is implemented.

[0116] The above embodiments are used to illustrate the present invention rather than to limit the present invention. Any modification and change made to the present invention within the spirit of the present invention and the protection scope of the claims shall fall within the protection scope of the present invention.

Claims

1. A network attack situation peacetime and wartime status assessment method based on CBA algorithm and Bayesian network, characterized in that: The method comprises the following steps: (1) Obtain continuous numerical data of network security related monitoring indicators and construct sample data; (2) Calculate the class information entropy in the sample data, divide the boundaries, and complete the discretization of the data; mine association rules based on the CBA algorithm; (3) Construct the Bayesian network topology based on association rules, apply the discretized sample data to perform Bayesian network structure learning, introduce the pessimistic error rate to prune the directed edges in the network topology, and obtain the final Bayesian network model; the specific process is as follows: (3.1) Construct the initial topological structure of the Bayesian network based on association rules, and use the discretized sample data to learn the Bayesian network structure; (3.2) Sort the strong association rules in descending order according to support and confidence; (3.3) Sequentially select each strong association rule, take the index in the antecedent of each strong association rule as the starting point and the index in the posterior as the end point, draw directed edges in the initial network topology, and in the case of directed edges forming a loop, discard the directed edges represented by the rules with the later order, and obtain the full edge network topology; (3.4) Based on the full edge network topology, sample data is used to learn the Bayesian network parameters to obtain the Bayesian network model, and the first rating error rate of the model for network attack situations in peacetime and wartime under the sample data is calculated; (3.5) Taking the full edge network topology as the starting point, delete its first directed edge, and perform parameter learning to obtain model BN1, and calculate the second rating error rate of the network attack situation of the model in peacetime and wartime; process BN1: if the second rating error rate is less than the first rating error rate, then cut off the first directed edge, otherwise keep it, thereby obtaining a new network topology after processing; (3.6) Taking the new network topology outputted in step (3.5) as the starting point, repeat step (3.5) to traverse all directed edges in the full edge network topology to obtain the final Bayesian network topology; (3.7) Based on the final Bayesian network topology, the sample data is used to learn the Bayesian network parameters to obtain the network attack situation peacetime and wartime monitoring Bayesian network model; (4) Based on the final Bayesian network model, the indicators are monitored to determine whether they are abnormal, obtain the peacetime and wartime status rating, and set multiple key indicators. When any key indicator is abnormal, the peacetime and wartime status rating is improved.

2. According to claim 1, a network attack situation peacetime and wartime status assessment method based on CBA algorithm and Bayesian network is characterized in that: The monitoring indicator data includes seven dimensions: WEB attacks, emails, high-risk applications, host security, threat modeling, honeypots, and antivirus. The time nodes for collecting each monitoring indicator data are recorded to establish a monitoring indicator system.

3. According to claim 1, a network attack situation peacetime and wartime status assessment method based on CBA algorithm and Bayesian network is characterized in that: The trial and error method is used to test multiple combinations of minimum support and minimum confidence, and the number of strong association rules mined under each combination is counted; the strong association rule mining process is as follows: (2.1) Taking each indicator as the classification target, the strong association rules are mined based on the CBA algorithm to obtain a set of strong association rules; (2.2) Process all the strong association rules in the class strong association rule set, remove the attribute values ​​of all indicators, and then get the corresponding strong association rule set; (2.3) Aggregate the rules of each strong association rule set and remove duplicates; (2.4) Delete conflicting rules and obtain the final strong association rules.

4. According to claim 3, a network attack situation peacetime and wartime status assessment method based on CBA algorithm and Bayesian network is characterized in that: The conflict rules specifically include: a) retain those with higher support; b) If the support is the same, the one with higher confidence is retained; c) If the support and confidence are the same, keep the first generated rule.

5. According to claim 1, a network attack situation peacetime and wartime status assessment method based on CBA algorithm and Bayesian network is characterized in that: The key indicators include the number of non-false alarm reports of intranet honeypots, the number of complex non-false alarm reports responded to by manual response, and the number of HIDS alarm handling.

6. According to claim 1, a network attack situation peacetime and wartime status assessment method based on CBA algorithm and Bayesian network is characterized in that: The process of monitoring network security situation in peacetime and wartime is as follows: S1: Dynamically collect data other than peacetime and wartime status ratings through security equipment; S2: Process the monitoring data into discretized level data; S3: Substitute the discretized monitoring values ​​of each indicator into the Bayesian network model as the initial state of each node to obtain the initial evaluation results of the peacetime and wartime states; S4: Based on the initial evaluation results of S3, the evaluation results are revised according to key indicators to obtain revised results; S5: Adjust the security operation peacetime and wartime strategies based on the revised peacetime and wartime status assessment results.

7. A network attack situation peacetime and wartime status assessment device based on CBA algorithm and Bayesian network, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the processor executes the executable code, a network attack situation peacetime and wartime status assessment method based on a CBA algorithm and a Bayesian network is implemented as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by the processor, a network attack situation peacetime and wartime status assessment method based on a CBA algorithm and a Bayesian network is implemented as described in any one of claims 1 to 6.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by the processor, a network attack situation peacetime and wartime status assessment method based on a CBA algorithm and a Bayesian network is implemented as described in any one of claims 1 to 6.

Images