基于能力机会意图模型的网络安全态势感知方法

网络安全态势感知是提高安全管理员对网络整体安全状况掌控能力的重要技术手段。针对现有网络安全态势感知方法评估要素不够全面的问题，从攻击方、防护方、网络环境三方面出发构建了网络安全态势感知的能力机会意图模型，引入不确定推理模型解决了安全态势要素间的不确定影响关系，给出了能力指数、机会指数和意图指数的计算方法，并介绍了详细的网络安全态势感知方法。使用林肯实验室的公开数据集进行了实验，结果表明本文方法评估要素更为全面，评估结果符合实际情况。

A network security situational awareness method based on capability-opportunity-intent model

Network security awareness is an important technical mean to improve the network security control ability of network security administrators. In view of the problem that the assessment elements of current methods are not complete, this paper built a network situational awareness model which used the situation elements from attacker, defender and network environment. Then introduced the uncertainty reasoning model to solve the uncertain impact between the security situation elements and presented the detailed computing methods of capability index, opportunity index and intent index. After that this paper introduced a network security situational awareness method. Finally, used the public datasets of Lincoln Laboratory to conduct experiments, the experiment results showed that the method in this paper used more comprehensive evaluation elements and were much more according to the actual situations.