An immunity based network security risk estimation

There are two kinds of risk-estimation methods for the network security: static and real-time. The static methods estimate the network risk through statically evaluating the network value, security holes, and the occurring frequency of security events1], e.g., COBRA1), OCTAVE2], etc. Focusing on the static factors of the target system, the static methods can only make a rough estimation of the security risk that the network faced in the past, and cannot in real-time evaluate the risk of …

An immunity based network security risk estimation

According to the relationship between the antibody concentration and the pathogen intrusion intensity, here we present an immunity-based model for the network security risk estimation (Insre). In Insre, the concepts and formal definitions of self, nonself, antibody, antigen and lymphocyte in the network security domain are given. Then the mathematical models of the self-tolerance, the clonal selection, the lifecycle of mature lymphocyte, immune memory and immune surveillance are established. Building upon the above models, a quantitative computation model for network security risk estimation, which is based on the calculation of antibody concentration, is thus presented. By using Insre, the types and intensity of network attacks, as well as the risk level of network security, can be calculated quantitatively and in real-time. Our theoretical analysis and experimental results show that Insre is a good solution to real-time risk evaluation for the network security.