首页 | 本学科首页   官方微博 | 高级检索  
     

层次化网络安全威胁态势量化评估方法
引用本文:陈秀真,郑庆华,管晓宏,林晨光. 层次化网络安全威胁态势量化评估方法[J]. 软件学报, 2006, 17(4): 885-897
作者姓名:陈秀真  郑庆华  管晓宏  林晨光
作者单位:西安交通大学,网络化系统与信息安全研究中心,制造系统工程国家重点实验室,陕西,西安,710049;西安交通大学,网络化系统与信息安全研究中心,制造系统工程国家重点实验室,陕西,西安,710049;清华大学,智能与网络化系统研究中心,北京,100084
基金项目:中国科学院资助项目;国家科技攻关项目;国家杰出青年科学基金
摘    要:安全评估是贯穿信息系统生命周期的重要管理手段,是制定和调整安全策略的基础和前提.只有充分识别系统安全风险,才能有针对性地采取有效的安全防范措施.基于IDS(intrusion detection system)海量报警信息和网络性能指标,结合服务、主机本身的重要性及网络系统的组织结构,提出采用自下而上、先局部后整体评估策略的层次化安全威胁态势量化评估模型及其相应的计算方法.该方法在报警发生频率、报警严重性及其网络带宽耗用率的统计基础上,对服务、主机本身的重要性因子进行加权,计算服务、主机以及整个网络系统的威胁指数,进而评估分析安全威胁态势.实验表明,该系统减轻了管理员繁重的报警数据分析任务,能够提供服务、主机和网络系统3个层次的直观安全威胁态势,使其对系统的安全威胁状况有宏观的了解.而且,可以从安全态势曲线中发现安全规律,以便调整系统安全策略,更好地提高系统安全性能,为指导安全工程实践、设计相应安全风险评估和管理工具提供了有价值的模型和算法.

关 键 词:网络安全  威胁评估模型  威胁指数  入侵检测系统  威胁态势
收稿时间:2004-06-09
修稿时间:2005-07-11

Quantitative Hierarchical Threat Evaluation Model for Network Security
CHEN Xiu-Zhen,ZHENG Qing-Hu,GUAN Xiao-Hong and LIN Chen-Gu. Quantitative Hierarchical Threat Evaluation Model for Network Security[J]. Journal of Software, 2006, 17(4): 885-897
Authors:CHEN Xiu-Zhen  ZHENG Qing-Hu  GUAN Xiao-Hong  LIN Chen-Gu
Abstract:Evaluating security threat status is very important in network security management and analysis. A quantitative hierarchical threat evaluation model is developed in this paper to evaluate security threat status of a computer network system and the computational method is developed based on the structure of the network and the importance of services and hosts. The evaluation policy from bottom to top and from local to global is adopted in this model. The threat indexes of services, hosts and local networks are calculated by weighting the importance of services and hosts based on attack frequency, severity and network bandwidth consumption, and the security threat status is then evaluated. The experiment results show that this model can provide the intuitive security threat status in three hierarchies: services, hosts and local networks so that system administrators are freed from tedious analysis tasks based on the alarm datasets to have overall security status of the entire system. It is also possible for them to find the security behaviors of the system, to adjust the security strategies and to enhance the performance on system security. This model is valuable for guiding the security engineering practice and developing the tool of security risk evaluation.
Keywords:network security  threat evaluation model  threat index  intrusion detection system  threat situation
本文献已被 CNKI 维普 万方数据 等数据库收录!
点击此处可从《软件学报》浏览原始摘要信息
点击此处可从《软件学报》下载全文
设为首页 | 免责声明 | 关于勤云 | 加入收藏

Copyright©北京勤云科技发展有限公司  京ICP备09084417号