基于集对分析的网络安全态势评估

为方便管理员更为直观地观察网络安全状况以便迅速作出应变措施,提出了基于集对分析的网络安全态势评估模型。首先对各个传感器的数据进行预处理,得到服务器和攻击的规范化数据,然后利用集对分析理论融合来自多个传感器的数据得到主机的安全态势,最后采用自下而上的层次化安全态势量化评估模型,以评估网络的整体态势。通过对DARPA 2000数据集的分析,证明集对分析比传统方法更能够对网络态势所处的级别进行明确划分,更好地得出整个网络简单的安全态势。

Network security situational awareness model based on set pair analysis

To observe the network security situation intuitively, so the administrator can make a quick decision, this paper proposed a network security situational awareness model based on set pair analysis. First of all, it preprocessed the data from every sensor. Then fused multisensor data by introducing the set pair analysis theory and worked out the SA of every host. Finally, it proposed a quantitative security situation assessment model by using bottom-up hierachical structure to evaluate the overall situation of the network. Through the analysis of the DARPA 2000 dataset, the result shows the set pair analysis can evaluate the exactly degree of the network security situation. So it can work out the whole security situation of the network.