一种基于粗糙集理论的网络安全态势感知方法

网络安全态势感知是目前网络安全领域研究的一个热点问题.本文提出利用粗糙集理论进行网络安全态势感知,该方法把网络攻击行为作为网络安全要素,定量分析了各安全要素或安全要素组合对网络安全的威胁程度,最终建立了具有攻击行为、网络服务和安全态势3个层次的网络安全态势感知模型,并通过仿真实验生成了明确的网络安全态势图.采用粗糙集理论使得系统能够高效处理海量网络安全状态数据,生成易理解的攻击检测规则,清楚直观地反映攻击行为对网络整体安全状况的影响.

A Method of Network Security Situation Awareness Based on Rough Set Theory

Network security situation awareness is a hot research field in the network security domain. A method of network security situation awareness based on rough set theory is first used, in which network attack is regarded as the network security factor, and the threat degrees of each security factor or combination of them on network security are analyzed quantitatively, finally network security situation awareness model with three layers--attacks, network services and security situation is established and definite network security situation graph is created by the simulation experiment. The use of RST makes the network security situation awareness system be able to deal with large volumes of network data effectively, generate explainable attack-detectlon rules, then the influence of network attack on the whole network security can be reflected clearly and intuitively.