考虑时间参数的网络安全态势评估模型研究

针对已有网络安全态势评估由于缺乏考虑数据源时变性而造成的证据源证据不可靠、评估出现误差的问题,引入时变函数来刻画多源证据的时变性,提出时变D-S证据理论,用以提高证据的可靠性。使用改进的时变D-S证据理论方法对多传感器的证据进行融合,得到威胁的发生概率,并在此基础上提出带有时间参数的网络安全态势评估层次化模型;最后利用网络实例数据,对所提出的网络安全态势评估模型进行了验证。实验对比结果表明,该模型对实际网络运行情况的评估更符合实际情况。

Network security situation assessment model based on time parameter

For resolving the problem that due to the lack of consideration of time-varying of data sources, the existing network security situation assessment usually failed to make the source of evidence reliable enough and error existed in the assessment results, this paper introduced the time-varying function to describe the time-varying multi-source evidence. It proposed the time-varying D-S evidence theory to improve the reliability of the evidence. The occurrence probability of the threat was obtained by using the improved time-varying D-S evidence theory to multi-sensor fusion of the evidence. On this basis, it proposed the hierarchical model with time parameter. Finally it gave an example of the actual network datasets to valiadate the network security situa-tion awareness model. The results of the experimental comparison show that this model is more in line with the actual situation.