Network security situation awareness system based on self-discipline computing and processing method thereof

Abstract

The invention discloses a network security situation awareness system based on self-discipline computing and a processing method thereof. The network security situation awareness system comprises a managed resource, an Agent cooperation layer module, a sensor, an effector module and a self-discipline manager module, wherein the Agent cooperation layer module is connected with the managed resource and the self-discipline manager module; and the sensor and the effector module are respectively connected with the Agent cooperation layer module and the self-discipline manager module. The network security situation awareness system has the advantages that the system structure and the situation extraction for situation awareness are improved, the system environment is adjusted autonomously to adapt to the environment change dynamically, so that dynamic allocation of resources, dynamic synthesis of services and dynamic correction of system parameters are realized.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network security situation awareness system based on autonomous computing and a technical solution thereof. Background technique [0002] With the popularization of the network, the threats it faces are increasing, and computer viruses, Trojan horse programs, and DoS / DDoS attacks are becoming more and more rampant. In order to ensure the safe operation of the network, the currently used intrusion detection, firewall, virus detection and other technologies are passive defense methods, which can only detect parts of the system, and the obtained information lacks correlation. Based on this situation, since the concept of network security situation awareness [1] was proposed in 2000, the research on related models and methods has quickly become a new research hotspot. [0003] Network security situational awareness is a new technology that emerges in response to the needs...

AI Technical Summary

Problems solved by technology

[0019] 1) The complexity of the threat propagation network results in a large state space, and the evaluation of large-scale networks is inefficient, requiring certain approximate processing, which may cause the accuracy of the evaluation results

[0020] 2) Due to the variability and trickery of the attacker's means, it is difficult to control the attack strategy and defense countermeasures when using this method to assess the situation, and it is difficult to realize it in practice

[0021] 3) The impact of the defense mechanism on the overall network security situation is not considered, but the overall network security situation is only evaluated from the perspective of attack or vulnerability

[0029] 1) The analysis of the security threat situation assessment system is based on the network intrusion detection sensor alarm log and the network bandwidth occupancy rate. However, this information cannot fully reflect the hacker's attack behavior

[0030] 2) There are more or less problems in the AHP adopted, such as the establishment of indicator weights is too subjective and absolute, and the consistency correction is too dependent on external participation

[0031] 3) How to integrate self-discipline features and dynamically adjust the configuration and corresponding operating parameters of the network security situational awareness system to achieve true self-adaptation according to changes in the current state of the system, security, and environmental parameters, etc., does not involve

Images