Bayesian network-based multi-step attack security situation assessment method

Abstract

The invention relates to a network security situation assessment method, in particular, a Bayesian network-based multi-step attack security situation assessment method. The method includes the following steps that: multi-step attack generating patterns are mined through association analysis, so that an attack graph can be constructed; a Bayesian network is established according to the multi-step attack graph, attack wills, probability of success of attacks and the accuracy of event monitoring are defined as the probability attributes of the Bayesian network; based on the event monitoring, a multi-step attack risk is calculated according to the posterior reasoning and cumulative probability of the Bayesian network; and the security situations of a host and the whole network are quantitatively assessed according to a hierarchical quantitative assessment method. With the method of the invention adopted, the problem of lack of correlation analysis in a network security situation assessment process can be solved. According to the method of the invention, monitoring events are taken into risk assessment, and a network security situation assessment model is accurately established, and therefore, the effectiveness and real-time performance of the method of the invention can be enhanced.

Description

technical field [0001] The invention relates to a network security assessment method, in particular to a Bayesian network-based multi-step attack security situation assessment method. Background technique [0002] With the rapid growth of my country's Internet market and the number of users, network security problems are also emerging. This makes the Internet, while benefiting the general public, be challenged by information theft, failures, accidents, viruses, etc., and the problems of network security and usability are becoming more and more prominent. Therefore, there is an urgent need for a new security technology that can process large-scale daily network data and form targeted protection strategies to improve network security performance, and research on network security situational awareness has emerged as the times require. [0003] Network security situational awareness is a proactive security defense mechanism. It will standardize and integrate multi-source heter...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a multi-step attack security situation assessment method based on Bayesian network, to solve the threat assessment of multi-step attack, the problem of lack of correlation between multi-steps, and to take monitoring events into risk assessment , to accurately establish a network security situation assessment model, which enhances the effectiveness and real-time performance of the present invention

Images