Vulnerability situation data fusion method

Abstract

The invention discloses a vulnerability situation data fusion method. The concept of the vulnerability and the relation between the concepts can be clearly defined by constructing the vulnerability data body, and the inconsistency between the heterogeneous data collected by different collection tools can be effectively eliminated; the difference of different scanning tools on the vulnerability evidence aspect is considered, the difference is existent between the credibility degrees of the provided evidences, and the vulnerability situation data scanned by different tools are fused by adoptinga weighted D-S evidence theory method, the relative weight represents the credibility degree of each detection tool in the fusion process, thereby enabling the fusion result to more reflect the truth;and the better result can be obtained when multiple evidences are in conflict.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a vulnerability situation data fusion method. Background technique [0002] With the rapid development of Internet technology, the network has gradually become an indispensable part of people's life, and the network hazards are becoming more and more serious. Various security devices are used to detect attacks in the network, but most of these devices work independently, and network security managers cannot timely and accurately perceive the status of the entire network. In this case, network security situational awareness technology emerges as the times require. [0003] Network security situation awareness refers to the integration and processing of massive, multi-source, and heterogeneous security data to form specific situation information, and to judge the corresponding situation and predict future development trends through integrated analysis. Among them, vulner...

AI Technical Summary

Problems solved by technology

However, on the one hand, these vulnerability data present the characteristics of multi-source and heterogeneous. On the other hand, different security devices have different detection capabilities, and there are corresponding problems of missed and false positives.

Images