Joint decision-making method and system for security situation assessment and defense strategy

Abstract

The invention relates to a joint decision-making method and system for security situation assessment and defense strategy. The method comprises the following steps: grading power grid assets, threatsand vulnerabilities according to grading criteria; substituting grading of the power grid assets, threats and vulnerabilities into workflow, and modeling power grid attack-defense game state assessment workflow to form an attack-defense game diagram; and selecting key nodes of a current system from two aspects of vulnerability utilization and asset security situation assessment value based on theconstructed attack-defense game diagram to select a security defense strategy. The technical scheme provided by the invention has a good prediction effect for fluctuation state and controllable modeling complexity.

Description

technical field [0001] The invention relates to the field of joint decision-making of network security situation assessment and defense strategy, in particular to a method and system for joint decision-making of security situation assessment and defense strategy based on COBA-SemanticNet (object-oriented Symantec Net). Background technique [0002] The popularity of Internet applications, the rapid development of network technology, the diversity and openness of interconnection itself, and the expansion of user scale make industrial control systems vulnerable to various attacks. Traditional protection methods represented by intrusion detection technology and firewalls have been difficult to meet the security protection requirements of large-scale industrial control networks, and a new solution - network security situation assessment has emerged as the times require. The network security situation is based on situation understanding and situation assessment. Through the compr...

AI Technical Summary

Problems solved by technology

However, the modeling process of these algorithms is highly complex, and data processing takes a long time. They are mainly for attack modeling, and they do not comprehensively analyze the network security situation based on factors such as network assets and vulnerabilities, resulting in modeling effects. has limitations

On the other hand, in terms of network security defense, the formulation of current network security defense strategies is mainly based on experience and post-event adjustments, and there are problems of excessive defense and untimely defense. This is mainly due to the lack of accurate and efficient network security situation assessment technology, which cannot Develop targeted defense strategies based on the security situation of the network

Images