###
DOI:
Journal of Software:2006.17(4):885-897

层次化网络安全威胁态势量化评估方法
陈秀真,郑庆华,管晓宏,林晨光
(西安交通大学,网络化系统与信息安全研究中心,制造系统工程国家重点实验室,陕西,西安,710049;西安交通大学,网络化系统与信息安全研究中心,制造系统工程国家重点实验室,陕西,西安,710049;清华大学,智能与网络化系统研究中心,北京,100084)
Quantitative Hierarchical Threat Evaluation Model for Network Security
CHEN Xiu-Zhen,ZHENG Qing-Hua,GUAN Xiao-Hong,LIN Chen-Gu
()
Abstract
Chart / table
Reference
Similar Articles
Article :Browse 6898   Download 5971
Received:June 09, 2004    Revised:July 11, 2005
> 中文摘要: 安全评估是贯穿信息系统生命周期的重要管理手段,是制定和调整安全策略的基础和前提.只有充分识别系统安全风险,才能有针对性地采取有效的安全防范措施.基于IDS(intrusion detection system)海量报警信息和网络性能指标,结合服务、主机本身的重要性及网络系统的组织结构,提出采用自下而上、先局部后整体评估策略的层次化安全威胁态势量化评估模型及其相应的计算方法.该方法在报警发生频率、报警严重性及其网络带宽耗用率的统计基础上,对服务、主机本身的重要性因子进行加权,计算服务、主机以及整个网络系统的威胁指数,进而评估分析安全威胁态势.实验表明,该系统减轻了管理员繁重的报警数据分析任务,能够提供服务、主机和网络系统3个层次的直观安全威胁态势,使其对系统的安全威胁状况有宏观的了解.而且,可以从安全态势曲线中发现安全规律,以便调整系统安全策略,更好地提高系统安全性能,为指导安全工程实践、设计相应安全风险评估和管理工具提供了有价值的模型和算法.
Abstract:Evaluating security threat status is very important in network security management and analysis. A quantitative hierarchical threat evaluation model is developed in this paper to evaluate security threat status of a computer network system and the computational method is developed based on the structure of the network and the importance of services and hosts. The evaluation policy from bottom to top and from local to global is adopted in this model. The threat indexes of services, hosts and local networks are calculated by weighting the importance of services and hosts based on attack frequency, severity and network bandwidth consumption, and the security threat status is then evaluated. The experiment results show that this model can provide the intuitive security threat status in three hierarchies: services, hosts and local networks so that system administrators are freed from tedious analysis tasks based on the alarm datasets to have overall security status of the entire system. It is also possible for them to find the security behaviors of the system, to adjust the security strategies and to enhance the performance on system security. This model is valuable for guiding the security engineering practice and developing the tool of security risk evaluation.
文章编号:     中图分类号:    文献标志码:
基金项目:Supported by the National Natural Science Foundation of China under Grant No.60243001 (国家自然科学基金); the National High-Tech Research and Development Plan of China under Grant No.2001AA140213 (国家高技术研究发展计划(863)); the National Outstanding Young Investigator of China under Grant No.6970025 (国家杰出青年基金) Supported by the National Natural Science Foundation of China under Grant No.60243001 (国家自然科学基金); the National High-Tech Research and Development Plan of China under Grant No.2001AA140213 (国家高技术研究发展计划(863)); the National Outstanding Young Investigator of China under Grant No.6970025 (国家杰出青年基金)
Foundation items:
Reference text:

陈秀真,郑庆华,管晓宏,林晨光.层次化网络安全威胁态势量化评估方法.软件学报,2006,17(4):885-897

CHEN Xiu-Zhen,ZHENG Qing-Hua,GUAN Xiao-Hong,LIN Chen-Gu.Quantitative Hierarchical Threat Evaluation Model for Network Security.Journal of Software,2006,17(4):885-897