一种基于粗糙集理论的网络安全态势感知方法  

A Method of Network Security Situation Awareness Based on Rough Set Theory

作　　者：梁颖[1] 王慧强[1] 赖积保 

机构地区：[1]哈尔滨工程大学计算机科学与技术学院,哈尔滨150001

出　　处：《计算机科学》2007年第8期95-97,147,共4页Computer Science

基　　金：高等学校博士学科点专项科研基金项目(20050217007);国防预研重点资助项目(413150702);武备预研基金资助项目51416060104CB0101)

摘　　要：网络安全态势感知是目前网络安全领域研究的一个热点问题。本文提出利用粗糙集理论进行网络安全态势感知,该方法把网络攻击行为作为网络安全要素,定量分析了各安全要素或安全要素组合对网络安全的威胁程度,最终建立了具有攻击行为、网络服务和安全态势3个层次的网络安全态势感知模型,并通过仿真实验生成了明确的网络安全态势图。采用粗糙集理论使得系统能够高效处理海量网络安全状态数据,生成易理解的攻击检测规则,清楚直观地反映攻击行为对网络整体安全状况的影响。Network security situation awareness is a hot research field in the network security domain. A method of network security situation awareness based on rough set theory is first used, in which network attack is regarded as the network security factor, and the threat degrees of each security factor or combination of them on network security are analyzed quantitatively, finally network security situation awareness model with three layers--attacks, network services and security situation is established and definite network security situation graph is created by the simulation experiment. The use of RST makes the network security situation awareness system be able to deal with large volumes of network data effectively, generate explainable attack-detectlon rules, then the influence of network attack on the whole network security can be reflected clearly and intuitively.

关 键 词：网络安全 态势感知 粗糙集理论 网络安全要素 

分 类 号：TP18[自动化与计算机技术—控制理论与控制工程]