基于D-S证据理论的层次化网络安全威胁态势评估方法  

THREAT EVALUATION MODEL FOR HIERARCHICAL NETWORK SECURITY BASED ON D-S EVIDENCE THEORY

作　　者：龚琼瑶[1] 丁宏[1] 

机构地区：[1]杭州电子科技大学计算机学院,浙江杭州310018

出　　处：《计算机应用与软件》2008年第11期74-75,94,共3页Computer Applications and Software

基　　金：浙江省自然科学基金项目(Y104426);浙江省教育厅高校科研计划项目(20040457)

摘　　要：基于IDS(intrusion detection system)海量报警信息和网络系统的组织结构,提出了采用自下而上、先局部后整体评估策略的层次化安全威胁态势评估模型。该方法采用D-S证据推理理论,推理服务、主机和整个网络系统的威胁级别,进而评估分析安全威胁态势。实验结果证明该方法能够定性地评估服务、主机和网络系统3个层次的安全态势,给系统管理员提供直观的安全态势分析结果。Evaluating security threat status is very important in network security management and analysis. Based on the great number of IDS alarm information and the structure of the network, a hierarchical security threat evaluation model adopting an evaluation policy from bottom to top and from local to global is presented. D-S evidence inference theory is employed to inference the threat of services, hosts and local networks, and the security threat status is then evaluated. The experimental results show that this model can qualitatively evaluate the security situation in three levels：service, host and local area network system, and it provides system administrators with system intuitive security situation analysis results, so that system administrators are freed from tedious analysis tasks based on the alarm datasets.

关 键 词：D-S证据理论 态势评估 安全态势 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP393[自动化与计算机技术—计算机科学与技术]