基于日志审计与性能修正算法的网络安全态势评估模型  

A Network Security Situational Awareness Model Based on Log Audit and Performance Correction

作　　者：韦勇[1,2] 连一峰[2] 

机构地区：[1]中国科学技术大学电子工程与信息科学系,合肥230027 [2]中国科学院软件研究所信息安全国家重点实验室,北京100190

出　　处：《计算机学报》2009年第4期763-772,共10页Chinese Journal of Computers

基　　金：国家"八六三"高技术研究发展计划项目基金(2006AA01Z437;2007AA01Z475;2006AA01Z412;2006AA01Z433)资助~~

摘　　要：文章分析和比较了目前的安全态势评估方法,提出了一种基于日志审计与性能修正算法的网络安全态势评估模型.首先利用日志审计评估节点理论安全威胁,并通过性能修正算法计算节点安全态势.然后利用节点服务信息计算网络安全态势,并且采用多种预测模型对网络安全态势进行预测,绘制安全态势曲线图.最后构建了一个网络实例,使用网络仿真软件对文中提出的态势评估模型和算法进行了验证.实验证明该方法切实有效,比传统方法更准确地反映了网络的安全态势和发展趋势.This paper analyzes and compares the existing situational awareness methods and proposes a network security situational awareness model based on log audit and performance correction algorithm. First, nodes theoretic security threat is got by log audit and the value of nodes security situation is computed by performance correction algorithm. Then the value of network security situation is computed using service information, the future threat is predicted by several prediction models, and the Security Situational Graph （SSG） is drawn. Finally an example is given to validate the network security situational awareness model and algorithm by simulation software. The example proves that the model is more effective and accurate to reflect the network security situational and its trends than traditional methods.

关 键 词：安全态势评估 日志审计 性能修正 安全态势曲线图 预测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]