基于多源融合的网络安全态势感知模型  

Network security situation awareness model based on multi-source fusion

作　　者：刘效武[1] 王慧强[2] 禹继国[1] 曹宝香[1] 

机构地区：[1]曲阜师范大学计算机科学学院,山东日照276826 [2]哈尔滨工程大学计算机科学与技术学院,黑龙江哈尔滨150001

出　　处：《解放军理工大学学报（自然科学版）》2012年第4期403-407,共5页Journal of PLA University of Science and Technology(Natural Science Edition)

基　　金：国家863计划资助项目(2007AA01Z401);国家自然科学基金重大研究计划资助项目(90718003);山东省高等学校科技计划资助项目(J11LG09)

摘　　要：为解决多阶段网络安全态势感知的多源融合与态势评估问题,建立了基于多源融合的网络安全态势感知模型。以模型为指导,利用粒子群算法实现D-S证据融合中的权值寻优,降低融合的不确定性。结合对威胁因子和威胁等级函数关系的推演,提出了面向攻击轨迹的层次化态势评估方法,实现攻击阶段、攻击轨迹和网络3个层次的威胁评估。仿真实验表明,提出的模型和方法是有效的和准确的,能够感知网络安全态势动态演化情况,为监控和管理网络提供了新的方法和手段。Firstly, a network security situation awareness model based on multi-source fusion was presented in which the multisource fusion, attack track reconstruction and situation evaluation were considered. Under the instruction of the model, the optimized weights of the D-S evidence fusion were searched using particle swarm optimization in order to reduce the uncertainty in the procedure of fusion. Then, a hierarchy attack track oriented situation awareness method was proposed in combination with the reasoning of the function relation between the threat gene and the threat level. This method was able to accomplish the threat evaluation of the attack step, the attack track and the network. The simulation experiments show that the presented model and methods are effective and accurate and have the aware ness of the dynamic evolvement of the network system, which provides the administrators new method to monitor and administrate their networks.

关 键 词：多源融合 网络安全态势感知 威胁评估 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]