主机系统安全态势实时评估方法的研究  

Research on real-time evaluation method for host system security situation

作　　者：刘仁山[1] 孟祥宏[1] 

机构地区：[1]呼伦贝尔学院计算机科学与技术学院,内蒙古呼伦贝尔021008

出　　处：《河南理工大学学报（自然科学版）》2014年第3期344-348,共5页Journal of Henan Polytechnic University（Natural Science）

基　　金：内蒙古自然科学基金资助项目(2011BS0905);国家社会科学基金资助项目(11XTQ009);内蒙古高校科学研究项目(NJZC14309)

摘　　要：为了解决传统安全评估方法不能详细刻画安全态势变化以及安全指标确定不够科学、全面的问题,提出了基于隐马尔可夫模型(HMM)的主机系统安全态势实时评估方法,从攻击的可信度、严重度、资产值和敏感度方面分析影响攻击威胁度等因素,利用HMM模型计算主机系统处于不同安全状态的概率.通过实例表明,该方法能对IDS的报警信息进行科学响应,动态获取主机系统安全态势变化曲线,为管理员了解和防范主机系统安全风险提供指导,具有一定的科学性和实用性.In order to solve the problem that traditional security assessment methods cannot describe the securi- ty situation changes in detail and the security index determined is not scientific and comprehensive, a real-time host system security situation evaluation method based on HMM is proposed. From reliability, severity, asset value and susceptibility analyses for every kind of factor on the threat of attack, the method can calculate the probability of the host system at the different security conditions by using HMM model. Computational exam- ples show that the method can response alarm information of IDS scientifically, obtain dynamically the host system security situation change curve, and provide guidance for administrators to understand and prevent the host system security risk. It has a certain property for science and practicality.

关 键 词：主机系统安全 安全态势 可信度 威胁度 HMM模型 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]