一种改进的网络安全态势量化评估方法  

An Improved Quantitative Evaluation Method for Network Security

作　　者：席荣荣[1] 云晓春[1] 张永铮[1] 郝志宇[1] 

机构地区：[1]中国科学院信息工程研究所,北京100093

出　　处：《计算机学报》2015年第4期749-758,共10页Chinese Journal of Computers

基　　金：国家"八六三"高技术研究发展计划项目基金(2012AA012803;2013AA014703);国家科技支撑计划基金(2012BAH46B02);国家自然科学基金(61100188);中国科学院知识创新基金(XDA06030200)资助~~

摘　　要：在基于隐马尔可夫模型的网络安全态势评估中,观测序列的获取和状态转移矩阵的确立是影响评估准确性的关键.目前观测序列多以随机方式获取,不能有效表征网络的安全性;而状态转移矩阵往往依据经验给出,具有很强的主观性.该文提出改进方法:首先,基于警报的统计特性提出警报质量的概念,依据警报质量获取的观测序列,可改进数据源的有效性;其次,基于安全事件和防护措施的博弈过程,提出确定状态转移矩阵的方法,并结合攻击成功的概率对其进行修正,提高状态转移矩阵的有效性.对比实验证明,基于改进算法生成的风险值对网络安全态势的量化更加合理.Obtaining high-quality observation sequence and establishing correct state transition matrix are important to assess network security situation based on Hidden Markov Models. Currently observation sequence is obtained at random, it can＇t ensure the effectiveness of data source; and state transition matrix is established based on experience, it is subjective. An improved method is presented in this paper. Firstly, it obtains observation sequence based on quality of alert, which can improve the effectiveness of data source. Secondly, it determines state transition matrix based on the game of attack and defense, and adopts the successful probability of attack to amend it, which can improve the effectiveness of the matrix. The experiment demonstrates the improved method is more accurate, and can reflect the trend of network security more reasonably.

关 键 词：观测序列 状态转移矩阵 警报质量 博弈矩阵 攻击成功的概率 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]