实时网络安全威胁态势感知  

Real-time situation awareness of network security threats

作　　者：吴朝雄[1] 王晓程[1] 王红艳[1] 石波[1] 

机构地区：[1]中国航天科工集团第二研究院706所,北京100854

出　　处：《计算机工程与设计》2015年第11期2953-2957,共5页Computer Engineering and Design

摘　　要：针对目前网络安全威胁态势分析实时性不足以及对复杂攻击感知敏感度不高的问题,设计实时感知系统结构模型,提出相应的感知方法和分析技术。通过粗集(rough set,RS),从已有的组合攻击样本数据集中提取复杂攻击规则,结合事件流处理技术(event stream processing,ESP),实现对安全事件流的在线动态分析检测,提高对复杂攻击的感知能力,提升网络安全威胁态势分析的实时性和客观性。实验验证了该方法的有效性和可行性。Aiming at the lack of real-time analysis of network security threats situation and sensitivity perceived of complex attack,the architecture of real-time perceived system was designed,and the method and analysis technology were proposed.Complex attack rules from the sample were got through rough set（RS）theory.Combining with event stream processing（ESP）technology,online dynamic analysis and detection of security event stream was completed.The sensitivity for complex attack was promoted,so that it can improve the timeliness and objectivity of situation analysis of network security threats.Experiments verifies the effectiveness and feasibility of the proposed method.

关 键 词：网络安全 威胁态势 RS ESP 实时 复杂攻击 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]