摘要
为了准确评估网络系统的安全状态,文章提出一种基于隐Markov模型(HMM)的网络安全态势感知方法。首先通过对系统多种安全检测数据融合,得到系统的网络结构、资产、威胁和脆弱性数据的规范化数据;接着对系统中的每个资产,将该资产受到的威胁和存在的脆弱性结合起来,分析影响该资产的安全事件序列,分别建立该资产保密性、完整性和可用性三个安全性分量的HMM,采用滑动窗口机制将观测序列分段训练,并采用带遗忘因子的更新算法得到HMM的各个参数;然后根据HMM和观测序列分析该资产安全状态,评估该资产的安全态势分量;最后综合分析网络中所有资产的安全态势分量,评估网络的安全态势分量,并根据应用背景评估网络的整体安全态势。实验分析表明,基于HMM的网络安全态势感知方法符合实际应用,评估结果准确有效。
To accurately evaluate security situation states,this paper proposes an approach to network security situation awareness（NSSA） based on Hidden Markov Model（HMM）.It gains standardized data of network structure information,assets,threats and vulnerabilities via fusing variety system security data collected by multi-sensors.For every asset,this paper associates its suffered threats with its vulnerabilities to analyze the sequence of its security incidents,establishes HMMs to analyze security situation factors of confidentiality,integrity and availability.Using sliding window mechanism it trains segmented sequence of security incidents and it gains the parameters of HMM＇s through update algorithm with forgetting factor.According to the HMMs and security incidents sequence it evaluates security situation factors of one asset＇s and entire network.Depending on the application background it evaluates security situation states of different network system.The investigation of evaluation to a specific network indicates that the approach is suitable for actual network environment and the evaluation result is precise and efficient.
出处
《信息网络安全》
2011年第10期47-51,共5页
Netinfo Security
基金
国家高技术研究发展(863)计划(2006AA01Z449)
第42届中国博士后科学基金资助项目(20070420738)
