关键词: 网络安全态势评估, 主机安全态势, 链路安全态势, D-S证据理论

Abstract: Network security situation assessment is one of the hottest topics in the field of network security. After analyzing and comparing the existing network security situation assessment methods at home and abroad, it proposes a network security situation quantitative assessment model fusing multi-source data. Considering the affection that the hosts and links have on the network security situation, network security situation indicators are grouped into host security indicators and link safety indicators. The streamlined host security event set and link security event set are gotten by using the improved D-S evidence theory to fuse logging, alarm, and other probe data. Network security situation quantitative assessment is implemented by computing the host security situation and the link security situation based on the corresponding service information. An instance is given to validate the proposed network security situation assessment model by network simulation software. Experimental results show that the model can accurately achieve the network security situation quantitative evaluation, and the assessment results can objectively reflect the trend of network security situation.

Key words: network security situation evaluation, host security situation, link security situation, D-S evidence theory