网络安全态势量化评估模型研究

发布时间：2018-03-02 12:41

本文选题：网络安全　切入点：数据融合　出处：《合肥工业大学》2014年硕士论文　论文类型：学位论文

【摘要】：随着互联网技术的不断发展,网络安全问题也日益突出。防火墙、入侵检测等传统的网络安全技术尽管提供了一定程度的安全防范能力,但由于相互之间协调性等问题,传统的网络安全技术并不能有效的评估网络的整体安全状态,同时也还存在较高的误报率和漏报率问题；此外传统态势研究存在基于单源数据、评估因素不全面以及评估依赖安全传感器的告警信息的统计量化等问题。对此,本文提出了采用数据融合技术的网络安全态势量化研究,文本的主要工作如下：(1)在分析数据融合的基本理论和方法的基础上,针对D-S证据理论融合出现的悖论现象,提出了改进的融合方法。(2)研究态势评估的关键技术,分析了入侵检测技术以及脆弱性扫描技术在态势评估中的应用,并建立了相应的模型和实验验证。(3)在多源传感器检测的基础上提出了网络安全态势评估框架模型。首先采用数据融合技术将多个传感器的检测结果进行融合以判断发生攻击的可能性,然后综合网络中存在的脆弱性,判断攻击成功的可能性,最后综合威胁的危害性以及网络结点的资产价值,给出量化的网络安全态势。(4)通过实验对本文提出的网络安全态势量化框架模型的有效性进行了验证。实验表明,相对于传统的网络安全态势评估,本文提出的框架模型考虑因素更加全面,能够很好的评估当前的网络的安全状态。
[Abstract]:With the continuous development of Internet technology, network security issues are becoming increasingly prominent. Traditional network security technologies, such as firewalls, intrusion detection and so on, provide a certain degree of security prevention capability, but due to the coordination between each other, Traditional network security technology can not effectively evaluate the overall security status of the network, but also there are high false alarm rate and false alarm rate, in addition, the traditional situation research based on single source data, The evaluation factors are not comprehensive and the statistical quantification of alarm information depending on security sensor is evaluated. In this paper, the research of network security situation quantization based on data fusion technology is put forward. The main work of the text is as follows: (1) on the basis of analyzing the basic theories and methods of data fusion, and aiming at the paradox of D-S evidence theory fusion, an improved fusion method. The application of intrusion detection technology and vulnerability scanning technology in situation assessment is analyzed. The corresponding model and experimental verification are established. Based on the detection of multi-source sensors, the framework model of network security situation assessment is proposed. Firstly, the detection results of multiple sensors are fused to judge by data fusion technology. The possibility of an attack, Then synthesizing the vulnerability in the network, judging the possibility of successful attack, finally synthesizing the harm of the threat and the value of the assets of the network node, The effectiveness of the proposed framework is verified by experiments. The experimental results show that compared with the traditional network security situation assessment, the proposed model is more effective than the traditional network security situation assessment. The proposed framework model is more comprehensive and can evaluate the security status of the current network.
【学位授予单位】：合肥工业大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】