基于CBR和描述逻辑的网络安全应急响应

发布时间：2018-10-11 17:39

【摘要】：网络安全应急响应是未来信息安全策略的重心。目前应急响应主要依靠应急响应团队和安全管理者,他们虽能够有效处理部分安全事件,但不能给出在具体环境下合理、快速、有效地处理安全事件的方法。针对该问题,提出了智能化的基于案例推理和描述逻辑的网络安全应急响应方法,用以实现对具体安全事件的自动处理。首先用描述逻辑刻画网络安全应急响应领域知识,然后设计了基于细化算子和细化图的相似度匹配算法,给出了基于案例的推理(Case based reasoning,CBR)在应急响应中的具体实现过程,最后用具体实例检验了提出的方法。结果表明该方法具有清晰语义、自动分类概念和良好推理能力等特性,能够从过去的安全事件中获得目前所遇到的安全事件的解决方案,并能够给出具体环境下安全事件的处理方法。
[Abstract]:Network security emergency response is the focus of information security strategy in the future. At present, emergency response mainly depends on emergency response team and safety manager. Although they can deal with some security incidents effectively, they can not give a reasonable, fast and effective method to deal with security incidents in specific environment. To solve this problem, an intelligent network security emergency response method based on case-based reasoning and description logic is proposed to realize the automatic processing of specific security events. Firstly, the domain knowledge of network security emergency response is described by description logic, then the similarity matching algorithm based on thinning operator and thinning graph is designed, and the concrete implementation process of CBR (Case based reasoning,CBR in emergency response is given. Finally, a concrete example is used to test the proposed method. The results show that the method has the characteristics of clear semantics, automatic classification concept and good reasoning ability, and can obtain the solution of the current security event from the past security events. And it can give the method of dealing with the security event in the specific environment.
【作者单位】：桂林电子科技大学广西可信软件重点实验室;
【基金】：国家自然科学基金(60963010,60903079,61262030,61363030,61100025) 广西自然科学基金(2012GXNSFBA053169)资助
【分类号】：TP393.08

【共引文献】