基于资源信息证据推理的网络安全态势评估研究

发布时间：2018-06-03 10:53

本文选题：网络安全态势评估 + 流量分类　；参考：《湖北工业大学》2017年硕士论文

【摘要】：随着计算机技术的迅猛发展与不断革新和攻击手段的日益复杂化,网络攻击事件的频发对国家、社会造成的危害越来越恶劣。传统的安全技术面临着难以满足对网络全方位保障和对其状况精确掌握等问题。网络安全态势评估能够从整体上掌握网络环境的安全威胁变化,帮助决策人员正确分析安全变化情况并制定有效的应对策略,这对提高网络监测能力、威胁处理能力和保护信息安全方面具有关键性作用。因此,网络安全态势评估具有重大的研究意义。本课题就网络安全态势评估展开了研究。对网络安全态势评估的国内外相关研究现状分析得知,传统的网络安全态势评估方法,大多分析攻击类的安全事件,往往忽视了正常行为峰值对网络造成的威胁。针对不足之处,研究了基于资源信息证据推理的网络安全态势评估方法,该方法综合考虑正常行为和攻击行为对网络环境带来的安全威胁,联合网络资源要素完成评估工作,使得最终结果更符合实际的安全风险状况。论文首先研究了网络流量分类方法。为了更准确反映网络安全态势,需要综合评估正常行为和攻击行为对网络带来的威胁,因此在网络安全态势评估之前,对网络流量进行快速准确地分类。本文将流量、CPU利用率、内存消耗指标作为特征属性,再结合改进的kNN算法进行流量分类。相较于传统的kNN算法降低了时间开销,合理地对样本集进行裁剪,减少了需要比较的训练样本数量,达到了提高分类效率的目的。另外,论文在网络流量分类的基础上探讨了运用证据推理规则进行网络安全态势评估的方法。该方法根据网络资源的相关性分析,选择各类网络资源指标的密度作为网络安全态势要素,然后应用证据推理规则进行逻辑推理,综合分析正常行为和攻击行为给网络安全带来的风险,进而得到整体网络安全态势的评估结果。最后通过量化计算得到网络安全态势值,为管理人员的决策提供参考。实验结果表明,通过基于改进kNN算法的网络流量分类方法能在有效提高时间效率的同时保障分类正确率。另外,基于资源信息证据推理的网络安全态势评估方法具有良好的评估效果,评估结果能够较为准确反映网络安全状况的变化,为网络安全态势评估研究提供了新方法。
[Abstract]:With the rapid development of computer technology and the constant innovation and the increasingly complicated attack means, the frequent occurrence of network attacks is causing more and more harm to the country and society. The traditional security technology is difficult to meet the problems of all aspects of network security and accurate grasp of its status. The network security situation assessment can master the change of the security threat in the network environment as a whole, help the decision makers to analyze the security changes correctly and formulate effective coping strategies, which can improve the ability of network monitoring. Threat handling capabilities and the protection of information security play a key role. Therefore, network security situation assessment has great significance. This topic has carried out the research on the network security situation assessment. By analyzing the current situation of network security situation assessment at home and abroad, we know that the traditional methods of network security situation assessment, most of which analyze the security events of attack type, often ignore the threat to the network caused by the peak of normal behavior. Aiming at the deficiency, this paper studies the network security situation assessment method based on resource information evidence reasoning. This method considers the security threat brought by normal behavior and attack behavior to the network environment, and combines the network resource elements to complete the evaluation work. Make the final result more in line with the actual security risk situation. Firstly, the classification method of network traffic is studied. In order to reflect the network security situation more accurately, it is necessary to comprehensively evaluate the threats to the network caused by normal behavior and attack behavior. Therefore, the network traffic is classified quickly and accurately before the network security situation assessment. In this paper, the utilization ratio of CPU and the index of memory consumption are taken as the characteristic attributes, and then the improved kNN algorithm is used to classify the traffic. Compared with the traditional kNN algorithm, the time cost is reduced, the sample set is clipped reasonably, the number of training samples that need to be compared is reduced, and the classification efficiency is improved. In addition, based on the classification of network traffic, the paper discusses the method of network security situation assessment using evidential reasoning rules. According to the correlation analysis of network resources, this method selects the density of all kinds of network resource indexes as the element of network security situation, and then applies the rule of evidence reasoning to logical reasoning. The risk of network security caused by normal behavior and attack behavior is analyzed synthetically, and the result of evaluating the overall network security situation is obtained. Finally, the network security situation value is obtained by quantitative calculation, which provides a reference for managers to make decisions. The experimental results show that the network traffic classification method based on improved kNN algorithm can effectively improve the time efficiency and ensure the classification accuracy. In addition, the network security situation assessment method based on resource information evidence reasoning has a good evaluation effect, and the evaluation results can accurately reflect the changes of the network security situation, which provides a new method for the research of network security situation assessment.
【学位授予单位】：湖北工业大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】