【摘要】 基于IDS(intrusion detection system)海量报警信息和网络系统的组织结构,提出了采用自下而上、先局部后整体评估策略的层次化安全威胁态势评估模型。该方法采用D-S证据推理理论,推理服务、主机和整个网络系统的威胁级别,进而评估分析安全威胁态势。实验结果证明该方法能够定性地评估服务、主机和网络系统3个层次的安全态势,给系统管理员提供直观的安全态势分析结果。更多还原

【Abstract】 Evaluating security threat status is very important in network security management and analysis.Based on the great number of IDS alarm information and the structure of the network,a hierarchical security threat evaluation model adopting an evaluation policy from bot- tom to top and from local to global is presented.D-S evidence inference theory is employed to inference the threat of services,hosts and local networks,and the security threat status is then evaluated.The experimental results show that this model can qualitatively evaluate the security situation in three levels:service,host and local area network system,and it provides system administrators with system intuitive security situa- tion analysis results,so that system administrators are freed from tedious analysis tasks based on the alarm datasets.更多还原