【摘要】 网络安全态势感知(NSSA)是目前网络安全领域研究的一个热点问题。首次提出一种基于条件随机场的(CRFs)网络安全态势量化感知方法。该方法以入侵检测系统的报警信息作为网络安全态势感知的要素,结合主机的漏洞和状态,定义网络安全威胁度来更好地体现网络的风险,并对攻击进行分类,简化CRFs模型的输入,同时选择了有效的特征属性,通过DARPA 2000数据的仿真实验生成了明确的网络安全态势图,表明提出的方法能够很好地反映网络风险,量化网络安全态势。更多还原

【Abstract】 Network security situational awareness(NSSA)has been a hot research spot in the network security domain.A quantification method for NSSA based on conditional random fields(CRFs)was proposed.The data of network attacks from intrusion detection system(IDS),the hosts’vulnerabilities and the hosts’states were firstly combined as the network security factors.And then the network security threat degree was defined to quantify the risk of the whole network and classify the attacks.A diverse set of effective features were incorporated in CRFs Model.The experiments on the DARPA 2000 data set generate the explicit network security situational graph.It proves that the method introduced can represent network risk more accurate and offer a good quantification for the network security situation.更多还原