基于全信息熵的安全态势评估方法.docVIP

  基于全信息熵的安全态势评估方法 刘青芳，武斌** （北京邮电大学信息安全中心，北京 100876） 5 10 15 20 25 30 35 40 摘要：本文简述了网络安全态势评估的基本概念，构建了“属性—原子态势—评估指标—采 集指标”的多维、深层次网络安全评估指标集；提出了基于全信息熵的网络安全态势评估算 法，用语法信息解释原子态势发生的概率，语义信息代表原子态势的类型，语用信息是某个 原子态势的威胁程度，并建立了从原子态势、属性态势、主机态势及网络态势的层次化评估 流程；采用自信息熵的理论去计算原子态势发生的概率，利用加权求和的方法对各层态势值 进行计算；最后，利用真实的网络环境数据对提出的评估算法和流程进行了验证。 关键词：安全评估；指标；全信息；原子态势 中图分类号：TP301.4 The security situation assessment method based on comprehensive information entropy LIU Qingfang, WU Bing (Information Security Center, Beijing University of Posts and Telecommunication, Beijing 100876) Abstract: First，this paper introduced the basic concept of network security situation assessment, a multilayer and dimensionality network situation evaluation index set was constructed which includes attribute layer, atomic situation layer, evaluation index layer and index collection layer from top to bottom. Second，the network security situation assessment algorithm based on comprehensive information theory is proposed. Here syntactic information will be used to explain the occurring probability of atomic situation, semantic information is to express the implication of atomic situation and pragmatic information is to represent the threat level of atomic situation. A hierarchical assessment process which is made up of atomic situation, attribute situation, host situation and network situation is established. Then the theory of self-information entropy is adopted to compute the occurring probability of atomic situation. At last, on the basis of the proposed assessment method and process, the real network environment data is being tested. Keywords: security situation assessment; index; comprehensive information; atomic situation 0 引言 网络环境日益复杂，攻击用户及攻击手段的增加，使来自网络的威胁不断增长，网络安 全遭受重大挑战，为了进一步加强网络安全的保障力度，人们从各方面寻求解决方案，出现 很多安全相关的名词，如“安全态势”、“态势评估”等。 网 络 安 全 专 家 Bass[1] 提 出 了 网 络 安 全 态 势 感 知 (Network Security Situation Awareness,NSSA)研究，它借鉴了空中交通监管(Air Traffic Control，ATC )态势感知的成熟 技术和理论。网络态势是指由各种网络设备运行状况、网络行为以及用户行为等因素所构成 的整个网络当前状态和