基于条件随机场的网络安全态势量化感知方法术课稿.docxVIP

基于条件随机场的网络安全态势量化感知方法术基于条件随机场的网络安全态势量化感知方法术李建平1’2，王慧强1，卢爱平2，郝洪亮3，冯光升1(1．哈尔滨工程大学计算机科学与技术学院，黑龙江哈尔滨150001；2．大庆石油学院计算机与信息技术学院。黑龙江大庆163318；3．大庆油田有限责任公司测试技术服务分公司。黑龙江大庆163311)摘要：网络安全态势感知(NSSA)是目前网络安全领域研究的一个热点问题。首次提出一种基于条件随机场的(CRFs)网络安全态势量化感知方法。该方法以入侵检测系统的报警信息作为网络安全态势感知的要素，结合主机的漏洞和状态，定义网络安全威胁度来更好地体现网络的风险，并对攻击进行分类，简化CRFs模型的输入，同时选择了有效的特征属性，通过DARPA 2000数据的仿真实验生成了职确的网络安全态势图，表明提出的方法能够很好地反映网络风险，量化网络安全态势。关键词：网络安全态势感知；量化感知；条件随机场中图分类号：TP393．08 文献标识码：A 文章编号：1000-9787(2010)10-0083-04Quantification awareness method of network securitysituation DaSen 0n C0ndlnonal rannom tielnS···‘ 1 1 1●J● l 1 一l1 币LI Jian—pin91一，WANG Hui—qian91，LU Ai—pin92，HAO Hong·lian93，FENG Guang—shen91(1．College of Computer Science and Technology，Harbin Engineering University，Harbin 150001，China；2．School of Computer and Information Technology，Daqing Petroleum Institute，Daqing 163318，China；3．LoggingTesting services Company of Daqing Oilfield CO．LTD．，Daqing 163311，China)Abstract：Network security situational awareness(NSSA)has been a hot research·spot in the network securitydomain．A quantification method for NSSA based on conditional random fields(CRFs)Was proposed．The data ofnetwork attacks from intrusion detection system(IDS)．the hosts’vulnerabilities and the hosts’states were firstlycombined as the network security factors．And then the network security threat degree was defined to quantify therisk of the whole network and classify the attacks．A diverse set of effective features were incorporated in CRFsModel．卟e experiments on the DARPA 2000 data set generate the explicit network security situational graph．Itproves that the method introduced call represent network risk more accurate and offer a good quantification for thenetwork security situation．Key words：network security situational awareness(NSSA)；quantification awareness；conditional random fields0引言随着网络技术的广泛应用，其规模不断扩大和开放，网络也会受到各种安全威胁的影响，如，外部攻击者入侵、木马、DDoS、蠕虫、病毒、内部攻击等，而且，新型的攻击类型也不断涌现，如，Web代码注入、僵尸网络等。人们通常采用防火墙、入侵检测系统(IDS)，病毒检测等方法来保证网络系统的安全，但这些方法都只是对攻击行为采取局部的预防措施，网