基于服务影响分析的网络安全态势定量感知方法

根据服务与配置间的资源依存关系,选取服务可用性与服务性能作为影响分析的重要指标,将网络服务运行状态抽象为安全态势基本要素.引入混合策略博弈刻画网络空间攻防双方的安全交互,建立网络攻防博弈形式化模型,并对模型中的策略空间、转移规则、效用函数等给出了明确定义.实验结果表明,该方法可定量刻画Nash均衡时博弈双方的收益情况,完成了网络安全态势的量化分析与自动生成,为安全管理员正确决策提供支持.采用服务影响分析方法屏蔽了系统配置及入侵行为细节,效率高、实时性强,有助于网络安全态势感知研究的发展.

Service impact analysis-based quantitative method for networksecurity situational awareness

According to dependencies between service and configuration,service availability and performance were selected as important indexes in impact analysis,and network service states were abstracted as basic security situational elements.Mixed strategy game was introduced to depict the security interaction between attackers and defenders in cyberspace,and formal modeling of network attack-defense game was constructed in which parameters,such as strategy space,transition rules and payoff functions were clearly defined.Experimental results show that payoffs of game players at Nash equilibrium can be quantified,further more quantitative analysis and automatic generation of network security situation is achieved,which will help security administrators make correct decisions.Adopting service impact analysis can shield details about system configurations and intrusions,and it is of high efficiency and real-time performance and helpful in development of network security situational awareness.