Network security threat situation evaluation based on spread analysis
Dapeng Man · Journal of Jilin University · 2012
Most situation evaluation methods lack the consideration for authorization and dependency relationship,unable to reflect indirect threats,so the assessment results guide dynamic defense poorly.Regarding these problems,an evaluation method was proposed,which takes threat spread analysis as its basis,and attack intention guess as its extension.First,the direct and indirect threats were evaluated;the direct threats originate from attacks,and the indirect threats were caused by the spread of direct threats along the dependency relationships.Then,the nonlinear overlapping effects under multiple concurrent attacks were discussed.Finally,the covering and clustering method was used to guess attack intensions.Experiment shows that the proposed method can reveal security situation more thoroughly and accurately,and can guide dynamic defense preferably.