Quantitative threat situational assessment method for higher secure attribute value device

Lei HAN; Jiqiang LIU; Jian WANG; Bo SHI; Xudong HE

doi:10.11959/j.issn.2096-109x.2020070

您当前的位置：

首页 >

文章列表页 >

Quantitative threat situational assessment method for higher secure attribute value device

Papers | 更新时间：2024-06-03

- Quantitative threat situational assessment method for higher secure attribute value device
- Chinese Journal of Network and Information Security Vol. 6, Issue 5, Pages: 54-66(2020)
- 作者机构：
  
  1. 北京计算机技术及应用研究所，北京 100854
  2. 信息保障技术重点实验室，北京 100072
  3. 北京交通大学智能交通数据安全与隐私保护技术北京市重点实验室，北京 100044
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020070
  CLC： TP393
- Online First：2020-10，
  
  Published：15 October 2020
- 稿件说明：
移动端阅览
Lei HAN, Jiqiang LIU, Jian WANG, et al. Quantitative threat situational assessment method for higher secure attribute value device[J]. Chinese Journal of Network and Information Security, 2020, 6(5): 54-66.
DOI：

Lei HAN, Jiqiang LIU, Jian WANG, et al. Quantitative threat situational assessment method for higher secure attribute value device[J]. Chinese Journal of Network and Information Security, 2020, 6(5): 54-66. DOI： 10.11959/j.issn.2096-109x.2020070.

摘要

传统的网络安全态势量化评估方法主要面向宏观网络安全态势，未针对安全价值较高的网络设备，给出了高安全属性价值设备的定义，设计了针对设备的威胁态势量化评估框架和评估指标，根据评估框架和指标提出了高安全属性价值设备威胁态势量化评估方法。对具体网络中实际设备的评估结果表明，该方法能够准确、有效地量化评估高安全属性价值设备的威胁态势。

Abstract

Traditional network security situational assessment is mainly for the macro network security situation， not for the specific equipment

especially for the key network device.A conception about the higher secure attribute value device was introduced

based on which a threat situational assessment research framework was presented and assessment indexes were discussed.A quantitative threat situational assessment method for higher secure attribute value device was proposed based on assessment research framework and assessment indexes.The experiment resultsshow that the proposed method can assess device threat situation accurately and effectively.Meanwhile

the method is more general and objective than traditional methods.

关键词

Keywords

references

龚正虎 , 卓莹 . 网络态势感知研究 [J ] . 软件学报 , 2010 , 21 ( 7 ): 1605 - 1619 .

GONG Z H , ZHUO Y . Research on cyberspace situational aware-ness [J ] . Journal of Software , 2010 , 21 ( 7 ): 1605 - 1619 .

CYRIL O . Understanding cyber situation awareness [J ] . International Journal on Cyber Situational Awareness , 2016 , 1 ( 1 ): 11 - 30 .

BLASCH E , PLANO S . JDL level 5 issues supporting situational assessment reasoning [C ] // Proc of the Signal Processing,Sensor Fusion,and Target Recognition XI (SPIE) . 2002 : 270 - 279 .

ENDSLEY M , . Situation awareness global assessment technique (SAGAT) [C ] // Proc of the IEEE'88 National Aerospace and Electronics Conf . 1988 : 789 - 795 .

AGGARWAL P , GONZALEZ C , DUTT V . Cyber-security:role of seception in cyber-attack detection [C ] // International Conference on Applied Human Factors and Ergonomics . 2016 : 85 - 96

SUN X , DAI J , LIU P , et al . Towards probabilistic identification of zero-day attack paths [J ] . Communications and Network Security , 2017 : 64 - 72 .

ZHANG H , YAO D , RAMAKRISHNAN N , et al . Causality reasoning about network events for detecting stealthy malware activities [J ] . Computers ＆ Security , 2016 , 58 ( C ): 180 - 198 .

SHAO P , LU J , WONG R K , et al . A transparent learning approach for attack prediction based on user behavior analysis [C ] // International Conference on Information and Communications Security . 2016 : 159 - 172 .

刘效武 , 王慧强 , 吕宏武 , 等 . 网络安全态势认知融合感控模型 [J ] . 软件学报 , 2016 , 27 ( 8 ): 2099 - 2114 .

LIU X W , WANG H Q , LYU H W , et al . Fusion-based cognitive awareness-control model for network security situation [J ] . Journal of Software , 2016 , 27 ( 8 ): 2099 - 2114 .

文志诚 , 陈志刚 , 唐军 . 基于信息融合的网络安全态势量化评估方法 [J ] . 北京航空航天大学学报 , 2016 , 42 ( 8 ): 1593 - 1602 .

WEN Z C , CHEN Z Q , TANG J . Assessing network security situa-tion quantitatively based on information fusion [J ] . Journal of Bei-jing University of Aeronautics and Astronautics , 2016 , 42 ( 8 ): 1593 - 1602 .

赵淦森 , 吴杰超 , 陈梓豪 , 等 . 网络空间安全态势感知研究 [J ] . 网络与信息安全学报 , 2016 , 2 ( 10 ): 29 - 35 .

ZHAO G S , WU J C , CHEN Z H , et al . Research on security situa-tion awareness in cyberspace [J ] . Journal of Network and Informa-tion Security , 2016 , 2 ( 10 ): 29 - 12 .

朱承 , 缪嘉嘉 , 毛捍东 . 面向行为的内网空间安全态势建模与分析 [J ] . 网络与信息安全学报 , 2016 , 2 ( 8 ): 17 - 22 .

ZHU C , MIU J J , MAO H D . Behavior-oriented intranet space se-curity situation modeling and analysis [J ] . Journal of Network and Information Security , 2016 , 2 ( 8 ): 17 - 22 .

ELIAS B H , MARTIN H , MOURAD D , et al . Big data sanitization and cyber situational awareness:a network telescope perspective [J ] . IEEE Transactions on Big Data , 2017 , 99 : 1 - 8 .

MIN D , LEI F F , ZHENG G N , et al . DeepLog:anomaly detection and diagnosis from system logs through deep learning [C ] // ACM Sigsac Conference(CCS’17) . 2017 : 1285 - 1298 .

寇广 , 王硕 , 张达 . 基于深度堆栈编码器和反向传播算法的网络安全态势要素识别 [J ] . 电子与信息学报 , 2019 , 41 ( 9 ): 2187 - 2193 .

KOU G , WANG S , ZHANG D . Recognition of network security situation elements based on depth stack encoder and back propaga-tion algorithm [J ] . Journal of Electronics ＆ Information Technology , 2019 , 41 ( 9 ): 2187 - 2193 .

程家根 , 祁正华 , 陈天赋 . 基于 RBF 神经网络的网络安全态势感知 [J ] . 南京邮电大学学报（自然科学版） , 2019 , 39 ( 4 ): 88 - 95 .

CHENG J G , QI Z H , CHEN T F . Network security situation awareness based on RBF neural networks [J ] . Journal of Najing University of Posts an Telecommunications(Natural Science Edition) , 2019 , 39 ( 4 ): 88 - 95 .

张勇 , 谭小彬 , 崔孝林 , 等 . 基于 Markov 博弈模型的网络安全态势感知方法 [J ] . 软件学报 , 2011 , 22 ( 3 ): 495 - 508 .

ZHANG Y , TAN X B , CUI X L , et al . Network security situation awareness approach based on Markov game model [J ] . Journal of Software , 2011 , 22 ( 3 ): 495 - 508 .

席荣荣 , 云晓春 , 张永铮 . 一种改进的网络安全态势量化评估方法 [J ] . 计算机学报 , 2015 , 38 ( 4 ): 749 - 758 .

XI R R , YUN C X , ZHANG Y Z . An improved quantitative evalua-tion method for network security [J ] . Chinese Journal of Computers , 2015 , 38 ( 4 ): 749 - 758 .

杨豪璞 , 邱辉 , 王坤 . 面向多步攻击的网络安全态势评估方法 [J ] . 通信学报 , 2017 , 38 ( 1 ): 187 - 198 .

YANG H P , QIU H , WANG K . Network security situation evalua-tion method for multi-step attack [J ] . Journal on Communication , 2017 , 38 ( 1 ): 187 - 198 .

杨君刚 , 梁礼 , 刘故箐 , 等 . 在线监测的路由器安全威胁态势量化评估方法 [J ] . 通信学报 , 2013 , 34 ( 11 ): 59 - 70 .

YANG J G , LING L , LIU G J , et al . Method for router online secu-rity risk assessment quantification [J ] . Journal on Communications , 2013 , 34 ( 11 ): 59 - 70 .

YU B L , ALI A K , SELVAKUMAR M , et al . An adaptive assessment and prediction mechanism in network security situation awareness [J ] . Journal of Computer Sciences , 2017 , 13 ( 5 ): 114 - 129 .

CRISTINA A J . Wide-area situational awareness for critical infrastructure protection [J ] . IEEE Computer , 2013 , 46 ( 4 ): 30 - 37 .

CRISTINA A , SHERALI Z . Critical infrastructure protection:requirements and challenges for the 21st century [J ] . International Journal of Critical Infrastructure Protection , 2015 , 8 : 53 - 56 .

CEEMAN V , ANURAG S , SAMAN Z . CPIndex:cyber-physical vulnerability assessment for power-grid Infrastructures [J ] . IEEE Transactions on Smart Grid , 2017 , 6 ( 2 ): 566 - 575 .

国家信息中心 . GB/T 20984-2007 信息安全技术信息安全风险评估规范 [S ] . 北京:中国标准出版社 , 2007 .

Nation Informatics Centre . GB/T 20984-2007 Information security technology-Risk assessment specification for information securi-ty [S ] . Beijing:Standards Press of China , 2007 .

CVSS-Common Vulnerability Scoring System [EB ] .

韦勇 , 连一峰 . 基于日志审计与性能修正算法的网络安全态势评估模型 [J ] . 计算机学报 , 2009 , 32 ( 4 ): 763 - 772 .

WEI Y , LIAN Y F . A network security situational awareness model based on log audit and performance correction [J ] . Chinese Journal of Computers , 2009 , 32 ( 4 ): 763 - 772 .

Snort-the open source network intrusion detection system [EB ] .

Nmap-free security scanner for network [EB ] .

Netwox-a toolbox for network [EB ] .

Kali linux-a Debian-derived linux distribution designed for digital forensics and penetration testing [EB ] .

Nmon-the linux system performance tools [EB ] .

Smokeping-a toolbox for tracking of your network latency [EB ] .

Views

349

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Survey of optical-based physical domain adversarial attacks and defense

Classified risk assessment method of Android application based on multi-factor clustering selection

Research on structure and defense of adversarial example in deep learning

Survey on research of mini-drones security

Related Author

CHEN Jinyin

ZHAO Xiaoming

ZHENG Haibin

GUO Haifeng

Fan CHAO

Zhi YANG

Xuehui DU

Bing HAN

Related Institution

Institute of Cyberspace Security, Zhejiang University of Technology

College of Information Engineering, Zhejiang University of Technology

College of Computer Science and Technology,Harbin Engineering University

College of Computer Science and Engineering,Shandong University of Science and Technology

⁰