Key Technology Analyzing And Model Building Of Network Security Situation System

Network security situation is a critical component in the whole security management platform. In addition to the traditional network security management technology, network security situation technology could keep a close survalliance and analysis of a general security situation. In implementing a mining of history data, future trend of security situation could also be forecasted and suggestion to supervisor be forwarded.Network security situation is a new techonology in security survalliance. Domestic researches are still in a start. This paper discuss key technologies like the composition of a network security situation system, its model and algorithms to realise these models, etc.This paper starts from introducing a three layers'model for network security situation evaluation, expetiate several vital concepts in network security situation, and tries to give a clear explanation about the content and mutual relationship among these concepts. Detail speaking, this paper focus on first layer situation elements obtaining and second layer situation comprehension. Network security situation value calculation is elabrated in the paper, and also network security threat evaluation and network security situation evaluation. These three concepts are also extended in content and their connection and differentiation are covered as well.Then this paper follow the order by the situation model, starting from layer one. FAHP based on Delphi is introduced to calculate weight value in situation value calculation. Then a extended model for network security calculation is shown.Following is a statistically analyzing algorithm for threat analysis.This algorithm transfers different Q value sorting by attacking types, make the administrator be aware of the general threat level of the past period . Detailed methods for calculate Q value are also given.As for situation evaluation,this paper tries to look at the problem from new angle. Intuitional fuzzy decision algorithm is introduced to evaluate the impact caused by recent round of attacks. In order to achieve this goal, network survivability is brought in to assess services,hosts and systems'current status.Conclusion is made and future work is depicted in the last chapter.