论文部分内容阅读
在网络安全态势评估方法中,基于隐Markov模型的评估方法能较准确的反映网络安全状态的变化。但模型建立过程中,观测序列与转移矩阵难以科学地赋值,直接影响模型的准确性和有效性。针对上述挑战,本文提出了连续状态隐Markov模型的网络安全态势评估方法,首先,将安全状态空间划分为若干个有序状态,新获得的报警信息最优化的匹配已划分的有序状态作为观测序列;其次,基于划分的有序状态,将网络安全下一时间间隔可能处于的连续状态作为状态空间建立状态转移矩阵,从而有效降低转移矩阵维度,减少计算量的同时也更加突出地反映了网络的状态变化。最后,通过仿真实验分析,本文提出的模型建立方法更加合理地反映网络安全态势变化。
In the assessment method of network security situation, the evaluation method based on hidden Markov model can reflect the change of network security state more accurately. However, it is difficult to assign the observation sequence and the transfer matrix scientifically in the process of model establishment, which has a direct impact on the accuracy and validity of the model. In order to solve the above challenges, this paper presents a method for evaluating the network security situation based on the continuous state hidden Markov model. First, the security state space is divided into several ordered states. The newly obtained alarm information is optimized to match the divided ordered states as observations Secondly, based on the ordered state of the partition, the continuous state that the network security can be in the next time interval is used as the state space to establish the state transition matrix, so as to effectively reduce the dimension of the transition matrix and reduce the calculation volume, moreover, the network The state changes. Finally, through the simulation analysis, the proposed model establishment method reflects the change of network security situation more reasonably.