关键词: 计算机应用, 网络安全, 威胁态势评估, 扩散分析, 攻击意图

Abstract:

Most situation evaluation methods lack the consideration for authorization and dependency relationship, unable to reflect indirect threats, so the assessment results guide dynamic defense poorly. Regarding these problems, an evaluation method was proposed, which takes threat spread analysis as its basis, and attack intention guess as its extension. First, the direct and indirect threats were evaluated; the direct threats originate from attacks, and the indirect threats were caused by the spread of direct threats along the dependency relationships. Then, the nonlinear overlapping effects under multiple concurrent attacks were discussed. Finally, the covering and clustering method was used to guess attack intensions. Experiment shows that the proposed method can reveal security situation more thoroughly and accurately, and can guide dynamic defense preferably.

Key words: computer application, network security, threat situation evaluation, spread analysis, attack intention