CN110460472A - A kind of Situation Awareness method and system of weight quantization - Google Patents
A kind of Situation Awareness method and system of weight quantization Download PDFInfo
- Publication number
- CN110460472A CN110460472A CN201910757772.2A CN201910757772A CN110460472A CN 110460472 A CN110460472 A CN 110460472A CN 201910757772 A CN201910757772 A CN 201910757772A CN 110460472 A CN110460472 A CN 110460472A
- Authority
- CN
- China
- Prior art keywords
- data
- network
- situation
- single key
- information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/12—Discovery or management of network topologies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/147—Network analysis or design for predicting network behaviour
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
Abstract
The present invention provides a kind of Situation Awareness method and system of weight quantization, acquire the data in different information sources, the data flow of unified format is obtained by pre-processing, high frequency project team element is extracted from the data flow, generate high frequency correlation rule, it is sent into Situation Assessment and carries out project evaluation chain, by from the fusion of different evaluation systems, and Fuzzy Processing Data Elements, obtain individual equipment, the situation value of localized network, it is formed in conjunction with the framework of whole network, obtain the situation value of whole system, the situation value of different levels is imported neural network model to predict, finally visualize prediction result, sufficiently assessment whole system and each individual equipment, by each equipment, association is established in each layering, the element weighting of high frequency project team is handled, so as to scientifically be predicted following system, it is mentioned for user For valuable reference proposition.
Description
Technical field
This application involves the Situation Awareness method and systems of technical field of network security more particularly to a kind of weight quantization.
Background technique
Existing situational awareness techniques are understood using simple situation, so that it may obtain the security postures about whole system
Assessment result can not quantitatively provide the report of Situation Assessment, and it is even more impossible to the results based on Situation Assessment to carry out security postures
Prediction, utility value are very limited.
The Situation Assessment of weight quantization not only algorithmically sufficiently assesses whole system and each individual equipment, but also
It can be established and be associated with each equipment, each layering, high frequency project team element is added based on the situation value provided
Power processing provides valuable reference proposition so as to scientifically be predicted following system for user.This is this hair
Bright technical problems to be solved.
Summary of the invention
The purpose of the present invention is to provide a kind of Situation Awareness method and systems of weight quantization, acquire different information sources
Data, obtain the data flow of unified format by pre-processing, high frequency project team element extracted from the data flow, generate high frequency
Correlation rule is sent into Situation Assessment and carries out project evaluation chain, by wanting from the fusion of different evaluation systems and Fuzzy Processing data
Element obtains the situation value of individual equipment, localized network, forms in conjunction with the framework of whole network, obtains the situation value of whole system,
The situation value of different levels is imported neural network model to predict, finally visualizes prediction result.
In a first aspect, the application provides a kind of Situation Awareness method of weight quantization, which comprises
Acquire the sensor of separate sources, the running state data of information platform, detecting devices；
After receiving acquisition data, clear data in redundancy according to the type in source be system by Data Format Transform
One format is divided into corresponding field, is merged into data flow；
Element is extracted from the data flow after merging, finds the behavior act for including in element, access object, source person
Location, instantaneous flow size information, therefrom excavate high frequency project team, high frequency association generated according to the corresponding information of high frequency project team
Rule increases its corresponding weight, forms the tree-shaped structure of frequent mode；
According to the tree-shaped structure of the frequent mode, the adjacent similar assets situation information in address, queried access object are inquired
The assets situation information and query flows speed of affiliated same layer, the similar assets situation information of flow total amount；
Judge that single key equipment with the presence or absence of the identical security breaches of close assets adjacent with address, judges single crucial
The concurrent thread of equipment, bandwidth, network topology, access frequency whether there is alarm identical with affiliated same layer assets, judge list
Whether the influx growth rate of a key equipment, different agreement data packet distribution proportion, different size data packet distribution proportion are deposited
In variation identical with flow speed, flow total amount similar property, the security postures value of single key equipment is calculated；
By several neighbouring single key equipments, or according to several the single key equipments for having service interaction, group
At localized network, by the corresponding security breaches of each key equipment, concurrent thread, bandwidth, the network topology, visit in localized network
Ask frequency, influx growth rate, different agreement data packet distribution proportion and different size data packet distribution proportion, it is excellent according to business
First grade introduces the security postures value that Fuzzy Processing calculates localized network；
According to the topological relation of multiple localized networks, Fuzzy Processing calculates the security postures value of whole network；
The security postures value of single key equipment, localized network and whole network is imported into neural network model respectively, is led to
Neural network model deduction is crossed, obtains prediction of the following a period of time about attacker source and firing area；
By the security postures value of single key equipment, localized network and whole network, attacker source and firing area
Prediction result is visualized.
With reference to first aspect, in a first possible implementation of that first aspect, the data flow after merging mentions
Take element, comprising: according to the assessment models of previous historical data, correlation rule and index storehouse, from the respective field of data flow
Extract element information.
With reference to first aspect, in a second possible implementation of that first aspect, it is described clear data in redundancy letter
Data Format Transform is unified format according to the type in source by breath, is based at Map Reduce Distributed Parallel Computing
Reason.
With reference to first aspect, in first aspect in the third possible implementation, the Fuzzy Processing calculating is to be based on
The method that D-S theory is combined with fuzzy set calculates the probability that attack is supported.
Second aspect, the application provide a kind of Situation Awareness System of weight quantization, the system comprises:
Acquisition unit, for acquiring the sensor of separate sources, the running state data of information platform, detecting devices；
Pretreatment unit, after receiving acquisition data, clear data in redundancy will according to the type in source
Data Format Transform is unified format, is divided into corresponding field, is merged into data flow；
Situation understands unit, for extracting element from the data flow after merging, finds the behavior act for including in element, visits
Ask object, source person address, instantaneous flow size information, therefrom excavate high frequency project team, according to high frequency, project team is corresponding
Information generates high frequency correlation rule, increases its corresponding weight, forms the tree-shaped structure of frequent mode；
Situation Assessment unit, for inquiring the adjacent similar assets situation in address according to the tree-shaped structure of the frequent mode
Information, the assets situation information and query flows speed of the affiliated same layer of queried access object, the similar assets state of flow total amount
Gesture information；Judge that single key equipment with the presence or absence of the identical security breaches of close assets adjacent with address, judges single crucial
The concurrent thread of equipment, bandwidth, network topology, access frequency whether there is alarm identical with affiliated same layer assets, judge list
Whether the influx growth rate of a key equipment, different agreement data packet distribution proportion, different size data packet distribution proportion are deposited
In variation identical with flow speed, flow total amount similar property, the security postures value of single key equipment is calculated；
By several neighbouring single key equipments, or according to several the single key equipments for having service interaction, group
At localized network, by the corresponding security breaches of each key equipment, concurrent thread, bandwidth, the network topology, visit in localized network
Ask frequency, influx growth rate, different agreement data packet distribution proportion and different size data packet distribution proportion, it is excellent according to business
First grade introduces the security postures value that Fuzzy Processing calculates localized network；
According to the topological relation of multiple localized networks, Fuzzy Processing calculates the security postures value of whole network；
Tendency Prediction unit, for respectively leading the security postures value of single key equipment, localized network and whole network
Enter neural network model, deduced by neural network model, obtains following a period of time about attacker source and firing area
Prediction；
Situation display unit, for by the security postures value of single key equipment, localized network and whole network, attacker
The prediction result of source and firing area is visualized.
In conjunction with second aspect, in second aspect in the first possible implementation, the situation understands unit from merging
Data flow afterwards extracts element, comprising: according to the assessment models of previous historical data, correlation rule and index storehouse, from data flow
Respective field in extract element information.
In conjunction with second aspect, in second of second aspect possible implementation, the pretreatment unit clears data
In redundancy according to the type in source be unified format by Data Format Transform, be distributed based on Map Reduce
Parallel computation processing.
In conjunction with second aspect, in second aspect in the third possible implementation, the fuzzy place of the Situation Assessment unit
It is the method combined based on D-S theory with fuzzy set that reason, which calculates, calculates the probability that attack is supported.
The present invention provides a kind of Situation Awareness method and system of weight quantization, acquires the data in different information sources, leads to
It crosses pretreatment and obtains the data flow of unified format, high frequency project team element is extracted from the data flow, generates high frequency correlation rule,
Be sent into Situation Assessment carry out project evaluation chain, by from the fusion of different evaluation systems and Fuzzy Processing Data Elements, obtain list
A equipment, the situation value of localized network form in conjunction with the framework of whole network, the situation value of whole system are obtained, by different layers
Secondary situation value imports neural network model and is predicted, finally visualizes prediction result, sufficiently assess whole system with
And each individual equipment, association is established into each equipment, each layering, so as to carry out science to following system
Ground prediction, provides valuable reference proposition for user.
Detailed description of the invention
It to describe the technical solutions in the embodiments of the present invention more clearly, below will be to needed in the embodiment
Attached drawing is briefly described, it should be apparent that, for those of ordinary skills, before not making the creative labor
It puts, is also possible to obtain other drawings based on these drawings.
Fig. 1 is the flow chart of the Situation Awareness method of weight quantization of the present invention；
Fig. 2 is the architecture diagram of the Situation Awareness System of weight quantization of the present invention.
Specific embodiment
The preferred embodiment of the present invention is described in detail with reference to the accompanying drawing, so that advantages and features of the invention energy
It is easier to be readily appreciated by one skilled in the art, so as to make a clearer definition of the protection scope of the present invention.
Fig. 1 is the flow chart of the Situation Awareness method of weight quantization provided by the present application, which comprises
Acquire the sensor of separate sources, the running state data of information platform, detecting devices；
After receiving acquisition data, clear data in redundancy according to the type in source be system by Data Format Transform
One format is divided into corresponding field, is merged into data flow；
Element is extracted from the data flow after merging, finds the behavior act for including in element, access object, source person
Location, instantaneous flow size information, therefrom excavate high frequency project team, high frequency association generated according to the corresponding information of high frequency project team
Rule increases its corresponding weight, forms the tree-shaped structure of frequent mode；
According to the tree-shaped structure of the frequent mode, the adjacent similar assets situation information in address, queried access object are inquired
The assets situation information and query flows speed of affiliated same layer, the similar assets situation information of flow total amount；
Judge that single key equipment with the presence or absence of the identical security breaches of close assets adjacent with address, judges single crucial
The concurrent thread of equipment, bandwidth, network topology, access frequency whether there is alarm identical with affiliated same layer assets, judge list
Whether the influx growth rate of a key equipment, different agreement data packet distribution proportion, different size data packet distribution proportion are deposited
In variation identical with flow speed, flow total amount similar property, the security postures value of single key equipment is calculated；
By several neighbouring single key equipments, or according to several the single key equipments for having service interaction, group
At localized network, by the corresponding security breaches of each key equipment, concurrent thread, bandwidth, the network topology, visit in localized network
Ask frequency, influx growth rate, different agreement data packet distribution proportion and different size data packet distribution proportion, it is excellent according to business
First grade introduces the security postures value that Fuzzy Processing calculates localized network；
According to the topological relation of multiple localized networks, Fuzzy Processing calculates the security postures value of whole network；
The security postures value of single key equipment, localized network and whole network is imported into neural network model respectively, is led to
Neural network model deduction is crossed, obtains prediction of the following a period of time about attacker source and firing area；
By the security postures value of single key equipment, localized network and whole network, attacker source and firing area
Prediction result is visualized.
In some preferred embodiments, the data flow after merging extracts element, comprising: according to previous historical data
Assessment models, correlation rule and index storehouse, extract element information from the respective field of data flow.
In some preferred embodiments, it is described clear data in redundancy, according to the type in source, by data format
Unified format is converted to, is handled based on Map Reduce Distributed Parallel Computing.
In some preferred embodiments, the Fuzzy Processing calculating is the method combined based on D-S theory with fuzzy set,
Calculate the probability that attack is supported.
Fig. 2 is the architecture diagram of the Situation Awareness System of weight quantization provided by the present application, the system comprises:
Acquisition unit, for acquiring the sensor of separate sources, the running state data of information platform, detecting devices；
Pretreatment unit, after receiving acquisition data, clear data in redundancy will according to the type in source
Data Format Transform is unified format, is divided into corresponding field, is merged into data flow；
Situation understands unit, for extracting element from the data flow after merging, finds the behavior act for including in element, visits
Ask object, source person address, instantaneous flow size information, therefrom excavate high frequency project team, according to high frequency, project team is corresponding
Information generates high frequency correlation rule, increases its corresponding weight, forms the tree-shaped structure of frequent mode；
Situation Assessment unit, for inquiring the adjacent similar assets situation in address according to the tree-shaped structure of the frequent mode
Information, the assets situation information and query flows speed of the affiliated same layer of queried access object, the similar assets state of flow total amount
Gesture information；Judge that single key equipment with the presence or absence of the identical security breaches of close assets adjacent with address, judges single crucial
The concurrent thread of equipment, bandwidth, network topology, access frequency whether there is alarm identical with affiliated same layer assets, judge list
Whether the influx growth rate of a key equipment, different agreement data packet distribution proportion, different size data packet distribution proportion are deposited
In variation identical with flow speed, flow total amount similar property, the security postures value of single key equipment is calculated；
By several neighbouring single key equipments, or according to several the single key equipments for having service interaction, group
At localized network, by the corresponding security breaches of each key equipment, concurrent thread, bandwidth, the network topology, visit in localized network
Ask frequency, influx growth rate, different agreement data packet distribution proportion and different size data packet distribution proportion, it is excellent according to business
First grade introduces the security postures value that Fuzzy Processing calculates localized network；
According to the topological relation of multiple localized networks, Fuzzy Processing calculates the security postures value of whole network；
Tendency Prediction unit, for respectively leading the security postures value of single key equipment, localized network and whole network
Enter neural network model, deduced by neural network model, obtains following a period of time about attacker source and firing area
Prediction；
Situation display unit, for by the security postures value of single key equipment, localized network and whole network, attacker
The prediction result of source and firing area is visualized.
In some preferred embodiments, the situation understands that unit extracts element from the data flow after merging, comprising: according to
Assessment models, correlation rule and the index storehouse of previous historical data, extract element information from the respective field of data flow.
In some preferred embodiments, the pretreatment unit clear data in redundancy, according to the type in source,
It is unified format by Data Format Transform, is handled based on Map Reduce Distributed Parallel Computing.
In some preferred embodiments, the Situation Assessment unit Fuzzy Processing calculating is based on D-S theory and fuzzy set
The method combined calculates the probability that attack is supported.
In the specific implementation, the present invention also provides a kind of computer storage mediums, wherein the computer storage medium can deposit
Program is contained, which may include step some or all of in each embodiment of the present invention when executing.The storage medium
It can be magnetic disk, CD, read-only memory (referred to as: ROM) or random access memory (referred to as: RAM) etc..
It is required that those skilled in the art can be understood that the technology in the embodiment of the present invention can add by software
The mode of general hardware platform realize.Based on this understanding, the technical solution in the embodiment of the present invention substantially or
The part that contributes to existing technology can be embodied in the form of software products, which can store
In storage medium, such as ROM/RAM, magnetic disk, CD, including some instructions use is so that a computer equipment (can be
Personal computer, server or network equipment etc.) it executes described in certain parts of each embodiment of the present invention or embodiment
Method.
The same or similar parts between the embodiments can be referred to each other for this specification.For embodiment,
Since it is substantially similar to the method embodiment, so being described relatively simple, related place is referring to the explanation in embodiment of the method
.
Invention described above embodiment is not intended to limit the scope of the present invention..
Claims (8)
1. a kind of Situation Awareness method of weight quantization, which is characterized in that the described method includes:
Acquire the sensor of separate sources, the running state data of information platform, detecting devices；
After receiving acquisition data, clear data in redundancy according to the type in source be uniformly by Data Format Transform
Format is divided into corresponding field, is merged into data flow；
Element is extracted from the data flow after merging, finds the behavior act for including in element, access object, source person address, wink
When uninterrupted information, therefrom excavate high frequency project team, high frequency correlation rule generated according to the corresponding information of high frequency project team,
Its corresponding weight is increased, the tree-shaped structure of frequent mode is formed；
According to the tree-shaped structure of the frequent mode, the adjacent similar assets situation information in address is inquired, belonging to queried access object
The assets situation information and query flows speed of same layer, the similar assets situation information of flow total amount；
Judge that single key equipment with the presence or absence of the identical security breaches of close assets adjacent with address, judges single key equipment
Concurrent thread, bandwidth, network topology, access frequency whether there is alarm identical with affiliated same layer assets, judge single close
The influx growth rate of button apparatus, different agreement data packet distribution proportion, different size data packet distribution proportion whether there is with
Flow speed, the identical variation of flow total amount similar property, calculate the security postures value of single key equipment；
By several neighbouring single key equipments, or according to several the single key equipments for having service interaction, composition office
Portion's network, by the corresponding security breaches of each key equipment in localized network, concurrent thread, bandwidth, network topology, access frequency
Rate, influx growth rate, different agreement data packet distribution proportion and different size data packet distribution proportion, according to service priority
Introduce the security postures value that Fuzzy Processing calculates localized network；
According to the topological relation of multiple localized networks, Fuzzy Processing calculates the security postures value of whole network；
The security postures value of single key equipment, localized network and whole network is imported into neural network model respectively, passes through mind
It is deduced through network model, obtains prediction of the following a period of time about attacker source and firing area；
By the security postures value of single key equipment, localized network and whole network, the prediction in attacker source and firing area
As a result it is visualized.
2. the method according to claim 1, wherein the data flow after merging extracts element, comprising: root
Accordingly toward the assessment models of historical data, correlation rule and index storehouse, element information is extracted from the respective field of data flow.
3. -2 described in any item methods according to claim 1, which is characterized in that it is described clear data in redundancy, root
According to the type in source, be unified format by Data Format Transform, handled based on Map Reduce Distributed Parallel Computing.
4. method according to claim 1-3, which is characterized in that the Fuzzy Processing calculating is managed based on D-S
By the method combined with fuzzy set, the probability that attack is supported is calculated.
5. a kind of Situation Awareness System of weight quantization, which is characterized in that the system comprises:
Acquisition unit, for acquiring the sensor of separate sources, the running state data of information platform, detecting devices；
Pretreatment unit, for receive acquisition data after, clear data in redundancy, according to the type in source, by data
Format is converted to unified format, is divided into corresponding field, is merged into data flow；
Situation understands unit, for extracting element from the data flow after merging, finds the behavior act for including in element, access pair
As, source person address, the information of instantaneous flow size, high frequency project team is therefrom excavated, according to the corresponding information of high frequency project team
High frequency correlation rule is generated, its corresponding weight is increased, forms the tree-shaped structure of frequent mode；
Situation Assessment unit, for inquiring the adjacent similar assets situation information in address according to the tree-shaped structure of the frequent mode,
The assets situation information and query flows speed of the affiliated same layer of queried access object, the similar assets situation letter of flow total amount
Breath；Judge that single key equipment with the presence or absence of the identical security breaches of close assets adjacent with address, judges single key equipment
Concurrent thread, bandwidth, network topology, access frequency whether there is alarm identical with affiliated same layer assets, judge single close
The influx growth rate of button apparatus, different agreement data packet distribution proportion, different size data packet distribution proportion whether there is with
Flow speed, the identical variation of flow total amount similar property, calculate the security postures value of single key equipment；
By several neighbouring single key equipments, or according to several the single key equipments for having service interaction, composition office
Portion's network, by the corresponding security breaches of each key equipment in localized network, concurrent thread, bandwidth, network topology, access frequency
Rate, influx growth rate, different agreement data packet distribution proportion and different size data packet distribution proportion, according to service priority
Introduce the security postures value that Fuzzy Processing calculates localized network；
According to the topological relation of multiple localized networks, Fuzzy Processing calculates the security postures value of whole network；
Tendency Prediction unit, for the security postures value of single key equipment, localized network and whole network to be imported mind respectively
It through network model, is deduced by neural network model, obtains following a period of time about the pre- of attacker source and firing area
It surveys；
Situation display unit, for by the security postures value of single key equipment, localized network and whole network, attacker source
It is visualized with the prediction result of firing area.
6. system according to claim 5, which is characterized in that the situation understands that unit is extracted from the data flow after merging
Element, comprising: according to the assessment models of previous historical data, correlation rule and index storehouse, mentioned from the respective field of data flow
Take element information.
7. according to the described in any item systems of claim 5-6, which is characterized in that the pretreatment unit clear data in it is superfluous
Data Format Transform is unified format, is based on Map Reduce distributed parallel by remaining information according to the type in source
Calculate processing.
8. according to the described in any item systems of claim 5-7, which is characterized in that the Situation Assessment unit Fuzzy Processing calculates
It is the method combined based on D-S theory with fuzzy set, calculates the probability that attack is supported.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910757772.2A CN110460472B (en) | 2019-08-16 | 2019-08-16 | Weighted quantization situation perception method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910757772.2A CN110460472B (en) | 2019-08-16 | 2019-08-16 | Weighted quantization situation perception method and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110460472A true CN110460472A (en) | 2019-11-15 |
| CN110460472B CN110460472B (en) | 2022-05-03 |
Family
ID=68487087
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910757772.2A Active CN110460472B (en) | 2019-08-16 | 2019-08-16 | Weighted quantization situation perception method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110460472B (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102263410A (en) * | 2010-05-31 | 2011-11-30 | 河南省电力公司 | Security risk assessment model, assessment method and assessment parameter determining method |
| CN102624696A (en) * | 2011-12-27 | 2012-08-01 | 中国航天科工集团第二研究院七〇六所 | Network security situation evaluation method |
| WO2016172514A1 (en) * | 2015-04-24 | 2016-10-27 | Siemens Aktiengesellschaft | Improving control system resilience by highly coupling security functions with control |
| CN107404400A (en) * | 2017-07-20 | 2017-11-28 | 中国电子科技集团公司第二十九研究所 | A kind of network situation awareness implementation method and device |
| CN108494810A (en) * | 2018-06-11 | 2018-09-04 | 中国人民解放军战略支援部队信息工程大学 | Network security situation prediction method, apparatus and system towards attack |
| CN108769048A (en) * | 2018-06-08 | 2018-11-06 | 武汉思普崚技术有限公司 | A kind of secure visualization and Situation Awareness plateform system |
-
2019
- 2019-08-16 CN CN201910757772.2A patent/CN110460472B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102263410A (en) * | 2010-05-31 | 2011-11-30 | 河南省电力公司 | Security risk assessment model, assessment method and assessment parameter determining method |
| CN102624696A (en) * | 2011-12-27 | 2012-08-01 | 中国航天科工集团第二研究院七〇六所 | Network security situation evaluation method |
| WO2016172514A1 (en) * | 2015-04-24 | 2016-10-27 | Siemens Aktiengesellschaft | Improving control system resilience by highly coupling security functions with control |
| CN107404400A (en) * | 2017-07-20 | 2017-11-28 | 中国电子科技集团公司第二十九研究所 | A kind of network situation awareness implementation method and device |
| CN108769048A (en) * | 2018-06-08 | 2018-11-06 | 武汉思普崚技术有限公司 | A kind of secure visualization and Situation Awareness plateform system |
| CN108494810A (en) * | 2018-06-11 | 2018-09-04 | 中国人民解放军战略支援部队信息工程大学 | Network security situation prediction method, apparatus and system towards attack |
Non-Patent Citations (3)
| Title |
|---|
| 刘鹏等: "大规模网络安全态势感知及预测", 《计算机安全》 * |
| 甘文道等: "基于RAN-RBF神经网络的网络安全态势预测模型", 《计算机科学》 * |
| 耿汝年: "加权频繁模式挖掘算法研究", 《中国博士学位论文全文数据库》 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110460472B (en) | 2022-05-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110445801A (en) | A kind of Situation Awareness method and system of Internet of Things | |
| CN106341414B (en) | A kind of multi-step attack safety situation evaluation method based on Bayesian network | |
| CN110460608A (en) | A kind of Situation Awareness method and system comprising association analysis | |
| CN110474904A (en) | A kind of Situation Awareness method and system improving prediction | |
| Zonouz et al. | SOCCA: A security-oriented cyber-physical contingency analysis in power infrastructures | |
| Desell et al. | Evolving deep recurrent neural networks using ant colony optimization | |
| Sun et al. | A trust management model to enhance security of cloud computing environments | |
| CN109074284A (en) | For increasing and decreasing the method and system and computer program product of resource in proportion | |
| CN106294559A (en) | A kind of application traffic analysis method and device | |
| CN106230773A (en) | Risk evaluating system based on fuzzy matrix analytic hierarchy process (AHP) | |
| Vu et al. | Distributed adaptive model rules for mining big data streams | |
| CN110493043A (en) | A kind of distribution Situation Awareness call method and device | |
| CN104363104A (en) | User-requirement-oriented mass multivariate data situation displaying system and method | |
| CN110460662A (en) | The processing method and system of internet of things data | |
| CN108537243A (en) | A kind of violation alarm method and device | |
| CN110493044A (en) | A kind of method and system of quantifiable Situation Awareness | |
| CN110493217A (en) | A kind of distributed Situation Awareness method and system | |
| Jacq et al. | The cyber-MAR project: First results and perspectives on the use of hybrid cyber ranges for port cyber risk assessment | |
| CN110493218A (en) | A kind of method and apparatus of Situation Awareness virtualization | |
| CN110471975A (en) | A kind of Internet of Things Situation Awareness call method and device | |
| CN105608380A (en) | Virtual machine lifecycle-based cloud computation security assessing method | |
| Lin et al. | ACO-BTM: a behavior trust model in cloud computing environment | |
| CN110460472A (en) | A kind of Situation Awareness method and system of weight quantization | |
| Pour et al. | A blockchain-enabled model to enhance disaster aids network resilience | |
| Bazrafkan et al. | National cyber situation awareness model |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |