Network Security Situation Assessment Method Based on Markov Game Model = Network Security Situation Assessment Method Based on Markov Game Model

다국어 초록 (Multilingual Abstract)

In order to solve the problem that the current network security situation assessment methods just focus on the attack behaviors, this paper proposes a kind of network security situation assessment method based on Markov Decision Process and Game theory. The method takes the Markov Game model as the core, and uses the 4 levels data fusion to realize the evaluation of the network security situation. In this process, the Nash equilibrium point of the game is used to determine the impact on the network security. Experiments show that the results of this method are basically consistent with the expert evaluation data. As the method takes full account of the interaction between the attackers and defenders, it is closer to reality, and can accurately assess network security situation.

참고문헌 (Reference)

1 Boyer S, "Stellar: A fusion system for scenario construction and security risk assessment" 105-116, 2015

2 Li F W, "Situation Assessment Method based on Hidden Markov Model" 36 (36): 1706-1711, 2015

3 The snort project, "SNORT Users Manual"

4 Gong Z H, "Research on Cyberspace Situational Awareness" 21 (21): 1605-1619, 2010

5 Ramaki A A, "Real time alert correlation and prediction using Bayesian networks" 98-103, 2015

6 Wen Z C, "Network security situation prediction method based on hidden Markov model" 46 (46): 3689-3695, 2015

7 Xie L X, "Network Security Situation Awareness Approach Based on Markov Game Model" 53 (53): 1750-1760, 2013

8 Zhang Y, "Network Security Situation Awareness Approach Based on Markov Game Model" 22 (22): 495-508, 2011

9 Bass T, "Multi sensor data fusion for next generation distributed intrusion detection systems" 24-27, 1999

10 Kadar I, "Knowledge representation issues in perceptual reasoning managed situation assessment" 13-15, 2005

11 Bass T, "Intrusion detection systems and multi sensor data fusion" 43 (43): 99-105, 2000

12 Jinxia Wei, "Defense Strategy of Network Security based on Dynamic Classification" 한국인터넷정보학회 9 (9): 5116-5134, 2015

13 Gad A, "Data fusion architecture for maritime surveillance" 448-455, 2002

14 Blasch E, "DFIG level5 issues supporting situational assessment reasoning" 35-43, 2005

15 Llinas J, "An introduction to multi sensor data fusion" 6 : 537-540, 1998

16 Xi R R, "An Improved Quantitative Evaluation Method for Network Security" 38 (38): 749-758, 2015

17 Wang C H, "Alert correlation system with automatic extraction of attack strategies by using dynamic feature weights" 5 (5): 1-10, 2016

18 Guan-Yu Hu, "A method for predicting the network security situation based on hidden BRB model and revised CMA-ES algorithm" 48 : 404-418, 2016