云模式下基于危险理论的网络攻击态势察觉模型

Danger Theory Based Model for Network Attacks Situation Perception with Cloud Method

为探索大规模、复杂网络的安全态势要素获取新途径,提出了一种云模式下基于危险理论的网络攻击态势察觉模型.效仿"细胞受损或非正常死亡产生危险信号,并由危险信号诱发免疫应答"机理,在定义计算机网络到危险模式映射后,用云模型的不确定性推理方法,通过构造云图和设计规则发生器,建立计算机网络定量安全状态参数转化为定性危险级别的云模型;依据危险等级生成危险信号,并由其激活由云端实现的基于免疫危险理论的网络攻击态势察觉.理论分析和验证实验结果表明该模型有效,为大规模、复杂计算机网络的安全态势感知提供了新思路.

To explore new ways of getting security situational factors for complex large-scale networks, a danger theory based model for network attacks situation perception with cloud method is proposed. The proposed model follows the danger model principles of cells dying unnaturally or distressed may release an alarm signal, and the adaptive immune response stimulated by danger signal. With the establishment of mapping the computer networks to immune danger model, the model is built by using the uncertainty reasoning method of cloud computing. Within the model, the quantitative safety state parameters, such as resource occupancy rate, network traffic are translated into different qualitative risk levels by cloud generators. Network attacks＇ detection is activated by danger signal, which is generated by different risk level. Theoretical analysis and simulation results show that the presented model is valid. Thus, it provides a good solution to large-scale computer network security situation awareness.