一种网络安全脆弱性评估方法

A assessment method of network security vulnerability

针对WIVSS默认评分机制无法体现脆弱点复杂性和多样性的缺点,对脆弱性分析理论与脆弱点评分技术进行分析,在通用脆弱点评分系统(common vulnerability scoring system,CVSS)基础上进行改进,设计了一种更具多样性且更能反映实际情况的脆弱点评分方法.该脆弱点评分方法主要由分析后得出的一系列实际系统约束规则出发,使用最优脆弱点评分权值组合搜索算法和基于信息熵的权值组合选择算法,联合确定目标网络的最优脆弱点评分权值组合,最终实现对脆弱点的最优评分.结果表明,文中方法确定的目标网络最优脆弱点评分权值组合保证了脆弱点多样性,弥补了WIVSS的不足.

To reflect the complexity and diversity of vulnerability for the WIVSS scoring mechanism,the frequently used vulnerability analysis theory and vulnerability scoring method were analyzed.A new vulnerability scoring method was designed based on common vulnerability scoring system （CVSS ） to reflect the complexity of vulnerabilities well.According to a set of actual system constraint rules from analysis,the optimum combination search algorithm of fragile comment decentralization values and the selection algorithm of information entropy weights portfolio were used to determine the optimal decentralization vulnerable reviews combination of values by the target network,and the best scores of vulnerable points were obtained.The results show that the proposed weight combination of vulnerability can ensure the diversity of vulnerability point and improve the WIVSS.