层次化动态网络入侵风险量化评估研究

Quantitative Evaluation of Hierarchical Dynamic Network Intrusion Risk

对网络的入侵风险量化评估是网络安全体系的重要防范方法,可在发现入侵后及时做出相应,有效降低网络入侵风险。传统方法采用小波神经网络(Wavelet Neural Network,WNN)模型对层次化动态网络入侵风险评估,对层次化动态网络入侵风险量化评估结果较为粗糙,导致评估结果精度较低、网络入侵报警正确率低等。为此,在传统WNN模型基础上,融合人工免疫原理提出新的层次化动态网络入侵风险量化评估方法。利用WNN模型计算层次化动态网络正向和反向入侵数据的隐含层输出结果,得到初步层次化动态网络入侵风险的等级评估结果;融合人工免疫原理与入侵风险等级评估,将层次化动态网络的入侵模拟为人体记忆细胞对外部抗原的免疫过程,利用克隆技术改变不同网络服务器的抗原浓度,实现对层次化动态网络入侵风险的精确量化评估。实验结果说明,所提方法的风险量化评估结果精度高且对层次化动态网络入侵的报警正确率高。

The quantitative evaluation of network intrusion risk is an important way to prevent the network security system. It can be made timely after the discovery of intrusion and effectively reduce the risk of network intrusion. The traditional method uses the WNN（Wavelet Neural Network） model to evaluate the intrusion risk of the hierarchical dynamic network. The unbalance of the weight distribution is lack of a complete risk assessment process,which cannot effectively quantify the risk,which leads to the low accuracy of the evaluation results and the low accuracy of the network intrusion alarm. Therefore,based on the traditional WNN model,a new hierarchical dynamic network intrusion risk quantitative evaluation method is proposed based on the principle of artificial immune system. The WNN model is used to calculate the hidden layer output of the positive and reverse intrusion data in the hierarchical dynamic network,and the hierarchical dynamic network intrusion risk level evaluation results are obtained,and the artificial immune principle and the intrusion risk rank evaluation are fused. The intrusion modes of the hierarchical dynamic network are proposed as the human memory cells to the external antigen. In the process of immunization,cloning technology is used to change the antigen concentration of different network servers,so as to achieve accurate quantitative evaluation of the risk of hierarchical dynamic network intrusion. The experimental results show that the proposed method has high accuracy in risk quantification assessment and high alarm accuracy for hierarchical dynamic network intrusion.