基于外部报警日志的本地网络安全威胁度量

Internet安全报警数据中心是应对大规模网络安全威胁的重要基础设施之一.文章提出了一种利用数据中心度量本地网络安全威胁的方法.在系统漏洞扫描分析的基础上,引入端口攻击趋势的概念,利用外部数据中心数据计算攻击趋势.使本地系统的威胁评估与当前网络安全状况相结合,重新计算系统的安全威胁评分,实现了一个原型验证了所设计的方...

Measuring local security threats based on external collected alerts

The Internet security alert data center is an important infrastructure that defeats the large-scale network security threats.This paper proposes a method which uses data center to assess local network security threats.After scanning system and analysing system vulnerability,we introduce a concept of the trend of port attack,and calculate the attack trend based on the security alerts.We establish a model combining the threats assessment of local system with the security situation of current network,and re-ev...