Research On Technology Of Network Security Situation Analysis Based On Network Simulation

Nowadays the prevailing methods of researching on network security situation mainly base on associating, processing and analyzing the data logs of network security infrastructures, then obtain the current network situation and predict security situation through this way. However, there are many problems. First of all, most of the alarm logs generated from various network security equipments have different significances and styles. Secondly, the processes of associating and merging of these data are complex, redundant and inefficient. Thirdly, the development of forecasting network security situation in our country is slow, there are some theories based on fuzzy mathematics but they all did not implement the prototype, there also have some researches that only could forecast a small range of network topology, and couldn't provide the useful data for the large scale network security situation. Therefore, to evaluate and forecast the network security situation more reasonably and accurately, this paper presents a method that using the network simulation to analyze the network security situation.In this thesis we first introduce the conception of network security situation, the behavior characteristic of network security events and the development of network simulation technology. We construct a common network security event model that could be configured by our requirements by abstracting the key parameters of most popular network security events. The configurable model running on the real network topology could recreate and predict the appearance of network security events, then obtain the spreading trend of that. We extract the key factors that affect the current network security situation from simulation results, including the destroyed situation of the current network, the characteristics of network attack events and the host vulnerability situation. We also propose the calculation method of these three factors. Finally we conclude the mathematical model and formula of calculating the index of network security situation.