Network security situational assessment model based on improved AHP_FCE

Abstract

As the network security events emerge in endlessly, security situational awareness has become a hot topic in the area of network security research in recent years. Considering the characteristics of multi-source information, complicated data structure in the network security research, this paper puts forward a multilevel fuzzy comprehensive evaluation model, which is based on improved Analytic Hierarchy Process and Fuzzy Comprehensive Evaluation (AHP_FCE), for network security situational assessment. In this method, the hierarchical network index system which consists of three layers, namely, index layer, criterion layer and target layer from bottom to top, is established. The data of the index layer processed by the fuzzy mathematics is obtained from the massive snort alarm information and vulnerability information. The evaluation index weights each layer are calculated by the improved AHP. Comprehensive evaluation is started from the index layer, and by using the evaluation index weights, the factors of security situational are obtained in the criterion layer; by calculating layer by layer upwards, the hosts' security situational values are obtained in the target layer. Finally, the network security situational value is obtained using the hosts' weights. The effectiveness of this method is evaluated using DARPA 2000 data sets.