信息网络安全

信息网络安全 ›› 2025, Vol. 25 ›› Issue (6): 843-858.doi: 10.3969/j.issn.1671-1122.2025.06.001

• 专题论文: 网络主动防御 • 上一篇    下一篇

基于威胁传播的网络安全态势评估方法

赵波1,2(), 彭君茹1,2, 王一琁1,2   

  1. 1.武汉大学国家网络安全学院，武汉 430072
    2.空天信息安全与可信计算教育部重点实验室，武汉 430072
  • 收稿日期:2025-01-23 出版日期:2025-06-10 发布日期:2025-07-11
  • 通讯作者: 赵波 E-mail:zhaobo@whu.edu.cn
  • 作者简介:赵波（1972—），男，山东，教授，博士，CCF高级会员，主要研究方向为信息系统安全、嵌入式系统、可信计算|彭君茹（2000—），女，宁夏，硕士研究生，主要研究方向为网络安全、软件安全|王一琁（1994—），男，江苏，博士研究生，主要研究方向为网络安全、知识图谱
  • 基金资助:
    国家自然科学基金(U1936122);湖北省重点研发计划(2020BAB101)

Network Security Situation Assessment Method Based on Threat Propagation

ZHAO Bo1,2(), PENG Junru1,2, WANG Yixuan1,2   

  1. 1. School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China
    2. Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, Wuhan 430072, China
  • Received:2025-01-23 Online:2025-06-10 Published:2025-07-11
  • Contact: ZHAO Bo E-mail:zhaobo@whu.edu.cn

RichHTML

85

PDF (PC)

175

摘要：

网络安全态势评估是态势感知领域中的一项重要研究。目前,已有许多网络安全态势评估方法，但以往的研究通常缺乏可迁移性或依赖专家经验，导致评估过程不够灵活，评估结果也带有一定的主观性。通过分析恶意流量图，发现攻击者通常表现出较高的中心性特征，而这种特征与社交网络中个体之间的互动和影响力传播有相似之处。在社交网络中，中心性分析用于识别关键节点并揭示其传播路径，类似地，恶意流量图中的中心性分析有助于识别攻击源和传播节点。通过这种结构上的相似性，社交网络分析方法得以迁移到恶意流量图，进一步增强了态势评估的可迁移性。为克服传统方法的迁移性问题，文章提出一种新颖的网络安全态势评估方法（ThreatSA），与传统的静态分析方法不同，ThreatSA将恶意流量转化为图结构，并通过中心性分析量化节点的重要性，识别出攻击者或传播节点。随后，利用亲密度分析衡量这些节点与其他节点之间的关系强度，从而动态反映主机的安全态势。ThreatSA仅依赖恶意流量数据，且适用于信息不完整的网络环境。通过对3个公开的网络攻击数据集进行实验评估，结果表明，ThreatSA能够实时评估网络态势，并达到99.32%、99.65%和99.74%的相似度。与当前具有代表性的两种方法相比，ThreatSA在网络安全态势评估中取得了卓越的表现。

关键词: 态势评估, 威胁源定位, 中心性分析, 亲密度计算

Abstract:

Network security situation awareness assessment remains a critical research focus in cybersecurity. Previous methods suffered from limited transferability and excessive reliance on expert experience, leading to rigid processes and subjective evaluations. We analyzed malicious traffic graphs and observed that attackers exhibited higher centrality characteristics, structurally resembling interaction patterns in social networks. Centrality analysis, widely used in social networks to identify key nodes and propagation paths, was adapted to detect attack sources and propagation nodes in malicious traffic graphs. This structural similarity enabled transferring social network analysis methods to cybersecurity domains, improving assessment transferability. To address these limitations, this paper proposed ThreatSA, a novel network security situation assessment method. Unlike static approaches, ThreatSA converted malicious traffic into graph structures and quantified node importance through centrality analysis to identify attackers and propagation nodes. It then employed intimacy analysis to measure node relationship strength, dynamically reflecting host security status. The method required only malicious traffic data and functioned effectively in information-incomplete environments. Experimental evaluations on three public datasets demonstrate ThreatSA’s real-time assessment capability with 99.32%, 99.65%, 99.74% similarity scores. Comparative tests show ThreatSA outperforms two representative methods, proving its effectiveness in network security situation assessment.

Key words: situation assessment, threat source localization, centrality analysis, intimacy calculation

中图分类号: