A novel model for assessing network risks

Abstract

In order to assess the secure states of network systems hidden Markov stochastic process is used as the decision and analysis tool. Alarm events from intrusion detection systems are used as the processed objects. A novel hidden Markov Model is proposed and it is used to describe the state transform procedure of attacked hosts. The calculation method of the risk exponent for hosts is given. The risk exponent of each host is added together to give the quantitative evaluation of the risk for entire network systems. The experiments have justified that the proposed method is effective.