Quantitative Evaluation Model of Network Security Situation Based on D-S Evidence Theory

This paper studies a network security situation assessment model based on D-S evidence theory for the problems that the assessment information source is too single and the accuracy deviation is too large in the situation awareness system. First, the model uses PCA to pre-process the alarm data to shorten the alarm processing time; secondly, it uses the improved DS evidence theory to combine the credibility of multi-source attack data and improve the alarm recognition rate; thirdly, by constructing three kinds of situation assessment indicators of vulnerability, threat and assets, it quantifies the situation component and improves the accuracy of the perception; fourthly, it also uses the weighted average method to synthesize the situation component; finally, the model and algorithm are verified by using network instance data and the results show the correctness of the method.