Network security situation assessment based on HMM

Network security situation assessment is the core of situation awareness, and is also a qualitative and quantitative description of network security state. In this paper, the security state and intrusion alarm event in the network or the host system have corresponded to the state and observation symbols in HMM, so that a network security situation evaluation model based on HMM has been proposed. This model intrudes the alarm sequences generated from the detection system through association analysis to calculate the risk index of each host, so as to give a quantitative evaluation of the risk status of the whole net-work system. The Network Risk Index can be calculated easily and quickly. The experimental results show that this model can effectively and accurately give a quantitative evaluation of the security state of the network system.