Security Situation Assessment Method Based on States Transition

With the development of demands in the network security operation, how to assess the network security situation becomes a research hotspot. In order to solve the problem that the security situation of current network cannot be reflected by the alarm information from security equipment, the security situation assessment model based on state transition was built with HMM, by researching hosts states and analyzing events affected states transition. This method is effective in training the parameters of the model, and it can analyze the security situation quantitatively and qualitatively. At last, the result validates the method by the historical security data in CSTNET