An evaluation method of internal network security defense ability based on device traffic

With the rapid development of Internet technology, the social information level becomes higher and higher. The information system has many safety problems such as data leakage and denial of service besides providing services for the users. How to evaluate the security defense system quantitatively and optimize the deployment of devices, becomes an urgent problem to be solved. Aiming at these problems above, a security defense evaluation method of internal network based on the traffic of devices is proposed. This method quantifies the defense effectiveness, it realizes the objective evaluation on defense effectiveness from two dimensions. One is the severity of potential attack risk, another is the response of a device with defense function. In practical application, this method can evaluate the effectiveness of defense scheme under different application scenes and different security risk defining standards. It doesn't need modeling and analysis for special context separately, and it can evaluate the effectiveness of system's defense strategy quantitatively. Comparing with the method which security staff simulate attack behaviors by penetration testing, this method is more comprehensive and controllable. It is helpful to confirm the relationship between network security device and protected asset, the relationship between security threat and defense, and the relationship between security devices and whole defense system. Through analyzing the evaluation result, the efficiency of the evaluation method of the security defense capability of internal network is proved.