一种自动优化CVSSv2.0漏洞指标的评估方法

摘要

Considering that there are several drawbacks included in CVSS 2.0, such as strongly subjectivity, inefficient maneuverability, the difficulty to create automated assessment model, the evaluation index system is improved based on CVSS 2.0 evaluation system. And the evaluation index system is divided into two parts which are objective category and subjective category. It optimizes evaluation factor with principles of BP neural network self-learning and builds an automa-tion evaluation model based on BP neural network, then quantizes the input indicators characteristic into approximation of effectiveness rapidly. Finally the effectiveness, accuracy and feasibility of the method are proved by MATLAB simulation.%针对CVSS v2.0主观性强、操作性差，建立自动化评估模型困难的问题，提出在CVSS v2.0评估体系的基础上，改进其评价指标体系，把评价指标分为主客观两类；使用BP神经网络自学习原理再次优化评价因子；并建立基于BP神经网络的自动化评估模型，快速地对输入指标的特征做逼近实效的量化。通过MATLAB仿真验证了该方法的有效性、准确性与可行性。