Research on host-level security situational awareness

Situational assessment is significant for host-level security. Most existing approaches are generally limited to network security that is different from host-level security. In this paper, we introduce an approach to assess host security. Analyzing process and file behaviors, we propose a series of security indices, based on which we compute the value of process situation (PS) and file situation (FS). To make the results more practical, we associate the process situation with its status in operating system, and then modify the file situation by associating it with the process situation. As an output, a situation curve is drew to display recent and past security situation. The experiment results show that the model can reflect host security situation effectively and dynamically.