Abstract: The Hidden Markov Model(HMM) for describing host security states was established to evaluate the real time security risk of network, whose input is Intrusion Detection System alers. The probability for host to be attacked was calculated by this model. Aimed at the attack alers, a new calculating method for attack success probability was presented, and used attack threat level to calculate the risk index of the host node. Finally, the importance weight and risk index of all the host nodes were used to calculated the risk of the network ctuantitatively. The case study demonstrated this method can provide the real-time risk curves of host system for security managers to adjust security policies.

Key words: Network security, Risk assessment, Intrusion detection system, Hidden markov model