Abstract:Traditional network threat situational assessment is based on primary alerts, however, its lack of access to contextual information compromises the accuracy of assessment. This paper proposes a method to quantitatively assess network threat situation based on not only alerts but also contextual information. The new method first verifies alerts along with contextual information to determine the successful possibility of events; then analyzes the loss caused by events according to the risk and the corresponding asset value of events; and finally quantitatively assesses network threat situation based on the successful possibility and the loss of events. Case studies show that the proposed method can evaluate network threat situations accurately.