Risk assessment method for network attack surface based on Bayesian attack graph

Yuyang ZHOU; Guang CHENG; Chunsheng GUO

doi:10.11959/j.issn.2096-109x.2018053

您当前的位置：

首页 >

文章列表页 >

Risk assessment method for network attack surface based on Bayesian attack graph

Papers | 更新时间：2024-06-03

- Risk assessment method for network attack surface based on Bayesian attack graph
- Chinese Journal of Network and Information Security Vol. 4, Issue 6, Pages: 11-22(2018)
- 作者机构：
  
  1. 东南大学网络空间安全学院，江苏南京 211189
  2. 东南大学计算机科学与工程学院，江苏南京 211189
  3. 教育部计算机网络和信息集成重点实验室（东南大学），江苏南京 211189
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2018053
  CLC： TP393
- Online First：2018-06，
  
  Published：15 June 2018
- 稿件说明：
移动端阅览
Yuyang ZHOU, Guang CHENG, Chunsheng GUO. Risk assessment method for network attack surface based on Bayesian attack graph[J]. Chinese Journal of Network and Information Security, 2018, 4(6): 11-22.
DOI：

Yuyang ZHOU, Guang CHENG, Chunsheng GUO. Risk assessment method for network attack surface based on Bayesian attack graph[J]. Chinese Journal of Network and Information Security, 2018, 4(6): 11-22. DOI： 10.11959/j.issn.2096-109x.2018053.

摘要

针对移动目标防御中网络攻击面缺少客观风险评估的不足，为了有效地实现网络系统的安全风险评估，实现对潜在的攻击路径进行推算，提出一种基于贝叶斯攻击图的网络攻击面风险评估方法。通过对网络系统中资源、脆弱性漏洞及其依赖关系建立贝叶斯攻击图，考量节点之间的依赖关系、资源利用之间的相关性以及攻击行为对攻击路径的影响，推断攻击者到达各个状态的概率以及最大概率的攻击路径。实验结果表明了所提网络攻击面风险评估方法的可行性和有效性，能够为攻击面动态防御措施的选择提供很好的支撑。

Abstract

Aiming at the lack of objective risk assessment for the network attack surface on moving target defense

in order to realize the security risk assessment for the network system

and calculate the potential attack paths

a risk assessment method for network attack surface based on Bayesian attack graph was proposed.The network system resources

vulnerability and dependencies between them were used to establish Bayesian attack graph.Considering dependencies between nodes

the correlation between the resource and the influence of attacks on the attack path

the probability of each state that attackers can reach and the maximum probability attack path can be inferred.The experimental results prove the feasibility and effectiveness of the proposed network attack surface risk assessment method

which can provide a good support for the selection of dynamic defensive measures of attack surface.

关键词

Keywords

references

JAJODIAS , GHOSH AK , SWARUP V , et al . Moving target defense:creating asymmetric uncertainty for cyber threats [J ] . Springer Ebooks , 2011 : 54 .

蔡桂林 , 王宝生 , 王天佐 , 等 . 移动目标防御技术研究进展 [J ] . 计算机研究与发展 , 2016 , 53 ( 5 ): 968 - 987 .

CAI G L , WANG B S , WANG T Z , et al . Research and development of moving target defense technology [J ] . Journal of Computer Research and Development , 2016 , 53 ( 5 ): 968 - 987 .

WHITLEY J N , PHAN R C W , WANG J , et al . Attribution of attack trees [J ] . Computers ＆ Electrical Engineering , 2011 , 37 ( 4 ): 624 - 628 .

DALTON II G C , EDGE K S , MILLS R F , et al . Analysing security risks in computer and radio frequency identification (RFID) networks using attack and protection trees [J ] . International Journal of Security and Networks , 2010 , 5 ( 2/3 ): 87 - 95 .

AMMANN P , PAMULA J , RITCHEY R , et al . A host-based approach to network attack chaining analysis [C ] // Computer Security Applications Conference . 2005 : 72 - 84 .

叶子维 , 郭渊博 , 王宸东 , 等 . 攻击图技术应用研究综述 [J ] . 通信学报 , 2017 , 38 ( 11 ): 121 - 132 .

YE Z W , GUO Y B , WANG C D , et al . Survey on application of attack graph technology [J ] . Journal on Communications , 2017 , 38 ( 11 ): 121 - 132 .

POOLSAPPASIT N , DEWRI R , RAY I . Dynamic security risk management using Bayesian attack graphs [J ] . IEEE Transactions on Dependable and Secure Computing , 2012 , 9 ( 1 ): 61 - 74 .

MIEHLING E , RASOULI M , TENEKETZIS D . Optimal defense policies for partially observable spreading processes on bayesian attack graphs [C ] // ACMWorkshop on Moving Target Defense . 2015 : 67 - 76 .

NGUYEN T H , WRIGHT M , WELLMAN M P , et al . Multi-stage attack graph security games:heuristic strategies,with empirical game-theoretic analysis [C ] // ACM Workshop on Moving Target Defense . 2017 : 87 - 97 .

BOPCHE G S , MEHTRE B M . Graph similarity metrics for assessing temporal changes in attack surface of dynamic networks [J ] . Computers ＆ Security , 2017 , 64 : 16 - 43 .

陈小军 , 方滨兴 , 谭庆丰 , 等 . 基于概率攻击图的内部攻击意图推断算法研究 [J ] . 计算机学报 , 2014 , 37 ( 1 ): 62 - 72 .

CHEN X J , FANG B X , TAN Q F , et al . Inferring attack intent of malicious insider based on probabilistic attack graph model [J ] . Chinese Journal of Computers , 2014 , 37 ( 1 ): 62 - 72 .

高妮 , 高岭 , 贺毅岳 , 等 . 基于贝叶斯攻击图的动态安全风险评估模型 [J ] . 四川大学学报(工程科学版) , 2016 , 48 ( 1 ): 111 - 118 .

GAO N , GAO L , HE Y Y , et al . Dynamic security risk assessment model based on Bayesian attack graph [J ] . Journal of Sichuan University(Engineering Science Editon) , 2016 , 48 ( 1 ): 111 - 118 .

刘威歆 , 郑康锋 , 武斌 , 等 . 基于攻击图的多源告警关联分析方法 [J ] . 通信学报 , 2017 , 36 ( 9 ): 135 - 144 .

LIU W X , ZHENG K F , WU B , et al . Alert processing based on attack graph and multi-source analyzing [J ] . Journal on Communications , 2017 , 36 ( 9 ): 135 - 144 .

雷程 , 马多贺 , 张红旗 , 等 . 基于变点检测的网络移动目标防御效能评估方法 [J ] . 通信学报 , 2017 , 38 ( 1 ): 126 - 140 .

LEI C , MA D H , ZHANG H Q , et al . Performance assessment approach based on change-point detection for network moving target defense [J ] . Journal on Communications , 2017 , 38 ( 1 ): 126 - 140 .

HOWARD M , PINCUS J , WING J M . Measuring relative attack surfaces [J ] . Computer Security in the 21st Century , 2003 : 109 - 137 .

MANADHATA P K , WING J M . An attack surface metric [J ] . IEEE Transactions on Software Engineering , 2011 , 37 ( 3 ): 371 - 386 .

PENG W , LI F , HUANG C T , et al . A moving-target defense strategy for cloud-based services with heterogeneous and dynamic attack surfaces [C ] // IEEE International Conference on Communications . 2014 : 804 - 809 .

SUN K , JAJODIA S . Protecting enterprise networks through attack surface expansion [C ] // Workshop on Cyber Security Analytics,Intelligence and Automation . 2014 : 29 - 32 .

CYBENKO G , JAJODIA S , WELLMAN M P , et al . Adversarial and uncertain reasoning for adaptive cyber defense:building the scientific foundation [C ] // International Conference on Information Systems Security . 2014 : 1 - 8 .

FOREMAN J C , GURUGUBELLI D . Identifying the cyber attack surface of the advanced metering infrastructure [J ] . The Electricity Journal , 2015 , 28 ( 1 ): 94 - 103 .

PEARL J . Probabilistic reasoning in intelligent system [M ] . Morgan Kaufinann : Network of Plausible Inference , 1988 : 1 - 86 .

MELL P M , KENT K A , ROMANOSKY S . The common vulnerability scoring system (CVSS) and its applicability to federal agency systems [J ] . NIST Interagency/Internal Report (NISTIR) - 7435 , 2007 , 1 ( 1 ): 119 - 127 .

ZANGENEH V , SHAJARI M . A cost-sensitive move selection strategy for moving target defense [J ] . Computers ＆ Security , 2018 ( 75 ): 72 - 91 .

Views

2951

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Automated Windows domain penetration method based on reinforcement learning

Qualitative modeling and analysis of attack surface for process multi-variant execution software system

Research on network risk assessment based on attack graph of expected benefits-rate

Research progress on dynamic hopping technology for network layer

Dynamic heterogeneous scheduling method based on Stackelberg game model in container cloud

Related Author

Pinchang ZHANG

Jiankuo DONG

Fu XIAO

Letian SHA

Lige ZHAN

Xinsheng JI

Sheng QU

Ran SUI

Related Institution

College of Computer, Nanjing University of Posts and Telecommunications

Jiangsu Provincial Key Laboratory of Wireless Sensor Network High Technology Research

Information Engineering University

Information Center of Logistics Support Department of Central Military Commission

State Key Laboratory of Complex Electromagnetic Environment Effects on Electronics and Information System

⁰