Research on network risk assessment based on attack graph of expected benefits-rate

Wenfu LIU; Jianmin PANG; Xin ZHOU; Nan LI; Feng YUE

doi:10.11959/j.issn.2096-109x.2022047

您当前的位置：

首页 >

文章列表页 >

Research on network risk assessment based on attack graph of expected benefits-rate

Papers | 更新时间：2024-06-03

- Research on network risk assessment based on attack graph of expected benefits-rate
- Chinese Journal of Network and Information Security Vol. 8, Issue 4, Pages: 87-97(2022)
- 作者机构：
  
  1. 信息工程大学，河南郑州 450001
  2. 电子信息系统复杂电磁环境效应重点实验室，河南洛阳 471003
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2022047
  CLC： TP309.1
- Online First：2022-08，
  
  Published：15 August 2022
- 稿件说明：
移动端阅览
Wenfu LIU, Jianmin PANG, Xin ZHOU, et al. Research on network risk assessment based on attack graph of expected benefits-rate[J]. Chinese Journal of Network and Information Security, 2022, 8(4): 87-97.
DOI：

Wenfu LIU, Jianmin PANG, Xin ZHOU, et al. Research on network risk assessment based on attack graph of expected benefits-rate[J]. Chinese Journal of Network and Information Security, 2022, 8(4): 87-97. DOI： 10.11959/j.issn.2096-109x.2022047.

摘要

随着互联网应用和服务越来越广泛，层出不穷的网络攻击活动导致信息系统的安全面临极大的风险挑战。攻击图作为基于模型的网络安全风险分析技术，有助于发现网络节点间的脆弱性和评估被攻击的危害程度，已被证实是发现和预防网络安全问题的有效方法。攻击图主要分为状态攻击图和属性攻击图，由于状态攻击图存在状态爆炸的问题，研究者大多偏向于基于属性攻击图的网络风险评估研究。针对现有的属性攻击图研究过度依赖网络节点本身脆弱性和原子攻击本质属性进行量化分析，忽略了理性攻击者通常以攻击利益最大化来选择具体的攻击路径，提出了基于期望收益率攻击图的网络风险评估框架和攻击收益率量化模型。所提网络风险评估框架以公开的漏洞资源库、漏洞挖掘系统发现的新漏洞以及与网络攻防相关的大数据为基础数据源，以开源大数据平台为分析工具，挖掘计算攻击成本和攻击收益相关要素；借用经济学中的有关成本、收益以及收益率等概念构建原子攻击期望收益率计算模型；通过构建目标网络的属性攻击图，计算攻击路径上的原子攻击期望收益率，生成所有可能攻击路径的期望收益率列表；以期望目标为出发点，依据特定的优化策略（回溯法、贪心算法、动态规划）展开搜索，得到最大收益率的完整攻击路径，为网络风险评估提供依据。仿真实验结果表明了所提期望收益率攻击图网络风险评估方法的有效性及合理性，能够为发现和预防网络安全问题提供支撑。

Abstract

As Internet applications and services become more and more extensive

the endless network attacks lead to great risks and challenges to the security of information systems.As a model-based network security risk analysis technology

attack graph is helpful to find the vulnerability between network nodes and the harm of being attacked.It has been proved to be an effective method to find and prevent network security risks.Attack graph is mainly divided into state-based attack graph and attribute-based attack graph.Due to the problem of state explosion in state-based attack graph

most researchers prefer the attribute-based attack graph for network risk assessment.In view of the existing researches on attribute-based attack graph

they excessively rely on the vulnerability of network nodes and the essential attributes of atomic attack.However

they ignore that rational attackers usually choose specific attack paths by maximizing attack benefits.Then

a network risk assessment framework and a quantification method of attack benefits-rate based on expected benefits-rate attack graph were proposed.The network risk assessment framework took the open vulnerability resource database

the new vulnerabilities found by the vulnerability mining system and the big data related to network attack and defense as the basic data source.The network risk assessment framework also took the open source big data platform as the analysis tool to mine and calculate the elements related to attack cost and attack benefit.Using the concepts of cost

benefit and benefit-rate in economics

the calculation model of expected benefit-rate of atomic attack was constructed.By constructing the attribute-based attack graph of the target network

the expected benefit-rate of atomic attack on the attack path was calculated

and the expected benefit-rate list of all possible attack paths was generated.Furthermore

taking the expected goal as the starting point

the search was carried out according to the specific optimization strategy (backtracking method

greedy algorithm

dynamic programming).And the complete attack path with the maximum benefit-rate was obtained

which provided the basis for network risk assessment.The simulation results show the effectiveness and rationality of the proposed expected benefit-rate attack graph network risk assessment method

which can provide support for discovering and preventing network security problems.

关键词

Keywords

references

吴迪 , 冯登国 , 连一峰 , 等 . 一种给定脆弱性环境下的安全措施效用评估模型 [J ] . 软件学报 , 2012 , 23 ( 7 ): 1880 - 1898 .

WU D , FENG D G , LIAN Y F , et al . Efficiency evaluation model of system security measures in the given vulnerabilities set [J ] . Journal of Software . 2012 , 23 ( 7 ): 1880 - 1898 .

MAIO F D , MASCHERONA Z E . Risk analysis of cyber-physical systems by GTST-MLD [J ] . IEEE Systems Journal , 2020 , 14 ( 1 ): 1333 - 1340 .

LEE J , MOON D , KIM I , et al . A semantic approach to improving machine readability of a large-scale attack graph [J ] . The Journal of Supercomputing , 2018 .

SCARFONE K , MELL P . An analysis of CVSS version 2 vulnerability scoring [J ] . IEEE Computer Society , 2009 .

KERAMATI M , AKBARI A . CVSS-based security metrics for quantitative analysis of attack graphs [C ] // 2013 3th International Conference on Computer and Knowledge Engineering (ICCKE) . 2013 .

KHOUZANI M , LIU Z , MALACARIA P . Scalable min-max multi-objective cyber-security optimisation over probabilistic attack graphs [J ] . European Journal of Operational Research , 2019 .

LIU X G . A network attack path prediction method using attack graph [J ] . Journal of Ambient Intelligence and Humanized Computing , 2020 ,( 1 ): 1 - 8 .

ZANG T , GAO S , LIU B , et al . Integrated fault propagation model based vulnerability assessment of the electrical cyber-physical system under cyber attacks [J ] . Reliability Engineering ＆ System Safety , 2019 , 189 ( SEP. ): 232 - 241 .

OBERT J , CHAVEZ A . Graph theory and classifying security events in grid security gateways [J ] . International Journal of Semantic Computing , 2020 , 14 ( 1 ): 93 - 105 .

陈锋 , 张怡 , 苏金树 , 等 . 攻击图的两种形式化分析 [J ] . 软件学报 , 2010 , 21 ( 4 ): 838 - 848 .

CHEN F , ZHANG Y , SU J S , et al . Two formal analyses of attack graphs [J ] . Journal of Software , 2010 , 21 ( 4 ): 838 - 848 .

SHEYNER O , HAINES J , JHA S , et al . Automated generation and analysis of attack graphs [C ] // IEEE Symposium on Security ＆ Privacy . 2002 .

INGOLSK , CHU M , LIPPMANN R , et al . Modeling modern network attacks and countermeasures using attack graphs [R ] . 2009 .

马春光 , 汪诚弘 , 张东红 , 等 . 一种基于攻击意愿分析的网络风险动态评估模型 [J ] . 计算机研究与发展 , 2015 , 52 ( 9 ): 2056 - 2068 .

MA C G , WANG C H , ZHANG D H , et al . A dynamic network risk assessment model based on attacker’s inclination [J ] . Journal of Computer Research and Development . 2015 , 52 ( 9 ): 2056 - 2068 .

闫峰 . 基于攻击图的网络安全风险评估技术研究 [D ] . 长春:吉林大学 , 2014 .

YAN F . The technology research of network security risk assessment based on attacks graphs [D ] . Changchun:Jilin University , 2014 .

ZHANG S , SONG S . A novel attack graph posterior inference model based on bayesian network [J ] . Journal of Information Security , 2011 , 2 ( 1 ): 8 - 27 .

WANG L , LIU A , JAJODIA S . Using attack graphs for correlating,hypothesizing,and predicting intrusion alerts [J ] . Computer Communications , 2006 , 29 ( 15 ): 2917 - 2933 .

周余阳 , 程光 , 郭春生 . 基于贝叶斯攻击图的网络攻击面风险评估方法 [J ] . 网络与信息安全学报 , 2018 , 4 ( 6 ): 11 - 22 .

ZHOU Y Y , CHENG G , GUO C S . Risk assessment method for network attack surface based on Bayesian attack graph [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 6 ): 11 - 22 .

LALLIE H S , DEBATTISTAK , BAL J . Evaluating practitioner cyber-security attack graph configuration preferences [J ] . Computers ＆ Security , 2018 , 79 : 117 - 131 .

LIN P , CHEN Y . Dynamic network security situation prediction based on bayesian attack graph and big data [C ] // 2018 IEEE 4th Information Technology and Mechatronics Engineering Conference (ITOEC) . 2018 .

Views

504

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

AI-based risk assessment and early warning method for futures trading

Autonomous security analysis and penetration testing model based on attack graph and deep Q-learning network

Automated Windows domain penetration method based on reinforcement learning

Information security vulnerability scoring model for intelligent vehicles

Key path analysis method for large-scale industrial control network

Related Author

Li Meng

Liu Yibo

Guo Jinsheng

Weng Zhenhao

Qiao Yan

Hu Yi

Wang Junjie

Chang Fei

Related Institution

Huishang Futures Co., Ltd.

School of Computer Science and Information Engineering, Hefei University of Technology

Key Laboratory of Knowledge Engineering with Big Data, Hefei University of Technology

College of Computer, Nanjing University of Posts and Telecommunications

Jiangsu Provincial Key Laboratory of Wireless Sensor Network High Technology Research

⁰