基于贝叶斯攻击图的网络攻击面风险评估方法

周余阳; 程光; 郭春生

doi:10.11959/j.issn.2096-109x.2018053

您当前的位置：

首页 >

文章列表页 >

基于贝叶斯攻击图的网络攻击面风险评估方法

论文 | 更新时间：2024-06-03

- 基于贝叶斯攻击图的网络攻击面风险评估方法
- Risk assessment method for network attack surface based on Bayesian attack graph
- 网络与信息安全学报 2018年4卷第6期页码：11-22
- 作者机构：
  
  1. 东南大学网络空间安全学院，江苏南京 211189
  2. 东南大学计算机科学与工程学院，江苏南京 211189
  3. 教育部计算机网络和信息集成重点实验室（东南大学），江苏南京 211189
- 作者简介：
  
  [ "周余阳（1994-），男，江苏泰州人，东南大学博士生，主要研究方向为网络安全、移动目标防御。" ]
  [ "程光（1973-），男，安徽黄山人，博士，东南大学教授、博士生导师，主要研究方向为网络测量、网络安全和网络管理。" ]
  [ "郭春生（1994-），男，河南南阳人，东南大学硕士生，主要研究方向为网络安全。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61602114);国家重点研发计划基金资助项目;The National Key R＆D Plan Program of China(2017YFB0801703)
- DOI：10.11959/j.issn.2096-109x.2018053
  中图分类号： TP393
- 网络首发：2018-06，
  
  纸质出版：2018-06-15
- 稿件说明：
移动端阅览
周余阳, 程光, 郭春生. 基于贝叶斯攻击图的网络攻击面风险评估方法[J]. 网络与信息安全学报, 2018,4(6):11-22.

Yuyang ZHOU, Guang CHENG, Chunsheng GUO. Risk assessment method for network attack surface based on Bayesian attack graph[J]. Chinese Journal of Network and Information Security, 2018, 4(6): 11-22.
周余阳, 程光, 郭春生. 基于贝叶斯攻击图的网络攻击面风险评估方法[J]. 网络与信息安全学报, 2018,4(6):11-22. DOI： 10.11959/j.issn.2096-109x.2018053.

Yuyang ZHOU, Guang CHENG, Chunsheng GUO. Risk assessment method for network attack surface based on Bayesian attack graph[J]. Chinese Journal of Network and Information Security, 2018, 4(6): 11-22. DOI： 10.11959/j.issn.2096-109x.2018053.

摘要

针对移动目标防御中网络攻击面缺少客观风险评估的不足，为了有效地实现网络系统的安全风险评估，实现对潜在的攻击路径进行推算，提出一种基于贝叶斯攻击图的网络攻击面风险评估方法。通过对网络系统中资源、脆弱性漏洞及其依赖关系建立贝叶斯攻击图，考量节点之间的依赖关系、资源利用之间的相关性以及攻击行为对攻击路径的影响，推断攻击者到达各个状态的概率以及最大概率的攻击路径。实验结果表明了所提网络攻击面风险评估方法的可行性和有效性，能够为攻击面动态防御措施的选择提供很好的支撑。

Abstract

Aiming at the lack of objective risk assessment for the network attack surface on moving target defense

in order to realize the security risk assessment for the network system

and calculate the potential attack paths

a risk assessment method for network attack surface based on Bayesian attack graph was proposed.The network system resources

vulnerability and dependencies between them were used to establish Bayesian attack graph.Considering dependencies between nodes

the correlation between the resource and the influence of attacks on the attack path

the probability of each state that attackers can reach and the maximum probability attack path can be inferred.The experimental results prove the feasibility and effectiveness of the proposed network attack surface risk assessment method

which can provide a good support for the selection of dynamic defensive measures of attack surface.

关键词

Keywords

references

JAJODIAS , GHOSH AK , SWARUP V , et al . Moving target defense:creating asymmetric uncertainty for cyber threats [J ] . Springer Ebooks , 2011 : 54 .

蔡桂林 , 王宝生 , 王天佐 , 等 . 移动目标防御技术研究进展 [J ] . 计算机研究与发展 , 2016 , 53 ( 5 ): 968 - 987 .

CAI G L , WANG B S , WANG T Z , et al . Research and development of moving target defense technology [J ] . Journal of Computer Research and Development , 2016 , 53 ( 5 ): 968 - 987 .

WHITLEY J N , PHAN R C W , WANG J , et al . Attribution of attack trees [J ] . Computers ＆ Electrical Engineering , 2011 , 37 ( 4 ): 624 - 628 .

DALTON II G C , EDGE K S , MILLS R F , et al . Analysing security risks in computer and radio frequency identification (RFID) networks using attack and protection trees [J ] . International Journal of Security and Networks , 2010 , 5 ( 2/3 ): 87 - 95 .

AMMANN P , PAMULA J , RITCHEY R , et al . A host-based approach to network attack chaining analysis [C ] // Computer Security Applications Conference . 2005 : 72 - 84 .

叶子维 , 郭渊博 , 王宸东 , 等 . 攻击图技术应用研究综述 [J ] . 通信学报 , 2017 , 38 ( 11 ): 121 - 132 .

YE Z W , GUO Y B , WANG C D , et al . Survey on application of attack graph technology [J ] . Journal on Communications , 2017 , 38 ( 11 ): 121 - 132 .

POOLSAPPASIT N , DEWRI R , RAY I . Dynamic security risk management using Bayesian attack graphs [J ] . IEEE Transactions on Dependable and Secure Computing , 2012 , 9 ( 1 ): 61 - 74 .

MIEHLING E , RASOULI M , TENEKETZIS D . Optimal defense policies for partially observable spreading processes on bayesian attack graphs [C ] // ACMWorkshop on Moving Target Defense . 2015 : 67 - 76 .

NGUYEN T H , WRIGHT M , WELLMAN M P , et al . Multi-stage attack graph security games:heuristic strategies,with empirical game-theoretic analysis [C ] // ACM Workshop on Moving Target Defense . 2017 : 87 - 97 .

BOPCHE G S , MEHTRE B M . Graph similarity metrics for assessing temporal changes in attack surface of dynamic networks [J ] . Computers ＆ Security , 2017 , 64 : 16 - 43 .

陈小军 , 方滨兴 , 谭庆丰 , 等 . 基于概率攻击图的内部攻击意图推断算法研究 [J ] . 计算机学报 , 2014 , 37 ( 1 ): 62 - 72 .

CHEN X J , FANG B X , TAN Q F , et al . Inferring attack intent of malicious insider based on probabilistic attack graph model [J ] . Chinese Journal of Computers , 2014 , 37 ( 1 ): 62 - 72 .

高妮 , 高岭 , 贺毅岳 , 等 . 基于贝叶斯攻击图的动态安全风险评估模型 [J ] . 四川大学学报(工程科学版) , 2016 , 48 ( 1 ): 111 - 118 .

GAO N , GAO L , HE Y Y , et al . Dynamic security risk assessment model based on Bayesian attack graph [J ] . Journal of Sichuan University(Engineering Science Editon) , 2016 , 48 ( 1 ): 111 - 118 .

刘威歆 , 郑康锋 , 武斌 , 等 . 基于攻击图的多源告警关联分析方法 [J ] . 通信学报 , 2017 , 36 ( 9 ): 135 - 144 .

LIU W X , ZHENG K F , WU B , et al . Alert processing based on attack graph and multi-source analyzing [J ] . Journal on Communications , 2017 , 36 ( 9 ): 135 - 144 .

雷程 , 马多贺 , 张红旗 , 等 . 基于变点检测的网络移动目标防御效能评估方法 [J ] . 通信学报 , 2017 , 38 ( 1 ): 126 - 140 .

LEI C , MA D H , ZHANG H Q , et al . Performance assessment approach based on change-point detection for network moving target defense [J ] . Journal on Communications , 2017 , 38 ( 1 ): 126 - 140 .

HOWARD M , PINCUS J , WING J M . Measuring relative attack surfaces [J ] . Computer Security in the 21st Century , 2003 : 109 - 137 .

MANADHATA P K , WING J M . An attack surface metric [J ] . IEEE Transactions on Software Engineering , 2011 , 37 ( 3 ): 371 - 386 .

PENG W , LI F , HUANG C T , et al . A moving-target defense strategy for cloud-based services with heterogeneous and dynamic attack surfaces [C ] // IEEE International Conference on Communications . 2014 : 804 - 809 .

SUN K , JAJODIA S . Protecting enterprise networks through attack surface expansion [C ] // Workshop on Cyber Security Analytics,Intelligence and Automation . 2014 : 29 - 32 .

CYBENKO G , JAJODIA S , WELLMAN M P , et al . Adversarial and uncertain reasoning for adaptive cyber defense:building the scientific foundation [C ] // International Conference on Information Systems Security . 2014 : 1 - 8 .

FOREMAN J C , GURUGUBELLI D . Identifying the cyber attack surface of the advanced metering infrastructure [J ] . The Electricity Journal , 2015 , 28 ( 1 ): 94 - 103 .

PEARL J . Probabilistic reasoning in intelligent system [M ] . Morgan Kaufinann : Network of Plausible Inference , 1988 : 1 - 86 .

MELL P M , KENT K A , ROMANOSKY S . The common vulnerability scoring system (CVSS) and its applicability to federal agency systems [J ] . NIST Interagency/Internal Report (NISTIR) - 7435 , 2007 , 1 ( 1 ): 119 - 127 .

ZANGENEH V , SHAJARI M . A cost-sensitive move selection strategy for moving target defense [J ] . Computers ＆ Security , 2018 ( 75 ): 72 - 91 .

浏览量

2951

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于强化学习的自动化Windows域渗透方法

面向进程多变体软件系统的攻击面定性建模分析

基于期望收益率攻击图的网络风险评估研究

面向网络层的动态跳变技术研究进展

容器云中基于Stackelberg博弈的动态异构调度方法