融合宏观与微观的双层威胁分析模型

孙澄; 胡浩; 杨英杰; 张红旗

doi:10.11959/j.issn.2096-109x.2021015

您当前的位置：

首页 >

文章列表页 >

融合宏观与微观的双层威胁分析模型

学术论文 | 更新时间：2024-06-03

- 融合宏观与微观的双层威胁分析模型
- Two-layer threat analysis model integrating macro and micro
- 网络与信息安全学报 2021年7卷第1期页码：143-156
- 作者机构：
- 作者简介：
  
  [ "孙澄（1991- ），男，江苏常州人，信息工程大学硕士生，主要研究方向为APT检测跟踪。" ]
  [ "胡浩（1989- ），男，安徽池州人，博士，信息工程大学讲师，主要研究方向为网络态势感知。" ]
  [ "杨英杰（1971- ），男，河南郑州人，博士，信息工程大学教授，主要研究方向为信息安全。" ]
  [ "张红旗（1962- ），男，河北遵化人，信息工程大学教授、博士生导师，主要研究方向为网络安全、移动目标防御、等级保护和信息安全管理。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61902427)
- DOI：10.11959/j.issn.2096-109x.2021015
  中图分类号： TP393.08
- 网络首发：2021-02，
  
  纸质出版：2021-02-15
- 稿件说明：
移动端阅览
孙澄, 胡浩, 杨英杰, 等. 融合宏观与微观的双层威胁分析模型[J]. 网络与信息安全学报, 2021,7(1):143-156.

Cheng SUN, Hao HU, Yingjie YANG, et al. Two-layer threat analysis model integrating macro and micro[J]. Chinese Journal of Network and Information Security, 2021, 7(1): 143-156.
孙澄, 胡浩, 杨英杰, 等. 融合宏观与微观的双层威胁分析模型[J]. 网络与信息安全学报, 2021,7(1):143-156. DOI： 10.11959/j.issn.2096-109x.2021015.

Cheng SUN, Hao HU, Yingjie YANG, et al. Two-layer threat analysis model integrating macro and micro[J]. Chinese Journal of Network and Information Security, 2021, 7(1): 143-156. DOI： 10.11959/j.issn.2096-109x.2021015.

摘要

针对现有威胁分析模型无法兼顾高级安全威胁的宏观发展趋势及微观传播路径的问题，建立了一种双层威胁分析模型TL-TAM。模型上层刻画严重程度由低到高的威胁发展趋势，下层融合技术漏洞攻击、社会工程攻击及网络扫描攻击，刻画威胁传播路径。据此，提出了威胁预测分析算法。实验结果表明，模型能够对威胁传播进行多层面综合分析，并且克服了基于攻击图的威胁分析模型局限于技术漏洞攻击的缺陷，更加适用于高级安全威胁的动态跟踪分析。

Abstract

The existing threat analysis models failed to comprehensively analyze the propagation of advanced security threats integrating the threat development trend and propagation path.In order to solve the problem

a two-layer threat analysis model named TL-TAM was established.The upper layer of the model depicted the threat development trend.The lower layer depicted the threat propagation path considering social engineering and networks can.Based on the model

prediction algorithm of threat development was proposed.The experimental result shows that the model can comprehensively analyze the threat propagation at multiple levels

overcome the defect that the threat analysis model based on attack graph is limited to technical vulnerability attack

and is more suitable for dynamic tracking analysis of advanced security threats.

关键词

Keywords

references

赵志岩 , 纪小默 . 智能化网络安全威胁感知融合模型研究 [J ] . 信息网络安全 , 2020 , 20 ( 4 ): 87 - 93 .

ZHAO Z Y , JI X M . Research on the intelligent fusion model of network security situation awareness [J ] . Netinfo Security , 2020 , 20 ( 4 ): 87 - 93 .

金辉 , 张红旗 , 张传富 , 等 . 复杂网络中基于 QRD 的主动防御决策方法研究 [J ] . 信息网络安全 , 2020 , 20 ( 5 ): 72 - 82 .

JIN H , ZHANG H Q , ZHANG C F , et al . Research on active defense decision-making method based on QRD in complex network [J ] . Netinfo Security , 2020 , 20 ( 5 ): 72 - 82 .

LI M , HUANG W , WANG Y , et al . The study of APT attack stage model [C ] // 2016 IEEE/ACIS 15th International Conference on Computer and Information Science (ICIS) . 2016 .

CHEN P , DESMET L , HUYGENS C . A study on advanced persistent threats [C ] // IFIP International Conference on Communications and Multimedia Security . 2014 : 63 - 72 .

USSATH M , JAEGER D , CHENG F , et al . Advanced persistent threats:behind the scenes [C ] // 2016 Annual Conference on Information Science and Systems (CISS) . 2016 : 181 - 186 .

贺诗洁 , 黄文培 . APT 攻击详解与检测技术 [J ] . 计算机应用 , 2018 , 38 ( S2 ): 170 - 173 .

HE S J , HUANG W P . APT attacks details and detection technology [J ] . Journal of Computer Applications , 2018 , 38 ( S2 ): 170 - 173 .

HUTCHINS E M , CLOPPERT M J , AMIN R M . Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains [J ] . Leading Issues in Information Warfare ＆ Security Research , 2011 , 1 ( 1 ): 80 .

SWILER L P , PHILLIPS C . A graph-based system for network-vulnerability analysis [R ] . 1998 .

吴迪 , 连一峰 , 陈恺 , 等 . 一种基于攻击图的安全威胁识别和分析方法 [J ] . 计算机学报 , 2012 , 35 ( 9 ): 1938 - 1950 .

WU D , LIAN Y F , CHEN K , et al . A security threats identification and analysis method based on attack graph [J ] . Chinese Journal of Computers , 2012 , 35 ( 9 ): 1938 - 1950 .

WU S , ZHANG Y , CAO W , et al . Network security assessment using a semantic reasoning and graph based approach [J ] . Computers ＆ Electrical Engineering , 2017 : 96 - 109 .

WANG L , LIU A , JAJODIA S . Using attack graphs for correlating,hypothesizing,and predicting intrusion alerts [J ] . Computer communications , 2006 , 29 ( 15 ): 2917 - 2933 .

AHAMADINEJAD S H , JALILI S , ABADI M . A hybrid model for correlating alerts of known and unknown attack scenarios and updating attack graphs [J ] . Computer Networks , 2011 , 55 ( 9 ): 2221 - 2240 .

刘威歆 , 郑康锋 , 武斌 , 等 . 基于攻击图的多源告警关联分析方法 [J ] . 通信学报 , 2015 , 36 ( 9 ): 135 - 144 .

LIU W X , ZHENG K F , WU B , et al . Alert processing based on attack graph and multi-source analyzing [J ] . Journal on Communications , 2015 , 36 ( 9 ): 135 - 144 .

杨英杰 , 冷强 , 常德显 , 等 . 基于属性攻击图的网络动态威胁分析技术研究 [J ] . 电子与信息学报 , 2019 , 41 ( 8 ): 1838 - 1846 .

YANG Y J , LENG Q , CHANG D X , et al . Research on network dynamic threat analysis technology based on attribute attack graph [J ] . Technology Based on Attribute Attack Graph Journal of Electronics ＆ Information Technology , 2019 , 41 ( 8 ): 1838 - 1846 .

杨英杰 , 冷强 , 潘瑞萱 , 等 . 基于属性攻击图的动态威胁跟踪与量化分析技术研究 [J ] . 电子与信息学报 , 2019 , 41 ( 9 ): 2172 - 2179 .

YANG Y J , LENG Q , PAN R X , et al . Research on dynamic threat tracking and quantitative analysis [J ] . Technology Based on Attribute Attack Graph Journal of Electronics ＆ Information Technology , 2019 , 41 ( 9 ): 2172 - 2179 .

胡浩 , 叶润国 , 张红旗 , 等 . 基于攻击预测的网络安全态势量化方法 [J ] . 通信学报 , 2017 , 38 ( 10 ): 122 - 134 .

HU H , YE R G , ZHANG H Q , et al . Quantitative method for network security situation based on attack prediction [J ] . Journal on Communications , 2017 , 38 ( 10 ): 122 - 134 .

樊雷 , 余江明 , 雷英杰 . 面向APT攻击的分层表示模型 [J ] . 计算机工程 , 2018 , 44 ( 8 ): 155 - 160 .

FAN L , YU J M , LEI Y J . Hierarchical representation model for APT attack [J ] . Computer Engineering , 2018 , 44 ( 8 ): 155 - 160 .

浏览量

211

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据