基于期望收益率攻击图的网络风险评估研究

刘文甫; 庞建民; 周鑫; 李男; 岳峰

doi:10.11959/j.issn.2096-109x.2022047

您当前的位置：

首页 >

文章列表页 >

基于期望收益率攻击图的网络风险评估研究

学术论文 | 更新时间：2024-06-03

- 基于期望收益率攻击图的网络风险评估研究
- Research on network risk assessment based on attack graph of expected benefits-rate
- 网络与信息安全学报 2022年8卷第4期页码：87-97
- 作者机构：
  
  1. 信息工程大学，河南郑州 450001
  2. 电子信息系统复杂电磁环境效应重点实验室，河南洛阳 471003
- 作者简介：
  
  [ "刘文甫（1986− ），男，河南卫辉人，信息工程大学博士生，主要研究方向为大数据分析、自然语言处理、信息安全" ]
  [ "庞建民（1964− ），男，河北沧州人，博士，信息工程大学教授、博士生导师，主要研究方向为数据库理论、数据挖掘、机器学习、高性能计算、信息安全" ]
  [ "周鑫（1994− ），男，辽宁沈阳人，信息工程大学博士生，主要研究方向为人工智能、漏洞挖掘、信息安全" ]
  [ "李男（1977− ），男，河北保定人，博士，信息工程大学副教授，主要研究方向为高性能计算和大数据隐私保护" ]
  [ "岳峰（1985− ），男，山西长治人，博士，信息工程大学讲师，主要研究方向为高性能计算、信息安全、大数据挖掘" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(61802433);之江实验室“先进工业互联网安全平台”项目;Zhijiang Laboratory Advanced Industrial Internet Security Platform(2018FD0ZX01)
- DOI：10.11959/j.issn.2096-109x.2022047
  中图分类号： TP309.1
- 网络首发：2022-08，
  
  纸质出版：2022-08-15
- 稿件说明：
移动端阅览
刘文甫, 庞建民, 周鑫, 等. 基于期望收益率攻击图的网络风险评估研究[J]. 网络与信息安全学报, 2022,8(4):87-97.

Wenfu LIU, Jianmin PANG, Xin ZHOU, et al. Research on network risk assessment based on attack graph of expected benefits-rate[J]. Chinese Journal of Network and Information Security, 2022, 8(4): 87-97.
刘文甫, 庞建民, 周鑫, 等. 基于期望收益率攻击图的网络风险评估研究[J]. 网络与信息安全学报, 2022,8(4):87-97. DOI： 10.11959/j.issn.2096-109x.2022047.

Wenfu LIU, Jianmin PANG, Xin ZHOU, et al. Research on network risk assessment based on attack graph of expected benefits-rate[J]. Chinese Journal of Network and Information Security, 2022, 8(4): 87-97. DOI： 10.11959/j.issn.2096-109x.2022047.

摘要

随着互联网应用和服务越来越广泛，层出不穷的网络攻击活动导致信息系统的安全面临极大的风险挑战。攻击图作为基于模型的网络安全风险分析技术，有助于发现网络节点间的脆弱性和评估被攻击的危害程度，已被证实是发现和预防网络安全问题的有效方法。攻击图主要分为状态攻击图和属性攻击图，由于状态攻击图存在状态爆炸的问题，研究者大多偏向于基于属性攻击图的网络风险评估研究。针对现有的属性攻击图研究过度依赖网络节点本身脆弱性和原子攻击本质属性进行量化分析，忽略了理性攻击者通常以攻击利益最大化来选择具体的攻击路径，提出了基于期望收益率攻击图的网络风险评估框架和攻击收益率量化模型。所提网络风险评估框架以公开的漏洞资源库、漏洞挖掘系统发现的新漏洞以及与网络攻防相关的大数据为基础数据源，以开源大数据平台为分析工具，挖掘计算攻击成本和攻击收益相关要素；借用经济学中的有关成本、收益以及收益率等概念构建原子攻击期望收益率计算模型；通过构建目标网络的属性攻击图，计算攻击路径上的原子攻击期望收益率，生成所有可能攻击路径的期望收益率列表；以期望目标为出发点，依据特定的优化策略（回溯法、贪心算法、动态规划）展开搜索，得到最大收益率的完整攻击路径，为网络风险评估提供依据。仿真实验结果表明了所提期望收益率攻击图网络风险评估方法的有效性及合理性，能够为发现和预防网络安全问题提供支撑。

Abstract

As Internet applications and services become more and more extensive

the endless network attacks lead to great risks and challenges to the security of information systems.As a model-based network security risk analysis technology

attack graph is helpful to find the vulnerability between network nodes and the harm of being attacked.It has been proved to be an effective method to find and prevent network security risks.Attack graph is mainly divided into state-based attack graph and attribute-based attack graph.Due to the problem of state explosion in state-based attack graph

most researchers prefer the attribute-based attack graph for network risk assessment.In view of the existing researches on attribute-based attack graph

they excessively rely on the vulnerability of network nodes and the essential attributes of atomic attack.However

they ignore that rational attackers usually choose specific attack paths by maximizing attack benefits.Then

a network risk assessment framework and a quantification method of attack benefits-rate based on expected benefits-rate attack graph were proposed.The network risk assessment framework took the open vulnerability resource database

the new vulnerabilities found by the vulnerability mining system and the big data related to network attack and defense as the basic data source.The network risk assessment framework also took the open source big data platform as the analysis tool to mine and calculate the elements related to attack cost and attack benefit.Using the concepts of cost

benefit and benefit-rate in economics

the calculation model of expected benefit-rate of atomic attack was constructed.By constructing the attribute-based attack graph of the target network

the expected benefit-rate of atomic attack on the attack path was calculated

and the expected benefit-rate list of all possible attack paths was generated.Furthermore

taking the expected goal as the starting point

the search was carried out according to the specific optimization strategy (backtracking method

greedy algorithm

dynamic programming).And the complete attack path with the maximum benefit-rate was obtained

which provided the basis for network risk assessment.The simulation results show the effectiveness and rationality of the proposed expected benefit-rate attack graph network risk assessment method

which can provide support for discovering and preventing network security problems.

关键词

Keywords

references

吴迪 , 冯登国 , 连一峰 , 等 . 一种给定脆弱性环境下的安全措施效用评估模型 [J ] . 软件学报 , 2012 , 23 ( 7 ): 1880 - 1898 .

WU D , FENG D G , LIAN Y F , et al . Efficiency evaluation model of system security measures in the given vulnerabilities set [J ] . Journal of Software . 2012 , 23 ( 7 ): 1880 - 1898 .

MAIO F D , MASCHERONA Z E . Risk analysis of cyber-physical systems by GTST-MLD [J ] . IEEE Systems Journal , 2020 , 14 ( 1 ): 1333 - 1340 .

LEE J , MOON D , KIM I , et al . A semantic approach to improving machine readability of a large-scale attack graph [J ] . The Journal of Supercomputing , 2018 .

SCARFONE K , MELL P . An analysis of CVSS version 2 vulnerability scoring [J ] . IEEE Computer Society , 2009 .

KERAMATI M , AKBARI A . CVSS-based security metrics for quantitative analysis of attack graphs [C ] // 2013 3th International Conference on Computer and Knowledge Engineering (ICCKE) . 2013 .

KHOUZANI M , LIU Z , MALACARIA P . Scalable min-max multi-objective cyber-security optimisation over probabilistic attack graphs [J ] . European Journal of Operational Research , 2019 .

LIU X G . A network attack path prediction method using attack graph [J ] . Journal of Ambient Intelligence and Humanized Computing , 2020 ,( 1 ): 1 - 8 .

ZANG T , GAO S , LIU B , et al . Integrated fault propagation model based vulnerability assessment of the electrical cyber-physical system under cyber attacks [J ] . Reliability Engineering ＆ System Safety , 2019 , 189 ( SEP. ): 232 - 241 .

OBERT J , CHAVEZ A . Graph theory and classifying security events in grid security gateways [J ] . International Journal of Semantic Computing , 2020 , 14 ( 1 ): 93 - 105 .

陈锋 , 张怡 , 苏金树 , 等 . 攻击图的两种形式化分析 [J ] . 软件学报 , 2010 , 21 ( 4 ): 838 - 848 .

CHEN F , ZHANG Y , SU J S , et al . Two formal analyses of attack graphs [J ] . Journal of Software , 2010 , 21 ( 4 ): 838 - 848 .

SHEYNER O , HAINES J , JHA S , et al . Automated generation and analysis of attack graphs [C ] // IEEE Symposium on Security ＆ Privacy . 2002 .

INGOLSK , CHU M , LIPPMANN R , et al . Modeling modern network attacks and countermeasures using attack graphs [R ] . 2009 .

马春光 , 汪诚弘 , 张东红 , 等 . 一种基于攻击意愿分析的网络风险动态评估模型 [J ] . 计算机研究与发展 , 2015 , 52 ( 9 ): 2056 - 2068 .

MA C G , WANG C H , ZHANG D H , et al . A dynamic network risk assessment model based on attacker’s inclination [J ] . Journal of Computer Research and Development . 2015 , 52 ( 9 ): 2056 - 2068 .

闫峰 . 基于攻击图的网络安全风险评估技术研究 [D ] . 长春:吉林大学 , 2014 .

YAN F . The technology research of network security risk assessment based on attacks graphs [D ] . Changchun:Jilin University , 2014 .

ZHANG S , SONG S . A novel attack graph posterior inference model based on bayesian network [J ] . Journal of Information Security , 2011 , 2 ( 1 ): 8 - 27 .

WANG L , LIU A , JAJODIA S . Using attack graphs for correlating,hypothesizing,and predicting intrusion alerts [J ] . Computer Communications , 2006 , 29 ( 15 ): 2917 - 2933 .

周余阳 , 程光 , 郭春生 . 基于贝叶斯攻击图的网络攻击面风险评估方法 [J ] . 网络与信息安全学报 , 2018 , 4 ( 6 ): 11 - 22 .

ZHOU Y Y , CHENG G , GUO C S . Risk assessment method for network attack surface based on Bayesian attack graph [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 6 ): 11 - 22 .

LALLIE H S , DEBATTISTAK , BAL J . Evaluating practitioner cyber-security attack graph configuration preferences [J ] . Computers ＆ Security , 2018 , 79 : 117 - 131 .

LIN P , CHEN Y . Dynamic network security situation prediction based on bayesian attack graph and big data [C ] // 2018 IEEE 4th Information Technology and Mechatronics Engineering Conference (ITOEC) . 2018 .

浏览量

504

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于人工智能的期货交易风险评估与预警方法

基于攻击图和深度Q学习网络的自动化安全分析与渗透测试模型

基于强化学习的自动化Windows域渗透方法

面向智能汽车的信息安全漏洞评分模型

面向大规模工控网络的关键路径分析方法