基于攻击图的主机安全评估方法

杨宏宇; 袁海航; 张良

doi:10.11959/j.issn.1000-436x.2022030

您当前的位置：

首页 >

文章列表页 >

基于攻击图的主机安全评估方法

学术论文 | 更新时间：2024-06-05

- 基于攻击图的主机安全评估方法
- Host security assessment method based on attack graph
- 通信学报 2022年43卷第2期页码：89-99
- 作者机构：
  
  1. 中国民航大学安全科学与工程学院，天津 300300
  2. 中国民航大学计算机科学与技术学院，天津 300300
  3. 亚利桑那大学信息学院，图森AZ 85721
- 作者简介：
  
  [ "杨宏宇（1969-），男，吉林长春人，博士，中国民航大学教授，主要研究方向为网络与系统安全" ]
  [ "袁海航（1997-），男，山东济宁人，中国民航大学硕士生，主要研究方向为网络与系统安全" ]
  [ "张良（1987-），男，天津人，博士，亚利桑那大学博士后研究员，主要研究方向为强化学习和基于深度学习的信号处理" ]
- 基金信息：
  
  国家自然科学基金民航联合研究基金资助项目(U1833107)
- DOI：10.11959/j.issn.1000-436x.2022030
  中图分类号： TP393.08
- 网络出版日期：2022-02，
  
  纸质出版日期：2022-02-25
- 稿件说明：
移动端阅览
杨宏宇, 袁海航, 张良. 基于攻击图的主机安全评估方法[J]. 通信学报, 2022,43(2):89-99.

Hongyu YANG, Haihang YUAN, Liang ZHANG. Host security assessment method based on attack graph[J]. Journal on communications, 2022, 43(2): 89-99.
杨宏宇, 袁海航, 张良. 基于攻击图的主机安全评估方法[J]. 通信学报, 2022,43(2):89-99. DOI： 10.11959/j.issn.1000-436x.2022030.

Hongyu YANG, Haihang YUAN, Liang ZHANG. Host security assessment method based on attack graph[J]. Journal on communications, 2022, 43(2): 89-99. DOI： 10.11959/j.issn.1000-436x.2022030.

摘要

针对目前主机安全评估方法中无法准确计算主机安全值，忽略攻击图中主机关联性等问题，提出一种基于攻击图的主机安全评估方法。首先，生成主机攻击图，从漏洞自身、时间、环境和操作系统可利用性4个角度量化原子攻击概率并计算主机攻击概率。然后，根据专家先验评估和相关性定权法计算主机资产重要性，依据攻击图中主机间的关联关系计算主机的拓扑结构重要性。最后，依据主机漏洞影响值、主机重要性和主机攻击概率计算主机安全值。实验结果表明，所提方法得到的主机重要性和安全值符合真实网络情况，能够更全面准确地反映主机的安全状况；所提方法得到的主机安全值标准差为 0.078，大于其他方法得到的安全值标准差，表明所提方法得到的安全值离散程度更大，更易于区分安全等级和后续的风险处置优先级。

Abstract

In order to solve the problems of inaccurate calculation of host security value and ignoring host correlation in attack graph

a host security assessment method based on attack graph was proposed.First

the host attack graph was generated to quantify the atomic attack probability and the attack probability of the host was calculated from four perspectives

such as vulnerability itself

time

environment and operational system availability.Then

the host assets importance was calculated according to expert transcendental evaluation and correlation weighting method

and the topology importance of host was calculated according to the association relationship between hosts in attack graph.Finally

the host security value was calculated according to the impact value of host vulnerability

host importance and host attack probability.The experimental results show that the importance and security value of the proposed method accord with the real network situation and can reflect the security condition of the host more completely and accurately.The standard deviation of host safety value obtained by the proposed method is 0.078

which is larger than that obtained by other methods

indicating that the safety value obtained by the proposed method is more discrete and easier to distinguish the safety level from the subsequent risk disposal priority.

关键词

Keywords

references

吴晨思 , 谢卫强 , 姬逸潇 , 等 . 网络系统安全度量综述 [J ] . 通信学报 , 2019 , 40 ( 6 ): 14 - 31 .

WU C S , XIE W Q , JI Y X , et al . Survey on network system security metrics [J ] . Journal on Communications , 2019 , 40 ( 6 ): 14 - 31 .

丁绍虎 , 齐宁 , 郭义伟 . 基于 M-FlipIt 博弈模型的拟态防御策略评估 [J ] . 通信学报 , 2020 , 41 ( 7 ): 186 - 194 .

DING S H , QI N , GUO Y W . Evaluation of mimic defense strategy based on M-FlipIt game model [J ] . Journal on Communications , 2020 , 41 ( 7 ): 186 - 194 .

罗智勇 , 杨旭 , 刘嘉辉 , 等 . 基于贝叶斯攻击图的网络入侵意图分析模型 [J ] . 通信学报 , 2020 , 41 ( 9 ): 160 - 169 .

LUO Z Y , YANG X , LIU J H , et al . Network intrusion intention analysis model based on Bayesian attack graph [J ] . Journal on Communications , 2020 , 41 ( 9 ): 160 - 169 .

席荣荣 , 云晓春 , 张永铮 . 基于环境属性的网络威胁态势量化评估方法 [J ] . 软件学报 , 2015 , 26 ( 7 ): 1638 - 1649 .

XI R R , YUN X C , ZHANG Y Z . Quantitative threat situational assessment based on contextual information [J ] . Journal of Software , 2015 , 26 ( 7 ): 1638 - 1649 .

SHAN C , GAO J , HU C Z , et al . Network risk assessment method based on asset correlation graph [C ] // Trusted Computing and Information Security . Berlin:Springer , 2019 : 65 - 83 .

POKHREL N R , TSOKOS C P . Cybersecurity:a stochastic predictive model to determine overall network security risk using Markovian process [J ] . Journal of Information Security , 2017 , 8 ( 2 ): 91 - 105 .

李欢 . 基于贝叶斯网络攻击图的动态风险评估方法研究 [D ] . 秦皇岛:燕山大学 , 2019 .

LI H . Research on dynamic risk assessment method based on Bayesian network attack diagram [D ] . Qinhuangdao:Yanshan University , 2019 .

HU H , ZHANG H Q , YANG Y J . Security risk situation quantification method based on threat prediction for multimedia communication network [J ] . Multimedia Tools and Applications , 2018 , 77 ( 16 ): 21693 - 21723 .

HU W H , ZHANG L , LIU X Y , et al . Research on automatic generation and analysis technology of network attack graph [C ] // Proceedings of 2020 IEEE 6th Intl Conference on Big Data Security on Cloud (BigDataSecurity),IEEE Intl Conference on High Performance and Smart Computing,(HPSC) and IEEE Intl Conference on Intelligent Data and Security . Piscataway:IEEE Press , 2020 : 133 - 139 .

WANG W R , SHI F , ZHANG M , et al . A vulnerability risk assessment method based on heterogeneous information network [J ] . IEEE Access , 2020 , 8 : 148315 - 148330 .

SUN X Y , DAI J , LIU P , et al . Using Bayesian networks for probabilistic identification of zero-day attack paths [J ] . IEEE Transactions on Information Forensics and Security , 2018 , 13 ( 10 ): 2506 - 2521 .

李鑫 . 基于攻击图的网络安全评估技术研究与实现 [D ] . 北京:北京邮电大学 , 2017 .

LI X . Research and implementation of network security assessment technology based on attack graph [D ] . Beijing:Beijing University of Posts and Telecommunications , 2017 .

RUOHONEN J . A look at the time delays in CVSS vulnerability scoring [J ] . Applied Computing and Informatics , 2019 , 15 ( 2 ): 129 - 135 .

FREI S , MAY M , FIEDLER U , et al . Large-scale vulnerability analysis [C ] // Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense-LSAD’06 . New York:ACM Press , 2006 : 131 - 138 .

葛海慧 . 信息安全风险多维动态管理模型及相关评估方法研究 [D ] . 北京:北京邮电大学 , 2015 .

GE H H . Research on the multidimensional and dynamic information security risk management model and the related assessment algorithms [D ] . Beijing:Beijing University of Posts and Telecommunications , 2015 .

WANG R Y , GAO L , SUN Q , et al . An improved CVSS-based vulnerability scoring mechanism [C ] // Proceedings of 2011 Third International Conference on Multimedia Information Networking and Security . Piscataway:IEEE Press , 2011 : 352 - 355 .

国家质量监督检验检疫总局 , 中国国家标准化管理委员会 . 信息安全技术信息安全风险评估规范:GB/T 20984-2007 [S ] . 北京:中国标准出版社 , 2007 .

General Administration of Quality Supervision,Inspection and Quarantine of the People’s Republic of China , Standardization Administration of the People’s Republic of China . Information security technology-risk assessment specification for information security:GB/T 20984-2007 [S ] . Beijing:Standards Press of China , 2007 .

周爱民 , 周彩霞 , 欧阳晋焱 , 等 . 基于指标适度标准化的界面风格美综合评价模型 [J ] . 浙江大学学报(工学版) , 2020 , 54 ( 12 ): 2273 - 2285 .

ZHOU A M , ZHOU C X , OUYANG J Y , et al . Model of synthetic evaluation on interface stylistic beauty based on moderately standardized of index [J ] . Journal of Zhejiang University (Engineering Science) , 2020 , 54 ( 12 ): 2273 - 2285 .

浏览量

973

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于攻击图的网络安全性增强策略制定方法

用于评估网络整体安全性的攻击图生成方法

基于贝叶斯攻击图的SDN入侵意图识别算法的研究

基于吸收马尔可夫链攻击图的网络攻击分析方法研究

基于贝叶斯攻击图的网络入侵意图分析模型