Minimum-cost network hardening algorithm based on stochastic loose optimize strategy

Guang-sheng ZHAO; Qing-feng CHENG; Yong-lin SUN

doi:10.11959/j.issn.1000-436x.2015027

您当前的位置：

首页 >

文章列表页 >

Minimum-cost network hardening algorithm based on stochastic loose optimize strategy

Academic communication | 更新时间：2024-06-05

- Minimum-cost network hardening algorithm based on stochastic loose optimize strategy
- Journal on Communications Vol. 36, Issue 1, Pages: 237-245(2015)
- 作者机构：
  
  1. 解放军外国语学院语言工程系，河南洛阳 471003
  2. 国防科技大学计算机学院，湖南长沙 410073
- 作者简介：
- 基金信息：
  
  The National High Technology Research and Development Program of China (863 Program)(2009AA01Z432);The National Natural Science Foundation of China(60873215);The National Natural Science Foundation of China(61003303);Foundation of Science and Technology on Information Assurance Laboratory(KJ-13-109)
- DOI：10.11959/j.issn.1000-436x.2015027
  CLC： TN915.08
- Online First：2015-01，
  
  Published：25 January 2015
- 稿件说明：
移动端阅览
Guang-sheng ZHAO, Qing-feng CHENG, Yong-lin SUN. Minimum-cost network hardening algorithm based on stochastic loose optimize strategy[J]. Journal on Communications, 2015, 36(1): 237-245.
DOI：

Guang-sheng ZHAO, Qing-feng CHENG, Yong-lin SUN. Minimum-cost network hardening algorithm based on stochastic loose optimize strategy[J]. Journal on Communications, 2015, 36(1): 237-245. DOI： 10.11959/j.issn.1000-436x.2015027.

摘要

为了在大规模网络中构建代价最小的脆弱性弥补方案，提出了一种基于随机松弛优选策略的网络脆弱性弥补算法 (MCNHA-SLOS)，并分析了算法的有效性。MCNHA-SLOS 是一种近似最优算法，通过在全部弥补方案空间的一系列随机松弛子空间中进行迭代计算，使近似最优弥补方案必定落入低代价弥补方案空间中。实例分析和仿真结果表明，MCNHA-SLOS具有高效、精度可控、渐近最优等特点，能够应用于大规模网络环境。

Abstract

To construst a minimum-cost network hardening (MCNH) scheme in large-scale network

a stochastic loose optimize strategy based algorithm (MCNHA-SLOS) was proposed

and its effectiveness was analyzed.MCNHA-SLOS was a near-optimal approximation algorithm

which could achieve iterative computations in the array of sparse spaces of the whole plan space

so that the near-optimal scheme must exist in the low cost plan space.Instantiation analysis and experimental results show that the MCNHA-SLOS algorithm to be efficient

precision controllable and asymptotically optimal

and thus very applicable for large-scale network.

关键词

Keywords

references

JHA S , SHEYNER O , WING J M . Two formal analyses of attack graphs [A ] . Proceedings of 15th IEEE Computer Security Foundations Workshop [C ] . 2002 .

NOEL S , JAJODIA S , O'BERRY B , JACOBS M , et al . Efficient minimum-cost network hardening via exploit dependency graphs [A ] . Proceedings of 19th Annual Computer Security Applications Conference [C ] . 2003 . 86 - 95 .

WANG L Y , NOEL S , JAJODIA S . Minimum-cost network hardening using attack graphs [J ] . Computer Communications , 2006 , 29 ( 18 ): 3812 - 3824 .

HOMER J , , et al . From Attack Graphs to Automated Configuration Management-An Iterative Approach [R ] . Kansas State University Technical Report , 2008 .

SI J Q , ZHANG B , MAN D P , et al . Approach to making strategies for network security enhancement based on attack graphs [J ] . Journal on Commurtications , 2009 , 30 ( 2 ): 123 - 128 .

CHEN F , WANG L Y , SU J S . An efficient approach to minimum-cost network hardening using attack graphs [A ] . Proceedings of the 4th International Conference on Information Assurance and Security [C ] . 2008 . 209 - 212 .

CHEN F , ZHANG Y , SU J S , et al . Two formal analyses of attack graphs [J ] . Journal of Software , 2010 , 21 ( 4 ): 838 - 848 .

CHEN F . A Hierarchical Network Security Risk Evaluation Approach Based on Multi-goal Attack Graph [D ] . National University of Defense Technology , 2008 .

ALBANESE M , JAJODIA S , NOEL S . Time-efficient and cost- effective network hardening using attack graphs [A ] . Proceedings of the 42nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) [C ] . 2012 . 1 - 12 .

DIAMAH A , MOHAMMADIA M , BALACHANDRAN B . Network security evaluation method via attack graphs and fuzzy cognitive maps [J ] . Intelligent Decision Technologies , 2012 , 16 : 433 - 440 .

SWILER L P , PHILLIPS C , ELLIS D , et al . Computer-attack graph generation tool [A ] . Proceedings of DARPA Information Survivability Conference ＆Exposition II [C ] . 2001 . 307 - 321 .

SHEYNER O , HAINES J , JHA S , et al . Automated generation and analysis of attack graphes [A ] . Proceedings of IEEE Symposium on Security and Privacy [C ] . 2002 . 273 - 284 .

SHEYNER O . Scenario Graphs and Attack Graphs [D ] . Carnegie Mellon University , 2004 .

AMMANN P , WIJESEKERA D , KAUSHIK S . Scalable,graph-based network vulnerability analysis [A ] . Proceedings of the 9th ACM Conference on Computer and Communications Security [C ] . 2002 . 217 - 224 .

LIPPMANN R P , et al . An Annotated Review of Past Papers on Attack Graphs [R ] . MIT Lincoln Laboratory , 2005 .

LIPPMANN R P , INGOLS K W , SCOTT C , et al . Evaluating and Strengthening Enterprise Network Security Using Attack Graphs [R ] . ESC-TR-2005-064,MIT Lincoln Laboratory , 2005 .

OU X M , GOVINDAVAJHALA S , APPEL A W . MulVAL:a logic-based network security analyzer [A ] . Proceedings of 14th USENIX Security Symposium [C ] . 2005 , 8 .

OU X M , BOYER W F , MCQUEEN M A . A scalable approach to attack graph generation [A ] . Proceedings of 13th ACM conference on Computer and Communications Security [C ] . 2006 . 336 - 345 .

CHEN F , TU R , ZHANG Y , et al . Two scalable approaches to analyzing network security using compact attack graphs [A ] . Proceedings of International Symposium on Information Engineering and Electronic Commerce [C ] . 2009 . 90 - 94 .

CHEN F , SUN J S , HAN W B . AI planning-based approach of attack graph generation [J ] . Journal of PLA University of Science and Technology , 2008 , 9 ( 5 ): 460 - 465 .

MAN D P , ZHOU Y , YANG W , et al . Method to generate attack graphs for assessing the overall security of networks [J ] . Journal on Commurtications , 2009 , 30 ( 3 ): 1 - 5 .

HOMER J , VARIKUTI A , OU XM , et al . Improving attack graph visualization through data reduction and attack grouping [A ] . Proceedings of 5th International Workshop on Visualization for Cyber Security [C ] . 2008 . 68 - 79 .

HARBORT Z , LOUTHAN G , HALE J , et al . Techniques for attack graph visualization and interaction [A ] . Proceedings of the Seventh Annual Workshop on Cyber Security and Information Intelligence Research [C ] . 2011 .

ALHOMIDI M A , REED M J . Attack graphs representations [A ] . Proceedings of 4th Computer Science and Electronic Engineering Conference (CEEC) [C ] . 2012 . 83 - 88 .

Views

1652

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Study of SDN intrusion intent identification algorithm based on Bayesian attack graph

Research on network attack analysis method based on attack graph of absorbing Markov chain

Host security assessment method based on attack graph

Network intrusion intention analysis model based on Bayesian attack graph

Survey on application of attack graph technology

Related Author

Zhiyong LUO

Yu ZHANG

Qing WANG

Weiwei SONG

Molan LONG

Haiyan KANG

Hongyu YANG

Haihang YUAN

Related Institution

School of Computer Science and Technology, Harbin University of Science and Technology

School of Information Management, Beijing Information Science and Technology University

College of Safety Science and Engineering, Civil Aviation University of China

College of Computer Science and Technology, Civil Aviation University of China

College of Information, University of Arizona

AI问答

⁰