Host security assessment method based on attack graph

Hongyu YANG; Haihang YUAN; Liang ZHANG

doi:10.11959/j.issn.1000-436x.2022030

您当前的位置：

首页 >

文章列表页 >

Host security assessment method based on attack graph

Papers | 更新时间：2024-06-05

- Host security assessment method based on attack graph
- Journal on Communications Vol. 43, Issue 2, Pages: 89-99(2022)
- 作者机构：
  
  1. 中国民航大学安全科学与工程学院，天津 300300
  2. 中国民航大学计算机科学与技术学院，天津 300300
  3. 亚利桑那大学信息学院，图森AZ 85721
- 作者简介：
- 基金信息：
  
  The Civil Aviation Joint Research Fund Project of National Natural Science Foundation of China(U1833107)
- DOI：10.11959/j.issn.1000-436x.2022030
  CLC： TP393.08
- Online First：2022-02，
  
  Published：25 February 2022
- 稿件说明：
移动端阅览
Hongyu YANG, Haihang YUAN, Liang ZHANG. Host security assessment method based on attack graph[J]. Journal on Communications, 2022, 43(2): 89-99.
DOI：

Hongyu YANG, Haihang YUAN, Liang ZHANG. Host security assessment method based on attack graph[J]. Journal on Communications, 2022, 43(2): 89-99. DOI： 10.11959/j.issn.1000-436x.2022030.

摘要

针对目前主机安全评估方法中无法准确计算主机安全值，忽略攻击图中主机关联性等问题，提出一种基于攻击图的主机安全评估方法。首先，生成主机攻击图，从漏洞自身、时间、环境和操作系统可利用性4个角度量化原子攻击概率并计算主机攻击概率。然后，根据专家先验评估和相关性定权法计算主机资产重要性，依据攻击图中主机间的关联关系计算主机的拓扑结构重要性。最后，依据主机漏洞影响值、主机重要性和主机攻击概率计算主机安全值。实验结果表明，所提方法得到的主机重要性和安全值符合真实网络情况，能够更全面准确地反映主机的安全状况；所提方法得到的主机安全值标准差为 0.078，大于其他方法得到的安全值标准差，表明所提方法得到的安全值离散程度更大，更易于区分安全等级和后续的风险处置优先级。

Abstract

In order to solve the problems of inaccurate calculation of host security value and ignoring host correlation in attack graph

a host security assessment method based on attack graph was proposed.First

the host attack graph was generated to quantify the atomic attack probability and the attack probability of the host was calculated from four perspectives

such as vulnerability itself

time

environment and operational system availability.Then

the host assets importance was calculated according to expert transcendental evaluation and correlation weighting method

and the topology importance of host was calculated according to the association relationship between hosts in attack graph.Finally

the host security value was calculated according to the impact value of host vulnerability

host importance and host attack probability.The experimental results show that the importance and security value of the proposed method accord with the real network situation and can reflect the security condition of the host more completely and accurately.The standard deviation of host safety value obtained by the proposed method is 0.078

which is larger than that obtained by other methods

indicating that the safety value obtained by the proposed method is more discrete and easier to distinguish the safety level from the subsequent risk disposal priority.

关键词

Keywords

references

吴晨思 , 谢卫强 , 姬逸潇 , 等 . 网络系统安全度量综述 [J ] . 通信学报 , 2019 , 40 ( 6 ): 14 - 31 .

WU C S , XIE W Q , JI Y X , et al . Survey on network system security metrics [J ] . Journal on Communications , 2019 , 40 ( 6 ): 14 - 31 .

丁绍虎 , 齐宁 , 郭义伟 . 基于 M-FlipIt 博弈模型的拟态防御策略评估 [J ] . 通信学报 , 2020 , 41 ( 7 ): 186 - 194 .

DING S H , QI N , GUO Y W . Evaluation of mimic defense strategy based on M-FlipIt game model [J ] . Journal on Communications , 2020 , 41 ( 7 ): 186 - 194 .

罗智勇 , 杨旭 , 刘嘉辉 , 等 . 基于贝叶斯攻击图的网络入侵意图分析模型 [J ] . 通信学报 , 2020 , 41 ( 9 ): 160 - 169 .

LUO Z Y , YANG X , LIU J H , et al . Network intrusion intention analysis model based on Bayesian attack graph [J ] . Journal on Communications , 2020 , 41 ( 9 ): 160 - 169 .

席荣荣 , 云晓春 , 张永铮 . 基于环境属性的网络威胁态势量化评估方法 [J ] . 软件学报 , 2015 , 26 ( 7 ): 1638 - 1649 .

XI R R , YUN X C , ZHANG Y Z . Quantitative threat situational assessment based on contextual information [J ] . Journal of Software , 2015 , 26 ( 7 ): 1638 - 1649 .

SHAN C , GAO J , HU C Z , et al . Network risk assessment method based on asset correlation graph [C ] // Trusted Computing and Information Security . Berlin:Springer , 2019 : 65 - 83 .

POKHREL N R , TSOKOS C P . Cybersecurity:a stochastic predictive model to determine overall network security risk using Markovian process [J ] . Journal of Information Security , 2017 , 8 ( 2 ): 91 - 105 .

李欢 . 基于贝叶斯网络攻击图的动态风险评估方法研究 [D ] . 秦皇岛:燕山大学 , 2019 .

LI H . Research on dynamic risk assessment method based on Bayesian network attack diagram [D ] . Qinhuangdao:Yanshan University , 2019 .

HU H , ZHANG H Q , YANG Y J . Security risk situation quantification method based on threat prediction for multimedia communication network [J ] . Multimedia Tools and Applications , 2018 , 77 ( 16 ): 21693 - 21723 .

HU W H , ZHANG L , LIU X Y , et al . Research on automatic generation and analysis technology of network attack graph [C ] // Proceedings of 2020 IEEE 6th Intl Conference on Big Data Security on Cloud (BigDataSecurity),IEEE Intl Conference on High Performance and Smart Computing,(HPSC) and IEEE Intl Conference on Intelligent Data and Security . Piscataway:IEEE Press , 2020 : 133 - 139 .

WANG W R , SHI F , ZHANG M , et al . A vulnerability risk assessment method based on heterogeneous information network [J ] . IEEE Access , 2020 , 8 : 148315 - 148330 .

SUN X Y , DAI J , LIU P , et al . Using Bayesian networks for probabilistic identification of zero-day attack paths [J ] . IEEE Transactions on Information Forensics and Security , 2018 , 13 ( 10 ): 2506 - 2521 .

李鑫 . 基于攻击图的网络安全评估技术研究与实现 [D ] . 北京:北京邮电大学 , 2017 .

LI X . Research and implementation of network security assessment technology based on attack graph [D ] . Beijing:Beijing University of Posts and Telecommunications , 2017 .

RUOHONEN J . A look at the time delays in CVSS vulnerability scoring [J ] . Applied Computing and Informatics , 2019 , 15 ( 2 ): 129 - 135 .

FREI S , MAY M , FIEDLER U , et al . Large-scale vulnerability analysis [C ] // Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense-LSAD’06 . New York:ACM Press , 2006 : 131 - 138 .

葛海慧 . 信息安全风险多维动态管理模型及相关评估方法研究 [D ] . 北京:北京邮电大学 , 2015 .

GE H H . Research on the multidimensional and dynamic information security risk management model and the related assessment algorithms [D ] . Beijing:Beijing University of Posts and Telecommunications , 2015 .

WANG R Y , GAO L , SUN Q , et al . An improved CVSS-based vulnerability scoring mechanism [C ] // Proceedings of 2011 Third International Conference on Multimedia Information Networking and Security . Piscataway:IEEE Press , 2011 : 352 - 355 .

国家质量监督检验检疫总局 , 中国国家标准化管理委员会 . 信息安全技术信息安全风险评估规范:GB/T 20984-2007 [S ] . 北京:中国标准出版社 , 2007 .

General Administration of Quality Supervision,Inspection and Quarantine of the People’s Republic of China , Standardization Administration of the People’s Republic of China . Information security technology-risk assessment specification for information security:GB/T 20984-2007 [S ] . Beijing:Standards Press of China , 2007 .

周爱民 , 周彩霞 , 欧阳晋焱 , 等 . 基于指标适度标准化的界面风格美综合评价模型 [J ] . 浙江大学学报(工学版) , 2020 , 54 ( 12 ): 2273 - 2285 .

ZHOU A M , ZHOU C X , OUYANG J Y , et al . Model of synthetic evaluation on interface stylistic beauty based on moderately standardized of index [J ] . Journal of Zhejiang University (Engineering Science) , 2020 , 54 ( 12 ): 2273 - 2285 .

Views

1505

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Approach to making strategies for network security enhancement based on attack graphs

Method to generate attack graphs for assessing the overall security of networks

Study of SDN intrusion intent identification algorithm based on Bayesian attack graph

Research on network attack analysis method based on attack graph of absorbing Markov chain

Network intrusion intention analysis model based on Bayesian attack graph

Related Author

YANG Wu1

MAN Da-peng1

ZHANG Bing2

SI Jia-quan1

YANG Yong-tian1

ZHOU Yuan2

Zhiyong LUO

Yu ZHANG

Related Institution

Information Security Research Center, Harbin Engineering University

National Computer Network Emergency Response Technical Team/Coordination Center of China

School of Computer Science and Technology, Harbin University of Science and Technology

School of Information Management, Beijing Information Science and Technology University

School of Cyberspace Security,PLA Information Engineering University

AI问答

⁰