ISSN 1000-1239 CN 11-1777/TP

计算机研究与发展 ›› 2015, Vol. 52 ›› Issue (9): 2056-2068.doi: 10.7544/issn1000-1239.2015.20140177

• 信息安全 • 上一篇    下一篇

一种基于攻击意愿分析的网络风险动态评估模型

马春光,汪诚弘,张东红,李迎涛   

  1. (哈尔滨工程大学计算机科学与技术学院 哈尔滨 150001) (machunguang@hrbeu.edu.cn)
  • 出版日期: 2015-09-01
  • 基金资助: 
    基金项目:国家自然科学基金项目(61170241,61472097);黑龙江省自然科学基金项目(F201229);高等学校博士学科点专项科研基金项目(20132304110017)

A Dynamic Network Risk Assessment Model Based on Attacker’s Inclination

Ma Chunguang, Wang Chenghong, Zhang Donghong, Li Yingtao   

  1. (College of Computer Science and Technology, Harbin Engineering University, Harbin 150001)
  • Online: 2015-09-01

摘要: 针对目前利用攻击图进行风险评估时,存在过于依赖已知漏洞知识库、仅仅利用原子攻击本质属性进行量化分析而没有很好地关联攻击者主观的攻击意愿等问题,提出了一种基于攻击者攻击意愿分析的动态风险评估模型.通过融合已知威胁和潜在威胁构建原子攻击库,分析在系统网络环境下不同时期攻击者所面临的攻击压力,量化攻击者决策时的攻击意愿,将攻击意愿和原子攻击本身的攻击性质加入到贝叶斯网络攻击图的动态推理模型中.实验证明了该模型的合理性,并且该系统更适合于实际网络环境下的实时风险评估.

关键词: 贝叶斯攻击图, 攻击压力, 攻击意愿, 潜在威胁, 风险评估

Abstract: This article proposes a new dynamic network risk analysis model based on attackers’ inclination in order to solve some problems of the traditional risk analysis method based on attack graph. Traditional attack graph based on risk assessment method relies highly on the known vulnerability database and only analyzes the atomic attacks’ attribute regardless of the relationship between attack strategies and attackers’ inclination. In our model we take both the existing vulnerabilities and unknown threatens into consideration, then evaluate the attackers pressures during different attack periods so that we quantize the attackers’ inclination dynamically under the network environment. Then, we add the attackers’ inclination factors and atomic attack attributes into graph based risk assessment model, and we create a new type of attack graph using attackers’ inclination factors. Finally we set up a dynamic risk assessment method by using Bayesian reasoning engine. We convert our static attack to the dynamic Bayesian attack graph, and use the posterior probability computed by Bayesian reasoning engine to realize the dynamic risk assessment. We establish a real-world experiment environment to simulate our dynamic risk assessment model based on attackers’ inclination and validate its function. Experimental results demonstrate the rationality of this model, and prove that this system is more suitable for real-time risk assignment under the actual network environment.

Key words: Bayesian attack graph, attack pressure, attacker’s inclination, potential threats, risk assessment

中图分类号: