一种基于漏洞威胁模型的安全分析技术  

A Technology of Analyzing Security Based on Vulnerability Threats Model

作　　者：张亮[1] 朱磊明[1] 王康[1] 

机构地区：[1]解放军电子工程学院,合肥230037

出　　处：《计算机与数字工程》2008年第6期120-122,135,共4页Computer & Digital Engineering

摘　　要：如何全面、准确地分析网站面临的最大威胁成为专业信息安全公司和网站管理员的不可回避的难题。借鉴攻击图的基本思想设计漏洞威胁测试模型(VTTM),并以SQL注入漏洞为例对其进行建模,并利用两种算法分别计算网站的最大威胁值及最优测试序列。It＇ s quite a difficult problem for information security companies and web administrators to find a way to analyze the biggest threat to a website entirely and accurately. Having designed Vulnerability Threats Testing Model （VTTM） which is based on the basis of attack graph, taking SQL injection for example to construct its model and introducing two algorisms to calculate the biggest threat value and the best testing sequence respectively.

关 键 词：渗透测试 攻击图 SQL注入 贪婪算法 动态规划 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]