反应式容侵系统入侵预测的混合式贝叶斯网络方法  

Hybrid bayesian network method for predicting intrusion in reactive intrusion tolerance system

作　　者：王良民[1] 马建峰[2] 

机构地区：[1]东南大学计算机科学与工程学院 [2]西安电子科技大学计算机网络与信息安全教育部重点实验室,西安710071

出　　处：《中国工程科学》2008年第8期87-96,共10页Strategic Study of CAE

基　　金：国家自然科学基金资助项目(60703115,60503012,90604003);江苏省自然科学基金资助项目(BK2007560,BK2007708);国家博士后科学基金(20070420955);江苏省博士后科研资助计划(0702003B);江苏大学高级人才科研启动经费(07JDG080)

摘　　要：为解决反应式容忍入侵系统中的入侵预测问题,提出了新的混合式贝叶斯网络方法。该方法中,提出了一种基于系统安全状态的入侵模型,以攻击者能力上升的过程来描述入侵,关注入侵对系统的影响,适合于反应式容侵系统根据当前状态选择合适的响应机制。提出了基于入侵模型的混合式贝叶斯网络(HyBN,hybrid bayesian network)模型,将入侵模型中攻击行为和系统安全状态节点分离为攻击层和状态层两个网络层次,两层间使用收敛连接,而两层内部的节点间使用连续连接。在特定的信度更新算法的支持下,实验说明该贝叶斯网络方法用于入侵预测的有效性,比较说明HyBN方法的优点。To solve the open problem of predicting intrusion in Reactive Intrusion Tolerance System, a hybrid Bayesian network method is presented in this paper. Firstly, an intrusion model is presented, which pays its emphasis on the influence of the intrusion upon the system and describes the intrusion as the state transition process of the attackers＇ capability. The intrusion model is appropriate to trig the reactive intrusion tolerance system. We proposed the constructing algorithm and the proof of its feasibility. Secondly, a hybrid Bayesian network model based on this intrusion model is presented to show the casual relation of the attack behavior and secure state. The model is divided into two layers： attack behavior layer and secure state layer, in which the attack edges and state nodes of intrusion model are used as nodes in behavior layer and state layer respectively. In this hybrid Bayesian network model, the connections of the same layer are continuous, but that of the different layer are converge. The algorithm for computing the joint probability distribution of the hybrid Bayesian network is presented. In the end, the efficiency of the intrusion model and hybrid Bayesian network in predicting intrusion is shown by the experiment with our belief propagation algorithm, and the advantages of this predicting method over the related work are shown by analysis and comparisons.

关 键 词：容忍入侵 警报关联 入侵模型 入侵预测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]