基于攻击图的网络脆弱性分析方法  

Method Based on Attack Graph for Network Vulnerability Analysis

作　　者：苘大鹏[1] 杨武[1] 杨永田[1] 

机构地区：[1]哈尔滨工程大学信息安全研究中心,黑龙江哈尔滨150001

出　　处：《南京理工大学学报》2008年第4期416-419,共4页Journal of Nanjing University of Science and Technology

基　　金：国家"242"信息安全计划(2007B31);国家"863"计划(2007AA01Z473)

摘　　要：传统的攻击图分析方法在计算攻击目标可达概率时没有考虑攻击者的行为特征,降低了分析结果的准确性。为了解决这个问题,首先对全局攻击图模型进行了介绍,然后提出了一种基于全局攻击图的网络脆弱性分析方法。该方法利用网络状态间的转移概率描述攻击者的行为特征。在此基础上,计算攻击目标的可达概率。实验结果表明:安全管理人员利用该方法能够从全局角度分析网络的脆弱性,获得的分析结果更加客观、准确。Because the behavior characteristics of attackers are not considered in the traditional attack graph analysis, the accuracy of the analysis results is decreased. To solve this problem, a global attack graph model is presented, and a method for analyzing network vulnerabilities based on global attack graphs is proposed. The transition probability of network states is used to describe the behavior characteristics of attackers. The reachablity of attack targets is calculated. The experimental results show that the proposed method can analyze the overall vulnerabilities of networks, and the analysis results are more objective and accurate.

关 键 词：网络安全 安全评估 脆弱性分析 攻击图 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]