一种实时内部威胁模型建立方法  

Method for building the real time insider threat model

作　　者：张红斌[1,2] 裴庆祺[1] 马建峰[1] 

机构地区：[1]西安电子科技大学计算机网络与信息安全教育部重点实验室,陕西西安710071 [2]河北科技大学信息科学与工程学院,河北石家庄050054

出　　处：《西安电子科技大学学报》2009年第1期80-86,共7页Journal of Xidian University

基　　金：“863”项目资助(2007AA01Z429,2007AA01Z405);国家自然科学基金重点项目资助(60633020);国家自然基金资助(60573036,60702059,60503012,60803150);陕西省“13115”科技创新工程重大科技专项资助(2007ZDKG-56)

摘　　要：利用系统访问控制关系,定义了主体、客体两个偏序结构和二者间的映射关系,建立了分层映射内部威胁模型.采用层次分析法从主客体两方面对分层映射模型的内部威胁特征进行分解量化,并利用二者间的映射关系实现了对系统内部威胁的全面实时评估.克服了原有模型不能同时定量定性分析内部威胁的缺陷,提高了量化的准确性和客观性.实验结果表明,分层映射内部威胁模型能够实时、有效地评估系统的内部安全威胁,为进一步实现内部威胁感知建立了基础.Partial orders of subjects and of objects in the system and mapping relationship between them are defined by using the access control relationship. On this basis, a hierarchy-mapping based insider threat model is developed. The analytic hierarchy process is used to decompose and quantify the insider threat features of subjects and objects in the model. Then full real time assessment is obtained by using the mapping between subjects and objects. Compared with other models, this model improves the precision and objectivity of the quantization by the combination of qualitative and quantitative analysis. Experimental results show that the hierarchy-mapping based insider threat model can effectively assess the insider threat in real-time and can be used to build the insider threat sense system.

关 键 词：映射 内部威胁 评估 主体 客体 

分 类 号：TN915.04[电子电信—通信与信息系统]