用于评估网络整体安全性的攻击图生成方法  

Method to generate attack graphs for assessing the overall security of networks

作　　者：苘大鹏[1] 周渊[2] 杨武[1] 杨永田[1] 

机构地区：[1]哈尔滨工程大学信息安全研究中心,黑龙江哈尔滨150001 [2]国家计算机网络应急技术处理协调中心,北京100029

出　　处：《通信学报》2009年第3期1-5,共5页Journal on Communications

基　　金：国家重点基础研究发展计划(“973”计划)基金资助项目(2007CB311100);国家高技术研究发展计划(“863”计划)基金资助项目(2007AA01Z473)~~

摘　　要：为了评估网络的整体安全性,提出了一种新的攻击图生成方法。该方法采用正向、广度优先的策略搜索网络弱点间的依赖关系。利用限制攻击步骤数和状态节点可达性的策略来解决攻击图生成过程中存在的状态爆炸问题。实验结果表明,利用该方法生成的攻击图能够用于评估网络的整体安全性,采用的限制策略可以有效地去除攻击图中的冗余节点和边,并且降低了攻击图生成时的系统资源消耗。In order to evaluate the overall security of networks, a new method for generating attack graphs was proposed. The method used breadth-first algorithm to search the dependence of network vulnerabilities. To solve the state explosion problem, the strategies that limited the number of attack steps and the reachability of state nodes were adopted in gener- ating attack graphs. The experimental results show that the generated attack graphs can help security administrators to evaluate the overall security of networks, and the adopted optimization strategies are effective to remove redundant edges and nodes in attack graphs and decrease the system overhead during generating attack graphs.

关 键 词：网络安全 安全评估 脆弱性分析 攻击图 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]