基于攻击图的网络脆弱性量化评估研究  

Research of Quantitative Vulnerability Assessment Based on Attack Graphs

作　　者：陈锋[1] 张怡[1] 鲍爱华[2] 苏金树[1] 

机构地区：[1]国防科学技术大学计算机学院,湖南长沙410073 [2]国防科学技术大学信息系统与管理学院,湖南长沙410073

出　　处：《计算机工程与科学》2010年第10期8-11,19,共5页Computer Engineering & Science

基　　金：国家自然科学基金资助项目(90604006)

摘　　要：目前,网络脆弱性量化评估面临的主要挑战之一是识别网络中存在的脆弱性和它们之间的相互关系以及由此产生的潜在威胁,本文提出了一种基于属性攻击图的网络脆弱性量化评估方法。首先对属性攻击图和有效攻击路径进行了形式化定义,在此基础上提出了采用"最大可达概率"指标来度量目标网络中关键属性集合的脆弱性,并设计了最大可达概率计算算法,该算法解决了属性攻击图的含圈路径问题;为解决实际评估中原始数据缺失的问题,提出了"可信度"的概念,它能有效反映缺失数据对评估结果的影响。Attack graph is a modelbased vulnerability analysis technology. It may automatically analyze the interrelation among vulnerabilities in the network and the potential threat resulting from the vulnerabilities,which is one of problems the quantitative vulnerability assessment must solve. This paper proposes a novel quantitative vulnerability assessment method based on attributebased attack graphs. First attributebased attack graphs and valid attack paths are formally described, and maximal reachable probability is adopted to measure the vulnerability of the key attribute set of the target network. An algorithm for computing maximal reachable probability is presented to solve the problem of loop attack paths. Finally, because some data may not be obtained in practical assessment,the conception of creditability is introduced to measure the impact of absent data on the result.

关 键 词：攻击图 有效攻击路径 最大可达概率 可信度 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]