基于二叉决策图的网络可达性计算  

Binary decision diagram-based network reachability computing

作　　者：朱随江[1,2] 刘宇[1,2] 刘宝旭[1] 姜政伟[1,2] 

机构地区：[1]中国科学院高能物理研究所计算中心,北京100049 [2]中国科学院研究生院,北京100080

出　　处：《计算机工程与应用》2012年第4期74-76,共3页Computer Engineering and Applications

基　　金：国家科技支撑计划资助项目(No.2009BAH52B06);中国科学院知识创新工程重要方向基金资助项目(No.YYYJ-1013);中国科学院研发实验服务基地测试基金项目(No.201004)

摘　　要：针对现有攻击图生成方法中普遍通过网络扫描获得网络可达性信息存在信息不完整、耗时长、产生网络干扰等不足,提出一种基于二叉决策图的网络可达性计算方法。该方法利用二叉决策图建模防火墙规则,通过高效的集合运算计算网络可达性。真实环境检测和模拟实验均表明该方法具有精确、耗时短、无网络干扰等优点,适用于大规模网络可达性的计算,推动了攻击图在大规模网络中的应用。Almost all of the available attack graph generating tools get network reachability through network vulnerability scanning.There are some flaws by scanning, such as incomplete information, time consuming, and side-effect on the network. It proposes a novel algorithm to compute network reachability based on binary decision diagram. The algorithm represents firewall rules by corresponding binary decision diagram, computes the reachability by efficient set operations.The algorithm is experimented and used in operational network and simulated network. The result shows that it is accurate, it consumes less time, has no side-effect on the network, and scales well, so it suits for the large-scale network reachability computing and promotes the application of attack graph in large scale network.

关 键 词：攻击图 网络扫描 网络可达性 二叉决策图 大规模网络 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]