漏洞威胁的关联评估方法  

Vulnerability threat correlation assessment method

作　　者：谢丽霞[1] 江典盛 张利[2] 杨宏宇[1] 

机构地区：[1]中国民航大学计算机科学与技术学院,天津300300 [2]中国信息安全测评中心系统评估处,北京100085

出　　处：《计算机应用》2012年第3期679-682,共4页journal of Computer Applications

基　　金：国家自然科学基金资助项目(60776807;61179045);天津市科技计划重点项目(09JCZDJC16800);中国民航科技项目(MHRD201009;MHRD201021)

摘　　要：针对目前网络安全评估方法不能有效解决漏洞的关联性评价问题,提出一种基于漏洞间关联性的网络漏洞威胁评估方法。以攻击图为评估数据源,兼顾前序节点和后序节点的多样性,融合从前向后入(FI)方法和从后向前出(BO)方法,采用优化贝叶斯网络方法和加权平均法计算路径漏洞与主机漏洞的威胁值,得到关联环境下的漏洞量化评估结果。实验结果表明,该方法能有效弥补传统方法孤立评估漏洞的不足,能够更为有效地表达出系统的安全特性。Since the present network security assessment methods cannot evaluate vulnerability relevance effectively,a vulnerability threat assessment method based on relevance was presented.Firstly,an attack graph must be created as the source data.Secondly,by taking both pre-nodes and post-nodes diversity into consideration,integrating the methods of Forward In（FI） and Backward Out（BO）,the authors calculated the probability of vulnerability being used on multiple attack routes through optimizing calculation formulas originating from Bayesian network,then the weighted average method was utilized to evaluate the risk of certain vulnerability on a particular host,and finally the quantitative results were achieved.The experimental results show that this method can clearly and effectively describe the security features of systems.

关 键 词：漏洞 关联性 攻击图 路径评估 主机评估 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP393.08[自动化与计算机技术—计算机科学与技术]