基于贝叶斯网络的攻击图方法在网络安全评估中的应用  

Application of attack graph method based on bayesian network in network security assessment

作　　者：刘胜娃 高翔[2] 王敏[3] 

机构地区：[1]长庆钻井公司,陕西西安710018 [2]西北工业大学,陕西西安710072 [3]空军工程大学,陕西西安710068

出　　处：《现代电子技术》2013年第9期84-87,共4页Modern Electronics Technique

基　　金：国家科技支撑计划项目(2012BAB15B01)

摘　　要：随着网络的发展,网络安全评估成为网络维护中不可或缺的组成部分,尽管攻击图、攻击树和其他技术已被广泛地用于预测所有漏洞,但仍然缺少一个有效的手段来量化地分析网络安全。介绍一个新方法构建一个带标记的攻击图,图中的每个节点都被标注了一个概率值用来说明该漏洞被成功利用的可能性,每条边都代表了漏洞间的关联。采用通用漏洞评分系统(CVSS)作为基础计算每个漏洞被利用的概率,采用贝叶斯网络计算累积的概率,并用一些典型场景评估了该方法的有效性和准确性。With the development of network, Network security assessment becomes a vital process that needs to be executed to maintain network. Although attack graph, attack tree and other technologies have been proposed to predict all vulnerabilities, there is still lack an efficient way to quantitatively analyze the network security. In this paper, a new method is proposed to construct a marked attack graph, in which each node in the attack graph is marked with a probability value to explain the likelihood of a successful exploit, and each edge represents the relationship between vulnerabilities. The common vulnerability scoring system （CVSS） was adopted as a foundation to compute the probability of each vulnerability. Bayesian Network was employed to compute the accumulated probability. The efficiency and accuracy of this method are assessed with some typical cases.

关 键 词：网络安全 攻击图 贝叶斯网络 通用漏洞评分系统 

分 类 号：TN915.08[电子电信—通信与信息系统] TP393[电子电信—信息与通信工程]