基于状态攻防图模型的网络安全防御策略生成方法  

Defense strategy generation method for network security based on state attack-defense graph

作　　者：刘刚[1] 李千目[1] 张宏[1] 

机构地区：[1]南京理工大学计算机科学与工程学院,南京210094

出　　处：《计算机应用》2013年第A01期121-125,共5页journal of Computer Applications

基　　金：国家自然科学基金资助项目(60903027);江苏省自然科学重大研究项目(BK2011023);江苏省自然科学基金资助项目(BK2011370);航天创新基金资助项目(CALT201102);连云港工业攻关科技项目(CG1124);中国博士后基金资助项目(2012M521089)

摘　　要：为了减少网络的安全风险,针对网络攻击层面的风险管理需求,从攻击者和防御者的角度设计了一种网络安全防御策略生成方法。该方法根据网络的拓扑信息、节点的可达关系和脆弱性信息,生成网络状态攻防图,进一步计算状态攻防图中各原子攻击成功的概率和危害指数,从而得出所有可能的成功攻击路径概率和危害指数;再结合脆弱点的防控措施,生成防御策略。并通过一个典型的网络实例分析了该方法在网络安全主动防御中的应用,同时验证了其可行性和有效性。In order to reduce the network security risk, the authors designed a defense strategy generation method for network security based on State Attack-Defense Graph （SADG） in the view of the attacker and the defender to meet the requirements of risk management of network attack aspect. Firstly, according to the network＇ s vulnerability information, the proposed method generated the network SADG, calculated the successful probability and impact index of each atomic attack and got the successful probability and impact index of all possible attack paths. And then, the method generated defense strategy with the prevention and control measures of vulnerability. Finally, the proposed method was applied into a typical network scenario which adopted the active defense for network security, and verified the feasibility and effectiveness of the proposed method.

关 键 词：状态攻防图 防御策略 信息安全 网络安全 风险管理 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]