基于攻击模式的完备攻击图自动生成方法  

Complete Attack Graph Automatic Generation Method Based on Attack Pattern

作　　者：刘龙[1] 陈秀真[1] 李建华[2] 

机构地区：[1]上海交通大学信息安全工程学院,上海200240 [2]上海交通大学电子信息与电气工程学院,上海200240

出　　处：《计算机工程》2013年第10期127-132,共6页Computer Engineering

基　　金：国家"973"计划基金资助项目(2010CB731403;2010CB731406);国家自然科学基金资助项目(61071152;61271316);"十二五"国家科技支撑计划基金资助项目(2012BAH38B04);西安交通大学制造系统工程国家重点实验室开放课题基金资助项目(sklms2012005)

摘　　要：无圈攻击图结构简单,但在构建过程中会导致部分路径缺失。为此,给出完备攻击图的概念,提出基于攻击模式的完备攻击图自动生成方法。通过分析网络防火墙的配置文件,自动获取网络连通性。完善攻击模式知识库以优化攻击者能力建模,并在此基础上设计广度优先前向搜索的攻击图生成算法,实现自动生成完备攻击图的原型。实验结果表明,该方法的自动化程度高、时间消耗少,可应用于大型网络。As the generation of attack graph without loops leads to missing of attack paths, this paper puts forward the concept of complete attack graph and builds its automatic generation method. It obtains the network connectivity automatically by analyzing the firewall configuration files, to get rid of tedious manual input. Then the attack patterns are enriched to cover almost all network attack types and based on them, an efficient approach to complete attack graph generation is built. In the end, a model to generate complete attack graph automatically using the algorithm is built. Experimental result shows that this method has less time consumption, high degree of automation, and it can be applied to large networks.

关 键 词：网络安全 脆弱性 攻击图 网络连通性 防火墙 攻击模式 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]