一种基于目标攻击图的态势威胁评估方法  

Approach of Goal-Oriented Attack Graph-Based Threat Evaluation for Network Security

作　　者：刘威歆 郑康锋[1] 胡影[2] 武斌[1] 

机构地区：[1]北京邮电大学信息安全中心,北京100876 [2]武警北京指挥学院,北京100012

出　　处：《北京邮电大学学报》2015年第1期82-86,共5页Journal of Beijing University of Posts and Telecommunications

基　　金：国家自然科学基金青年科学基金项目(61101108)

摘　　要：针对传统安全威胁评估方法难以理解攻击渗透的相关性,且难以量化相关渗透对于网络环境的影响问题,结合攻击图渗透动作危害性、渗透相关性和主机业务重要性,提出双向威胁评估模型和计算方法,能衡量攻击的深入程度和对目标的威胁程度,最后提出了一个能应用于实时告警分析的攻击序列评估方法,并通过实验验证了所提模型的合理性和有效性.For being not falling in as final targets of attackers,the critical resources in network environments should be protected. It is vital to quantify the threat and impact during the process of multi-stage attacks. Aiming at combine threat quantification of individual attack action and significance value of hosts,as well as large amount of attack dependencies in attack graphs,a methodology for threat evaluation was proposed. The bi-directional threat evaluation presented in this article is able to compute progress attackers already,as well as the threat to goal-resources in attack graph,which can be well applied to real-time attack threat evaluation. The proposed was finally verified in experiment and simulation.

关 键 词：威胁评估 攻击图 双向威胁评估 

分 类 号：TN911.22[电子电信—通信与信息系统]