基于多元信息融合的网络威胁动态评估  

A Dynamic Network Threat Assessment Method Based on Multi-Source Information Fusion

作　　者：彭武[1,2] 黄琦[1,2] 孟小娟[3] 陈君华[4] 

机构地区：[1]中国电子科学研究院,北京100041 [2]北京联海信息系统有限公司,北京100041 [3]中航工业北京青云航空仪表有限公司,北京100086 [4]云南民族大学云南省高校物联网应用技术重点实验室,昆明650500

出　　处：《中国电子科学研究院学报》2016年第3期250-256,共7页Journal of China Academy of Electronics and Information Technology

摘　　要：威胁评估是根据网络环境、脆弱性、攻击行为、防护措施等信息预测和评估攻击者的入侵意图和攻击行为的过程。针对网络信息的多源性和复杂性,提出了一种基于多源信息融合理论和方法的网络威胁动态评估方法。该方法在攻击图的基础上,通过分析脆弱性的利用难度来定义攻击状态之间的转换概率,应用D-S证据理论融合入侵检测系统的报警得到攻击者的攻击行为和攻击者的能力,最终预测攻击者的攻击意图以及攻击规则,并对网络威胁进行量化分析。实验验证了该方法的可行性和有效性。Threat assessment is a process of prediction and estimation intrusive intention and attack action of an attacker according to network configurations,vulnerabilities,attack actions,safeguards and so on.Because of the variety and complexity of network information,a novel network threat assessment method based on multi-source fusion theory is proposed in this paper. On the basis of attack graph,the probabilities of attack state transition is defined by the difficulty analysis of vulnerability exploit. Then applying DS evidence theory,attack actions and capabilities of the attacker are obtained from alerts of intrusion detection system. Finally,intrusive intentions and attack plans can be projected through this method. The experimental results also prove the validity of the algorithm.

关 键 词：威胁评估 攻击路径 D-S证据理论 马尔可夫过程 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]