一种基于攻击树的4G网络安全风险评估方法  

A Method of 4G Network Security Risk Assessment Based on Attack Tree

作　　者：王赛娥 刘彩霞 刘树新 柏溢 WANG Saie;LIU Caixia;LIU Shuxin;BAI Yi(People’s Liberation Army Strategic Support Force Information Engineering University,Zhengzhou 450001,China)

机构地区：[1]中国人民解放军战略支援部队信息工程大学,郑州450001

出　　处：《计算机工程》2021年第3期139-146,154,共9页Computer Engineering

基　　金：国家自然科学基金青年基金项目(61803384)。

摘　　要：针对4G网络的安全风险评估问题,提出一种基于攻击树模型的评估方法,以分析网络的风险状况,评估系统的风险程度和安全等级。对4G网络的安全威胁进行分类,通过梳理攻击行为和分解攻击流程来构造攻击树模型,利用多属性理论赋予叶节点3个安全属性并通过等级评分进行量化,结合模糊层次分析法和模糊矩阵计算叶节点的风险概率,根据节点间的依赖关系得到根节点的风险概率,最终得到4G网络的安全风险等级。实验结果表明,该方法能够准确评估4G网络的风险因素,预测可能的攻击路径,为安全防护策略选择提供依据。This paper proposes a security risk evaluation method for 4G network based on attack tree model,which can be used to analyze the risks faced by the network and evaluate the risk level and security level of the system.The security risks of 4G network are categorized,and the attack tree model is constructed by sorting out the attack behavior and decomposing the attack flow.Then,the multi-attribute theory is used to give three security attributes to the leaf nodes and quantify them by scoring the level.The risk probability of the leaf node is calculated by combining Fuzzy Analytical Hierarchy Process(FAHP)and the fuzzy matrix.The risk probability of the root node is obtained according to the dependency between nodes.Experimental results show that the proposed method can accurately evaluate the risk factors of 4G network,predict the possible attack paths,and assist in the selection of security protection strategies.

关 键 词：4G网络 安全威胁 攻击树模型 风险评估 模糊层次分析法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]