一种面向攻击预测的马尔可夫的可转移信度模型  

A MARKOV TRANSFERABLE RELIABILITY MODEL FOR ATTACK PREDICTION

作　　者：廖信海 谢建国 Liao Xinhai;Xie Jianguo(School of Information Science and Technology,Guangdong University of Foreign Studies,Guangzhou 510000,Guangdong,China)

机构地区：[1]广东外语外贸大学信息科学与技术学院,广东广州510000

出　　处：《计算机应用与软件》2025年第3期348-358,共11页Computer Applications and Software

基　　金：国家自然科学基金项目(61976061,61702121)。

摘　　要：越来越多的高级持续性威胁导致许多来自高价值目标的关键信息外泄的事件。现有的网络防御框架和数据融合模型无法应对这类威胁,原因是这些模型缺乏针对具有不确定性和冲突信息的多阶段攻击的手段。因此使用马尔可夫相关理论对可转移信度模型进行优化,以解决网络攻击的多阶段性问题,并获得了先前不确定的网络态势感知。在优化后的模型里通过一种新的组合规则,为跨阶段进行假设评估和证据组合提供了一种新的方法。实验表明,提出的优化模型在对高级持续性威胁的判断和预警上有着良好性能。More and more advanced persistent threats have led to many incidents of leakage of key information from high-value targets.Existing cyber defense frameworks and data fusion models cannot cope with such threats,because these models lack the means for multi-stage attacks with uncertain and conflicting information.Therefore,Markov related theories were used to optimize the transferable belief model to solve the multi-stage problem of network attacks and obtain previously uncertain network situational awareness.A new combination rule was adopted in the optimized model to provide a new method for cross-stage hypothesis evaluation and evidence combination.Experiments show that the proposed optimization model has good performance in the judgment and early warning of advanced persistent threats.

关 键 词：态势感知 马尔可夫 网络威胁 杀伤链 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]