摘要
针对攻击图在评估网络安全时节点关系复杂、存在含圈攻击路径、只能反映网络静态风险等问题,将攻击图与贝叶斯理论结合,提出贝叶斯攻击图的概念,简化了攻击图并通过优化算法避免了含圈路径的产生;通过引入攻击证据与CVSS评分系统,提出了一种新的面向脆弱点的网络安全量化评估方法,基于贝叶斯攻击图对网络整体及局部的安全状况进行实时动态评估。通过在实际网络中的实验验证了该方法的可行性及有效性,与传统评估方法相比,该方法能够动态地反映网络安全的态势变化情况。
Aiming at solving the problems of attack graphs that the complicated relationships between nodes, the existing of cyclic attack paths and reflecting merely the static risk when evaluating the network security, this paper put forward the con- cept of Bayesian-attack graphs which simplified attack graphs and avoided the appearing of the cyclic paths by an optimized al- gorithm, combining attack graphs and Bayesian theory. By importing attack evidence and CVSS, this paper proposed a new method against to the vulnerability which could dynamically evaluate the whole and partial network security based on Bayesian- attack graphs. Experimental results in the real network show its veracity and validity, and the method can dynamically reflect the changes of the network security situation comparing to traditional assessment methods.
出处
《计算机应用研究》
CSCD
北大核心
2013年第9期2763-2766,共4页
Application Research of Computers
基金
国家自然科学基金资助项目(61272486)
关键词
贝叶斯攻击图
脆弱点
动态评估
攻击证据
Bayesian-attack graphs
vulnerability
dynamic assessment
attack evidence
