摘要
针对社交网络中社会工程学威胁难以定量评估的问题,提出基于属性攻击图和贝叶斯网络的社会工程学威胁评估方法.基于社交网络社会工程学攻击过程,定义社会工程学的可利用的脆弱性语义和攻击节点语义,提出相应的脆弱性可利用概率计算方法.通过分析社交网络中社会工程学攻击模式,模拟钓鱼攻击和跨站身份克隆攻击,根据属性攻击图生成算法构建社会工程学攻击图,采用贝叶斯网络模型对每种攻击路径造成的社会工程学威胁进行量化评估,得到社交网络中个人账号的隐私威胁风险.通过在Facebook数据集上的实验验证所提出方法的有效性.
An assessment method for social engineering threat based on attribute attack graph and Bayesian network was proposed, aiming at the problem that social engineering threats in social networks were difficult to evaluate quantitatively. The semantics of vulnerability and attack node in social engineering were defined, and the corresponding method for calculating available probability of vulnerability was proposed, according to the process of social engineering attack in social network. Phishing attacks and cross-station identity cloning attacks were simulated by analyzing the attack patterns of social engineering in social network. Social engineering attack maps were constructed based on the attribute attack graph generation algorithm. Bayesian network model was applied to assess quantitatively the social engineering threats caused by each attack path, and the privacy threat risk value of personal account in social network was obtained. Experiments on the Facebook dataset verified the effectiveness of the proposed method.
作者
张雪芹
张立
顾春华
ZHANG Xue-qin;ZHANG Li;GU Chun-hua(School of Information Science and Engineering,East China University of Science and Technology,Shanghai 200237,China)
出处
《浙江大学学报（工学版）》
EI
CAS
CSCD
北大核心
2019年第5期837-842,共6页
Journal of Zhejiang University：Engineering Science
基金
国家自然科学基金资助项目(61472139)
关键词
威胁评估
社会工程学攻击
脆弱性语义
攻击图
贝叶斯网络
threat assessment
social engineering attack
semantics of vulnerability
attack graph
Bayesian network
