基于贝叶斯网络的内部威胁预测研究

发布时间：2018-02-13 20:14

本文关键词： 内部威胁贝叶斯网络网络攻击图似然加权法　出处：《计算机应用研究》2013年09期 　论文类型：期刊论文

【摘要】：在内部网络带给企业办公便利的同时,内部网络所带来的威胁也日渐突出,由于企业中内部威胁具有危害性大、难以检测等特点,内部威胁亟需解决。因此,提出了基于贝叶斯网络攻击图的内部威胁预测模型。以内部用户实际操作过程中的行为为研究对象,以内部用户攻击过程中所占有的资源状态和所进行的操作序列攻击证据为节点,构建贝叶斯网络攻击图;以网络攻击图来描述攻击者在攻击过程中的不同攻击路径和攻击状态,并且利用贝叶斯网络推理算法计算内部威胁的危险概率。在贝叶斯网络攻击图中定义了元操作、原子攻击、攻击证据等概念,量化了节点变量、节点变量取值和条件概率分布。以改进的似然加权算法为基础,使贝叶斯网络的参数计算更加简便,内部威胁的预测更加精确。最后,通过仿真实验证明了该方法建模速度快、计算过程简单、计算结果精确,在预测内部威胁时的有效性和适用性。
[Abstract]:At the same time, the internal network brings convenience to the office of the enterprise, and the threat brought by the internal network is becoming more and more prominent. Because the internal threat in the enterprise is harmful and difficult to detect, the internal threat needs to be solved urgently. An internal threat prediction model based on Bayesian network attack graph is proposed. The Bayesian network attack graph is constructed based on the resource status and operation sequence attack evidence in the process of internal user attack, and the different attack paths and attack states in the attack process are described by network attack graph. The Bayesian network reasoning algorithm is used to calculate the risk probability of the internal threat. The concepts of meta-operation, atomic attack and attack evidence are defined in the Bayesian network attack graph, and the node variables are quantified. Based on the improved likelihood weighting algorithm, the parameter calculation of Bayesian network is simpler and the prediction of internal threat is more accurate. Finally, the simulation results show that the proposed method is fast in modeling. The calculation process is simple, the calculation result is accurate, and the validity and applicability in predicting the internal threat.
【作者单位】：河南理工大学计算机科学与技术学院;
【基金】：国家自然科学基金资助项目(51174263) 河南省教育厅自然科学基金资助项目(2011B520015) 河南理工大学博士基金资助项目(B2010-61) 河南省社科联基金资助项目(SKL-2012-849)
【分类号】：TP393.08

【参考文献】