基于贝叶斯网络攻击图的安全分析算法的研究

发布时间：2018-03-14 07:28

本文选题：攻击图　切入点：贝叶斯网络　出处：《江苏大学》2017年硕士论文　论文类型：学位论文

【摘要】：目前,随着计算机技术和数据通信技术的飞速发展,通过互联网来提供服务的应用日趋广泛与复杂。寻找合理、实用的网络安全分析方法已经成为当前网络安全领域的研究热点。网络攻击图模型描述目标网络内漏洞之间的依赖关系,是一种分析网络脆弱性的工具。本文基于攻击图生成方法,利用攻击图技术,结合安全事件以及脆弱性漏洞评分标准对脆弱性节点安全性进行定量的分析。定量分析的结果可以帮助系统管理员更好的理解当前网络系统中节点安全状态,从而为进一步地实施防护策略提供参考,降低网络系统安全风险。文章主要的工作内容包括:(1)基于攻击图生成工具、网络系统中的漏洞信息等,生成一种有向无环结构的攻击图。使用脆弱性漏洞评分系统评估攻击图中节点被攻击利用的概率,再借助有向无环图生成基于贝叶斯网络的攻击图。之后,在存在节点依赖关系的条件下,对贝叶斯网络攻击图中节点的先验概率进行计算,评估其威胁程度。结合安全事件信息,改变攻击图中节点状态值,使用贝叶斯网络后验概率计算方法更新攻击图中的节点被攻击利用概率,对攻击图中的节点精确评估。(2)针对因属性节点增加引起的后验概率计算复杂度呈指数级递增的问题,提出一种基于团树传播算法的概率计算方法。在贝叶斯网络攻击图转化成团树的三角化消元次序问题上,引入自适应遗传算法求解三角化最佳消元次序,并改进自适应遗传算法的选择算子,提高算法的全局最优解搜索能力及求精收敛速度。实验结果表明,使用改进选择算子的自适应遗传算法对比简单遗传算法和自适应遗传算法可以获得更好的消元次序,进一步降低反映团树推理时间复杂度的团树权重指标。
[Abstract]:At present, with the rapid development of computer technology and data communication technology, the application of providing services through the Internet is becoming more and more extensive and complex. The practical network security analysis method has become a hot topic in the field of network security. The network attack graph model describes the dependency relationship between the vulnerabilities in the target network. This paper is based on attack graph generation method, using attack graph technology, Combined with security events and vulnerability scoring criteria, the security of vulnerable nodes is quantitatively analyzed. The results of quantitative analysis can help system administrators to better understand the security status of nodes in the current network system. The main work of this paper includes: 1) generating tools based on attack graph, vulnerability information in network system, etc. A directed acyclic attack graph is generated. The vulnerability vulnerability scoring system is used to evaluate the probability of the node being exploited in the attack graph, and then the directed acyclic graph is used to generate the attack graph based on Bayesian network. Under the condition of node dependency, the prior probability of the node in the attack graph of Bayesian network is calculated, and the threat degree is evaluated. The state value of the node in the attack graph is changed by combining the security event information. A Bayesian network posteriori probability calculation method is used to update the attack probability of the nodes in the attack graph. The nodes in the attack graph are accurately evaluated. (2) the computational complexity of the posteriori probability due to the increase of attribute nodes is exponentially increasing. In this paper, a probability calculation method based on cluster tree propagation algorithm is proposed. In the triangular elimination order problem of Bayesian network attack graph transformed into cluster tree, adaptive genetic algorithm is introduced to solve the triangulated optimal elimination order. The selection operator of adaptive genetic algorithm is improved to improve the global optimal solution search ability and the convergence speed of the algorithm. The experimental results show that, Compared with simple genetic algorithm and adaptive genetic algorithm, the adaptive genetic algorithm with improved selection operator can obtain better elimination order and further reduce the weight index of cluster tree, which reflects the complexity of reasoning time of cluster tree.
【学位授予单位】：江苏大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】