基于攻防行为树的网络安全态势分析

发布时间：2018-04-15 11:16

本文选题：网络安全 + 态势分析　；参考：《工程科学与技术》2017年02期

【摘要】：现代网络面临遭受组合攻击的风险,通过构建基于攻防行为的安全态势分析模型来对每一个独立及组合攻击行为进行威胁分析十分必要。本文针对传统的攻击树模型没有考虑防御因素影响,防御树模型缺乏较好的可扩展性,故障树模型难以对外部攻击进行分析等问题,在攻击树模型中引入博弈论,以描述具体网络攻防事件场景。首先,分析网络中不同层次攻击行为的逻辑关系,整合不同层次攻击事件对应的攻防树,获得完整网络攻防行为树,进而构建网络攻防行为树模型。其次,从网络攻防行为、网络检测设备以及网络防御措施3方面对基本攻防行为树进行扩展,提出攻击目标成功率算法,计算其攻击概率。在此基础上,对攻击威胁进行评估,分析网络安全态势。最后,为验证网络攻防行为树模型的可行性和有效性,在BGP(border gateway protocol)攻击树的基础上构建攻防行为树模型,通过概率计算可知:攻击路径PATH1概率最大;且在没有防御措施的情况下,5条攻击路径的攻击成功率均得到增大,PATH2至PATH5概率增大倍数显著高于PATH1,与实际相符。本文所提的网络攻防行为树模型能很好地计算各种防御措施的效果,且能够在任意节点添加和删除攻防行为,具有较强的可扩展性,可为网络管理者与运营者提供科学的决策依据。
[Abstract]:Modern network faces the risk of combined attack. It is necessary to construct a security situation analysis model based on attack and defense behavior to analyze each independent and combined attack behavior.In this paper, the traditional attack tree model does not consider the influence of defense factors, the defense tree model lacks good scalability, and the fault tree model is difficult to analyze external attacks, so the game theory is introduced into the attack tree model.To describe a specific network attack and defense event scene.Firstly, the logical relation of attack behavior at different levels in network is analyzed, the attack and defense tree corresponding to different attack events is integrated, and the complete network attack and defense behavior tree is obtained, and then the network attack and defense behavior tree model is constructed.Secondly, the basic attack and defense behavior tree is extended from three aspects: network attack and defense behavior, network detection equipment and network defense measures. An attack target success rate algorithm is proposed and its attack probability is calculated.On this basis, the attack threat is evaluated and the network security situation is analyzed.Finally, in order to verify the feasibility and effectiveness of the network attack and defense behavior tree model, the attack and defense behavior tree model is constructed on the basis of the BGP(border gateway protocol attack tree. The probability calculation shows that the attack path PATH1 has the greatest probability;In the absence of defensive measures, the probability of increasing the probability of attack from PATH _ 2 to PATH5 is significantly higher than that of PATH _ 1, which is consistent with the actual situation.The network attack and defense behavior tree model proposed in this paper can well calculate the effect of various defense measures, and can add and remove attack and defense behavior at any node, so it has strong scalability.It can provide scientific decision basis for network manager and operator.
【作者单位】：海军工程大学信息安全系;
【基金】：国家社会科学基金军事学资助项目(15G003-201) 中国博士后基金资助项目(2014M552656) 湖北省自然科学基金资助项目(2015CFC867)
【分类号】：TP393.08

【参考文献】