基于攻击图的APT脆弱节点评估方法

发布时间：2018-04-16 03:25

本文选题：高级可持续性威胁(APT)攻击 + 攻击图　；参考：《重庆邮电大学学报(自然科学版)》2017年04期

【摘要】：高级可持续性威胁(advanced persistent threat,APT)具有行为隐蔽性强、攻击周期持久的特点,增加了攻击检测的难度。据此,引入攻击图理论评估网络系统在APT攻击下的脆弱节点,提出了一种基于攻击图的APT脆弱节点评估方法,有效地提高了发现攻击的概率。对APT攻击行为的异常特征进行提取和定义,对目标网络系统建立风险属性攻击图(risk attribute attack graph,RAAG)模型;基于APT攻击行为特征的脆弱性对系统节点的行为脆弱性进行评估,并以通用漏洞评分系统(common vulnerability scoring system,CVSS)标准做为参照评估系统节点的通联脆弱性;基于上述2个方面的评估,计算系统中各节点的整体脆弱性,并发现目标网络系统在面向APT攻击时的脆弱节点。实验结果表明,所提方法能够对APT攻击行为特征进行合理量化,对系统节点的脆弱性进行有效评估,在APT攻击检测率上有较好表现。
[Abstract]:Advanced persistent threat (advanced persistent threat) has the characteristics of strong behavior concealment and persistent attack cycle, which increases the difficulty of attack detection.Based on this, an attack graph theory is introduced to evaluate the vulnerable nodes of network system under APT attack, and an attack graph based APT vulnerable node evaluation method is proposed, which effectively improves the probability of detecting attacks.The abnormal feature of APT attack behavior is extracted and defined, the risk attribute attack graph of target network system is established, the vulnerability of APT attack behavior feature is evaluated, the vulnerability of system node is evaluated based on APT attack behavior feature, and the risk attribute attack graph is established for the target network system.The common vulnerability scoring system is used as a reference to evaluate the connection vulnerability of the system nodes, and based on the above two aspects, the overall vulnerability of each node in the system is calculated.At the same time, the vulnerable nodes of the target network system in APT attack are found.The experimental results show that the proposed method can reasonably quantify the characteristics of APT attack behavior, evaluate the vulnerability of system nodes effectively, and perform well in the detection rate of APT attacks.
【作者单位】：重庆邮电大学网络空间安全与信息法学院;重庆邮电大学计算机科学与技术学院;中国人民解放军信息工程大学密码工程学院;
【基金】：重庆市社会科学规划项目(2014SKZ26,2014YBFX103) 国家科技支撑计划项目(2015BAH29F01)~~
【分类号】：TP393.08

【参考文献】