面向SOA系统的攻击效能评估技术研究

发布时间：2018-06-18 07:58

本文选题：SOA + 攻击效能评估　；参考：《沈阳理工大学》2014年硕士论文

【摘要】：随着软件结构复杂性的快速增长，传统的开发模式已经不能满足用户对处理速度以及易用性的要求，，在这种情况下，面向服务的架构SOA（service-orientedarchitecture）应运而生。由于具有复用率高、扩展性强，松耦合等特点，SOA已逐渐成为了企业在开发软件时重点考虑的架构。然而，伴随着SOA在开发过程中的应用，其安全性问题却日益凸显，成为了约束SOA发展的一个重要原因。为了解决SOA的安全问题，必须为SOA系统制定合理的安全策略。对系统进行攻击效能评估是一种有效验证SOA系统安全性的方法。通过攻击测试，可以发现SOA系统中存在的薄弱环节，为其安全策略的制订提供指导。然而，当前的攻击效能评估中，存在以下明显问题：攻击测试方法缺乏针对性；评估指标选取多采用通用指标集；多采用主观赋权对评估指标进行权重确定等。为此，进行面向SOA系统的攻击效能评估研究意义重大。研究中，通过对SOA架构及其当前核心实现技术—Web Service进行了分析，立足Web Service攻击方法中具有代表性的拒绝服务攻击方式，引入SOAP泛洪攻击方法和XML嵌套攻击方法进行攻击实现，从而呈现SOA系统受到攻击时的状态与系统变化。在此基础上，通过分析系统受攻击时的性能与功能的改变，建立了具有针对性的效能评估指标集。同时，通过分析与对比主观赋权法、客观赋权法、主客观综合赋权法的特点和局限性，最终确立了基于层次分析法与熵权法相结合的综合赋权方式，实现对选定的评估指标的综合赋权，使赋权过程既能体现决策者的主观意见，又能反映指标数据所包含的客观信息。进一步，依据建立的SOA攻击效能测试系统，进行了相应评估指标的数据及信息采集，利用灰色综合评价法，对两种攻击实施下的面向SOA系统进行了效能评估。
[Abstract]:With the rapid growth of the complexity of the software structure, the traditional development mode has not met the requirements of the user's processing speed and ease of use. In this case, the service oriented architecture SOA (Service-OrientedArchitecture) emerges as the times require. Because of the characteristics of high reuse rate, scalability, loose coupling, and so on, SOA has gradually become an enterprise. However, with the application of SOA in the development process, the security problem has become increasingly prominent, which has become an important reason for the development of constrained SOA.
In order to solve the security problem of SOA, it is necessary to make a reasonable security strategy for the SOA system. An attack effectiveness evaluation of the system is an effective method to verify the security of the SOA system. Through the attack test, we can find the weak links in the SOA system and provide guidance for the security strategy. However, the current attack effectiveness evaluation There are obvious problems in the following aspects: the attack test method is lack of pertinence, the selection of evaluation indexes is mostly used in general index set, and the weight of the evaluation index is determined by subjective empowerment. Therefore, it is of great significance to evaluate the attack effectiveness of the SOA system.
In the study, by analyzing the SOA architecture and its current core implementation technology, Web Service, based on the representative denial of service attack mode in the Web Service attack method, the SOAP flooding attack method and XML nested attack method are introduced to carry out the attack implementation, thus presenting the state and system changes when the SOA system is attacked. On this basis, by analyzing the changes of the performance and function of the system under attack, the target set of effectiveness evaluation is set up. At the same time, the characteristics and limitations of the subjective empowerment method, objective empowerment method, subjective and objective comprehensive empowerment method are analyzed and compared, and the comprehensive empowerment based on the combination of analytic hierarchy process and entropy weight method is established. To realize the comprehensive empowerment of the selected evaluation index, the empowerment process can not only reflect the subjective opinions of the decision-makers, but also reflect the objective information contained in the index data. Further, according to the established SOA attack effectiveness test system, the data and information collection of the corresponding evaluation indexes are carried out, and the grey comprehensive evaluation method is used for two kinds of attack. The effectiveness of the SOA oriented system is evaluated.
【学位授予单位】：沈阳理工大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【共引文献】