摘要
目前,网络脆弱性量化评估面临的主要挑战之一是识别网络中存在的脆弱性和它们之间的相互关系以及由此产生的潜在威胁,本文提出了一种基于属性攻击图的网络脆弱性量化评估方法。首先对属性攻击图和有效攻击路径进行了形式化定义,在此基础上提出了采用"最大可达概率"指标来度量目标网络中关键属性集合的脆弱性,并设计了最大可达概率计算算法,该算法解决了属性攻击图的含圈路径问题;为解决实际评估中原始数据缺失的问题,提出了"可信度"的概念,它能有效反映缺失数据对评估结果的影响。
Attack graph is a modelbased vulnerability analysis technology. It may automatically analyze the interrelation among vulnerabilities in the network and the potential threat resulting from the vulnerabilities,which is one of problems the quantitative vulnerability assessment must solve. This paper proposes a novel quantitative vulnerability assessment method based on attributebased attack graphs. First attributebased attack graphs and valid attack paths are formally described, and maximal reachable probability is adopted to measure the vulnerability of the key attribute set of the target network. An algorithm for computing maximal reachable probability is presented to solve the problem of loop attack paths. Finally, because some data may not be obtained in practical assessment,the conception of creditability is introduced to measure the impact of absent data on the result.
出处
《计算机工程与科学》
CSCD
北大核心
2010年第10期8-11,19,共5页
Computer Engineering & Science
基金
国家自然科学基金资助项目(90604006)
关键词
攻击图
有效攻击路径
最大可达概率
可信度
attack graph；valid attack path；maximal reachable probability；creditability
