摘要
随着信息技术的发展,网络系统面临的安全问题日趋严峻。信息系统的静态不变性使得攻击者能够根据信息系统的属性特点,多角度开展攻击。现有的标准规范以检验系统是否达到安全保密要求为主,缺少对信息系统安全程度的定性和定量测量。攻击面表示攻击者能够进入系统并造成破坏的方法集合,因此从攻击面着手对系统安全性开展度量,能够体现系统被破坏的潜在可能性和实施攻击所需付出的代价程度。鉴于此,提出了一种基于攻击面的安全威胁评估体系。该体系通过探索攻击面形式化表达方法及数学模型,梳理了网络空间系统攻击面度量指标体系,随后基于最大熵马尔科夫模型和条件随机场模型,研究基于动态攻击面的安全威胁评估方法。提出的基于攻击面安全威胁评估体系能够用于网络系统安全程度量化评估,评估结果既可作为网络系统优化设计的参考,又可作为安全防御体系的效能评估数据依据。
With the development of information technology,the security problems faced by network systems have become increasingly severe.The static immutability of information systems enables attackers to launch attacks from multiple angles according to the attributes of the information systems.Existing standards and specifications mainly focus on testing whether the system meets the requirements of security and confidentiality,but lack of qualitative and quantitative measurement of information system security.Attack surface represents the collection of methods by which an attacker can enter the system and cause damage.Therefore,to measure the system security from the attack surface can reflect the potential damage of the system and the cost of the attack.This paper proposes a security threat assessment system based on the attack surface.The system,through exploration on the formal expression method and mathematical model of the attack surface,combs the attack surface measurement index system of the cyberspace system,and then based on the Maximum Entropy Markov model and conditions.Random field model studies security threat assessment methods based on dynamic attack surface.The security threat assessment system based on the attack surface proposed in this paper can be used of network system security degree,and the evaluation results can be used as reference for network system optimization design and as the data basis for effectiveness evaluation of security defense system.
作者
廉新科
闫卿
LIAN Xin-ke;YAN Qing(Unit 91977 of PLA,Beijing 100036,China)
出处
《通信技术》
2020年第10期2567-2572,共6页
Communications Technology
关键词
攻击面
度量模型
安全评估
指标体系
attack surface
measurement model
security assessment
index system
