网络攻击效果提取和分类

Mining and taxonomy of network attack effects

针对现有工作提出的网络攻击效果比较简单、含义抽象的缺点,研究了网络攻击效果的提取和分类。首先定义原子功能作为攻击效果的基本单位,指出原子功能提取的原则,通过分析NVD漏洞数据库、Snort规则库和Lincoln实验室攻击工具三个攻击库,最后得到五类100多个原子功能。这些原子功能可以代表大部分典型的网络攻击效果,含义明确、相互独立,且效果分类具有互斥性,可以作为网络攻击效果评估的基础,用于研究各类效果的量化评估方法,及提取各个原子功能的评估指标。

Aiming at brief and abstract network attack effects proposed by existing researches,this paper studied a mining and taxonomy of network attack effects.Defined atom function as basic unit of network attack effects,and proposed the mining principles of atom functions.Analyzed three attack databases including national vulnerability database(NVD),Snort rules,and Lincoln Laboratory attack tools for intrusion detection evaluation.At last more than 100 atom functions were enumerated and divided into 5 groups.These...