一种防范多阶段网络攻击的综合分析方法

An Integrated Analysis Approach for Defending Multi-Stage Attacks

提出了一种防范多阶段网络攻击的综合分析方法,首先捕获系统漏洞、攻击者的能力、以及这些信息之间的关系,将其模型化;然后利用改进的模型检测器NuSMV自动产生只包含能对系统造成危害的漏洞的攻击链;最后以攻击链为基础建立简化的攻击树,通过将攻击树量化进行风险评估、可靠性评估、最短路径分析等等。仿真实验表明该方法不仅能够有效的防范多阶段攻击,而且能够对网络进行脆弱性评估。

This paper presents an integrated analysis approach for defending multi_stage network attaks. First, it models the network by capturing system vulnerabilities, attacker capabilities, and the trust relationships; then on the basis of the improved model checker NuSMV, it produces attack chain automatically and efficiently, only containing vulnerabilities which endanger the security of system; Finally, it constructs simplified attack tree based on the attack chain and performs further analysis, such as risk analysis, reliability analysis, or shortest path analysis, by qualifying the attack tree. The simulation results indicate that this method not only can defend multi_stage efficiently, but also can be used to assess the overall vulnerability of the network .