基于攻击路径图的入侵意图识别

Intrusive Intention Recognition Based on Attack Path Graph

为了预测攻击者高层次的攻击目标,感知网络的安全态势,提出入侵意图识别方法.给出入侵意图的概念及其分类,提出一种基于层次化的攻击路径图.利用攻击路径图对攻击者的意图可达性、意图实现概率、意图实现的最短路径和攻击路径预测进行定量分析.应用有向图的最小割理论制定防护措施阻止攻击者意图的实现,为管理员的决策提供依据.实验验证了该方法的可行性和有效性.

In order to predict an attacker’s high level goals and assess network security situation, an intrusive intention recognition method is presented in this paper. Concept and taxonomy of intrusive intention are introduced at first. Then, to reduce complexity of understanding and analysis, a method of hierarchical attack path graph generation is proposed to recognize intrusive intention. Based on the attack path graph, the algorithms for evaluating quantitatively intention accessibility, reliable probability, attack path prediction and possible minimum attack path are developed. Next, economical and effective protective measures are addressed to block attackers’ intention to be achieved, by applying minimum vertex cut set theory to directed graph. Finally several experiments are done to prove the feasibility and validity of this method.