基于主机攻击图的攻击识别

Host-Based Attack Graph for Attack Recognition

研究了一种基于主机攻击图的网络攻击识别方法,其核心是定义一种SAGML语言,并利用该语言中的状态、行为和关系来描述攻击.详细讨论了攻击图的状态结构和行为链结构,以及基于XML语言的攻击图构建和解析过程.此外,为了提高攻击图的匹配效率,研究了攻击图的索引建立和匹配过程.最后,结合SYNFlood和Peacomm攻击示例,介绍了该方法的应用过程.

This paper establishes a system of network attack recognition based on attack graph by defining a SAGML language,which uses three elements：state,behavior and relationship to describe an attack.State and behavior chain structure of the attack graph,and the construction and analysis of attack graph based on XML are discussed in detail.To improve efficiency of attack graph retrieval,the attack graph indexing and matching strategy are studied.Two typical attacks,SYNFlood and Peacomm,are used to show applications of the proposed method.