基于规则的网络攻击事件生成方法

Generation Method for Network Attack Event Based on Regulation

网络对抗试验因其过程快、交互强和安全隔离性高等特点,对网络安全能力测试评估提出了更高要求。提出了一种基于规则的网络攻击事件生成方法,为网络安全能力测试提供威胁驱动源。首先,从网络协议报头、攻击负载和交互行为统计3方面建立了攻击特征库,构造初始攻击报文;然后,建立了攻击特征变换规则,在不改变攻击能力前提下对初始攻击报文进行变换,生成网络攻击事件,以提高网络攻击模拟逼真度;最后,进行了某情报组网系统的威胁感知能力评估试验,验证了基于规则的网络攻击事件生成方法的有效性。

The evaluation of the network security ability is required in fast confrontation of test process, strong interaction and highly security isolation. An attack event generation method based on the regulation is proposed to provide threat-driven source for network security ability experiment. Firstly, the attack behavior characteristic library is built from network protocol dat- agram, attack load and interactive behavior. Secondly, the initial attack packet is constructed based on behavior characteristics. Thirdly, the attack characteristic transformation rule is built to transform the initial attack packet without changing the attack ability for improving the simula- tion fidelity of the network combatant behavior. Finally, the threat sensing ability evaluation ex- periment is conducted in some area intelligence networking systems. Experimental results show that the method can efficiently support ability evaluation experiment.