动态攻击网络演化分析模型

Dynamic attack network evolution and analysis model

将基于攻击图的脆弱性评估技术和动态网络演化分析相结合,提出了一种动态攻击网络演化与分析模型。该模型借鉴演变图的思想将攻击图拓展为随时间域和空间域同时变化的演变攻击图,在子图相似度定义的基础上构建攻击演化模式,分析模式内暂态变化的同时结合时序数据分析模式间的连接变化,以攻击演变挖掘算法为核心的模型应用分析过程,可以确定整个过程中攻击模式的数量,明晰每个模式的典型攻击结构,实例证明提出的模型和方法可以有效地模拟攻击发生的过程,当需要防御手段进行干预时,可有针对性地选择危害大的阶段或者节点来抑制攻击过程的发生。

This paper presented a new dynamic attack network evolution and analysis model based on the attack graph vulner- ability assessment technology and analysis on the evolution of dynamic network. Reference to the evolution graph, this model ex- panded the attack graph to evolution attack graph which change in time domain and space domain both, constructed the stage of evolution attack model based on sub graph similarity, analysed the transient change in phase mode and the connection mode among attack phase combined with the time series data, the attack evolution mining algorithm was the core of the analysis of model application process which could get the number of attacks model in the whole process and typical attack structure of each attack model. Example shows that the model can simulate the process of attack effectively,when need defense intervene means, network administrator can suppress the occurrence of attack process through the harmful stave or node.