基于攻击面度量的动态目标防御效能评估方法

Performance Assessment Technique of Moving Target Defense Based on Attack Surface Measurement

在赛博空间的攻防博弈中,信息系统的静态不变特性使得攻击者具有足够的时间和空间来实施侦察、发动攻击.从网络防御的角度来看,利用操作系统、软件、数据、网络设施的动态随机变化实现信息系统的动态防御,有可能减小攻击面,从而抑制攻击.基于马尔可夫(Markov)链模型对信息系统动态目标防御方法进行了建模分析,通过引入攻击探测概率指标对变化攻击面进行定量度量.根据攻防博弈中实施策略的不同,将模型细分为4种情况,并以动态云中心攻防为例,对模型的有效性和合理性进行了验证.

Attackers have sufficient time and space to implementing reconnaissance and attack aiming at the static and fixed characteristic of information system in the game of cyberspace attack and defense. In the view of network defense, dynamic and random changes of OS, software, data and network infrastructure realize dynamic defense of information system, thus probably reduces attack surface and contains attacks. In the paper, a method of modeling and analysis of information system dynamic defense is presented based on Markov chain, meanwhile, the index of attack detection probability is introduced in order to quantitatively calculate attack surface of dynamic system. The model is subdivided into four cases according to attack and defense strategies. Finally, a calculation example of dynamic cloud center attack and defense is illustrated which shows that the mentioned modeling technique is valid and feasible.