基于吸收Markov链的网络入侵路径预测方法

Route Prediction Method for Network Intrusion Using Absorbing Markov Chain

入侵意图和路径预测对于安全管理员深入理解攻击者可能的威胁行为具有重要意义.现有研究主要集中于理想攻击场景中的路径预测,然而理想攻击路径并不都是入侵者采取的真实路径.为了准确全面地预测网络入侵的路径信息,提出基于吸收Markov链的多步攻击路径预测方法.首先利用吸收Markov链中状态转移的无后效性和吸收性设计节点状态转移概率归一化算法,并证明完整攻击图可以映射为吸收Markov链,进而给出了基于通用漏洞评分标准的状态转移概率度量方法,最后提出攻击状态节点访问次数和路径长度的期望值预测步骤流程.实例分析结果表明:该方法可以量化不同长度攻击路径的概率分布、计算路径长度的期望值、预测实现既定攻击目标所需的原子攻击次数,并对节点威胁进行排序,为及时应对网络攻击威胁提供更多安全防护指导.

Predictions of network intrusion intention and path are very significant for the security administrator to comprehend the possible threat behaviors of attackers deeply.Existing reports mainly focus on the path prediction under the ideal attack scenario.However,the ideal attack paths are not the real-world paths adopted by the intruders entirely.In order to predict the attack path information of network intrusion accurately and comprehensively,a novel route prediction method based on absorbing Markov chain(AMC)is proposed in this paper.Firstly,a normalization algorithm for state transition probability of AMC is designed with the Markov and absorption properties,then the complete attack graph(AG)proved can be mapped into the AMC.In addition,the probability metric for state transition based on common vulnerability scoring system(CVSS)is designed.Finally,the detailed steps for predicting expected number of visits to attack state and expected number of route lengths are further put forward respectively.Experimental analysis results indicate that our method can quantify the probability distribution of routes with different attack lengths,and calculate the expected number of route lengths.Moreover,it can predict the expected number of atomic attacks needed to compromise the attack goal.The predictions can be used in node threat ranking.Hence,our approach provides more guidance for network security protection in response to network attack threat timely.