基于局部攻击图的最小关键漏洞集分析方法

Analysis method of minimum critical vulnerability set based on partial attack graph

为缓解攻击图应用在工业互联网安全防护中的状态空间爆炸问题,提出一种基于局部攻击图的最小关键漏洞集分析方法。提出一种以重要资产节点为目标的局部攻击图生成算法,通过裁剪不可达目标节点的攻击路径缓解状态空间爆炸问题;基于局部攻击图生成过程中得到的攻击路径漏洞集直接进行最小关键漏洞集分析,节省传统分析方法在搜索关键漏洞过程中对攻击图进行二次遍历的时空开销。在此基础上,通过工业网络实例进行分析并开展相关工作比较,实验结果表明,所提方法合理可行,可高效分析网络系统中的最小关键漏洞集。

The attack graph is prone to state space explosion in industrial Internet security protection,which is a serious problem.To alleviate this problem,a minimal critical vulnerability set analysis method based on partial attack graph was proposed.A partial attack graph generation algorithm targeting important asset nodes was proposed to alleviate the state space explosion problem by clipping the attack paths of unreachable targets.Based on the attack path vulnerability set obtained during the generation of the partial attack graph,the analysis of the minimum critical vulnerability set was directly performed.The time and space overhead of the traditional analysis method for secondary traversal of the attack graph in the process of searching for critical vulnerabilities was saved.On this basis,an industrial network example was used to analyze and compare related work.Experimental results show that the proposed method is reasonable and feasible,and can efficiently analyze the minimum set of critical vulnerabilities in network systems.