基于攻击图的网络安全度量研究

Research on network security measurement based on attack graph

随着现代社会对网络系统依赖程度的日益增强,网络安全问题受到普遍关注。网络安全度量是指在理解网络环境的基础之上,建立合适指标体系和度量方法,评估网络的安全性。本文采用攻击图这种网络脆弱性分析技术,在对目标网络和攻击者建模的基础之上,根据两者之间的相互关系生成攻击图模型,分析不同的攻击路径。借鉴CVSS对单一漏洞的量化指标,以及节点间概率转换关系,提出攻击伸缩性机理。结合CVSS指标和攻击图,计算攻击伸缩性数值,并以此作为网络安全度量的方法,最后总结了当前网络安全度量的发展现状以及面临的挑战。

With the increasing dependence of modern society on network systems, network security issues have received widespread attention. Network security metrics are based on understanding the network environment, establishing appropriate indicator systems and metrics, and assessing network security. In this paper, using the network vulnerability analysis technology of attack graph, based on the modeling of the target network and the attacker, the attack graph model is generated based on the relationship between the two, and various possible attack paths are analyzed. This paper draws on CVSS’s quantitative index of single vulnerability, and proposes the mechanism of attack scalability. Combine the CVSS indicator and the attack graph to calculate the attack scalability value and use it as a method of network security metrics.Finally, it summarizes the current development status of network security metrics and analyzes the main challenges.