Network attack graphs are originally used to evaluate what the worst security state is when a concerned net-work is under attack. Combined with intrusion evidence such like IDS alerts, attack graphs can be further use...Network attack graphs are originally used to evaluate what the worst security state is when a concerned net-work is under attack. Combined with intrusion evidence such like IDS alerts, attack graphs can be further used to perform security state posterior inference (i.e. inference based on observation experience). In this area, Bayesian network is an ideal mathematic tool, however it can not be directly applied for the following three reasons: 1) in a network attack graph, there may exist directed cycles which are never permitted in a Bayesian network, 2) there may exist temporal partial ordering relations among intrusion evidence that can-not be easily modeled in a Bayesian network, and 3) just one Bayesian network cannot be used to infer both the current and the future security state of a network. In this work, we improve an approximate Bayesian posterior inference algorithm–the likelihood-weighting algorithm to resolve the above obstacles. We give out all the pseudocodes of the algorithm and use several examples to demonstrate its benefit. Based on this, we further propose a network security assessment and enhancement method along with a small network scenario to exemplify its usage.展开更多
Computer networks face a variety of cyberattacks.Most network attacks are contagious and destructive,and these types of attacks can be harmful to society and computer network security.Security evaluation is an effecti...Computer networks face a variety of cyberattacks.Most network attacks are contagious and destructive,and these types of attacks can be harmful to society and computer network security.Security evaluation is an effective method to solve network security problems.For accurate assessment of the vulnerabilities of computer networks,this paper proposes a network security risk assessment method based on a Bayesian network attack graph(B_NAG)model.First,a new resource attack graph(RAG)and the algorithm E-Loop,which is applied to eliminate loops in the B_NAG,are proposed.Second,to distinguish the confusing relationships between nodes of the attack graph in the conversion process,a related algorithm is proposed to generate the B_NAG model.Finally,to analyze the reachability of paths in B_NAG,the measuring indexs such as node attack complexity and node state transition are defined,and an iterative algorithm for obtaining the probability of reaching the target node is presented.On this basis,the posterior probability of related nodes can be calculated.A simulation environment is set up to evaluate the effectiveness of the B_NAG model.The experimental results indicate that the B_NAG model is realistic and effective in evaluating vulnerabilities of computer networks and can accurately highlight the degree of vulnerability in a chaotic relationship.展开更多
分布式拒绝服务(Distributed Denial of Service,DDoS)攻击已经成为网络安全的主要威胁之一,其中应用层DDoS攻击是主要的攻击手段。应用层DDoS攻击是针对具体应用服务的攻击,其在网络层行为表现正常,传统安全设备无法有效抵御。同时,现...分布式拒绝服务(Distributed Denial of Service,DDoS)攻击已经成为网络安全的主要威胁之一,其中应用层DDoS攻击是主要的攻击手段。应用层DDoS攻击是针对具体应用服务的攻击,其在网络层行为表现正常,传统安全设备无法有效抵御。同时,现有的针对应用层DDoS攻击的检测方法检测能力不足,难以适应攻击模式的变化。为此,文章提出一种基于时空图神经网络(Spatio-Temporal Graph Neural Network,STGNN)的应用层DDoS攻击检测方法,利用应用层服务的特征,从应用层数据和应用层协议交互信息出发,引入注意力机制并结合多个GraphSAGE层,学习不同时间窗口下的实体交互模式,进而计算检测流量与正常流量的偏差,完成攻击检测。该方法仅利用时间、源IP、目的IP、通信频率、平均数据包大小5维数据便可有效识别应用层DDoS攻击。由实验结果可知,该方法在攻击样本数量较少的情况下,与对比方法相比可获得较高的Recall和F1分数。展开更多
电力系统状态估计(power system state estimation,PSSE)在现代智能电网的稳定运行中起着至关重要的作用,但它也容易遭受网络攻击。虚假数据注入攻击(false data injection attacks,FDIA)是最常见的网络攻击方式之一,它可以篡改量测数...电力系统状态估计(power system state estimation,PSSE)在现代智能电网的稳定运行中起着至关重要的作用,但它也容易遭受网络攻击。虚假数据注入攻击(false data injection attacks,FDIA)是最常见的网络攻击方式之一,它可以篡改量测数据并绕过不良数据检测(bad data detection,BDD)机制,从而导致不正确的状态估计结果。文中提出一种基于数据驱动的针对PSSE的FDIA防御框架,该框架包含异常检测子框架和数据恢复子框架。异常检测部分采用改进的图卷积网络(improved graph convolutional network,IGCN)模型,该模型采用动态的边缘条件滤波器作用于图结构中,有效利用电力系统的拓扑信息、节点特征和边特征,从而检测出异常值。数据恢复部分采用变分自编码器(variational auto-encoder,VAE)模型,该模型将深度学习思想与贝叶斯推理相结合,可以有效地将异常数据恢复到在正常运行情况下的数值。针对不同攻击强度和攻击程度下的IEEE 14系统进行案例研究,以评估防御框架的检测与恢复性能。仿真结果表明,基于IGCN的异常检测子框架性能优于常规的数据驱动模型框架,其总体精确率为99.348%,召回率为99.331%,F1值为99.324%,基于VAE的数据恢复子框架的总体平均绝对误差为0.00534 p.u.,证明了防御框架优异的检测与恢复性能。展开更多
文摘Network attack graphs are originally used to evaluate what the worst security state is when a concerned net-work is under attack. Combined with intrusion evidence such like IDS alerts, attack graphs can be further used to perform security state posterior inference (i.e. inference based on observation experience). In this area, Bayesian network is an ideal mathematic tool, however it can not be directly applied for the following three reasons: 1) in a network attack graph, there may exist directed cycles which are never permitted in a Bayesian network, 2) there may exist temporal partial ordering relations among intrusion evidence that can-not be easily modeled in a Bayesian network, and 3) just one Bayesian network cannot be used to infer both the current and the future security state of a network. In this work, we improve an approximate Bayesian posterior inference algorithm–the likelihood-weighting algorithm to resolve the above obstacles. We give out all the pseudocodes of the algorithm and use several examples to demonstrate its benefit. Based on this, we further propose a network security assessment and enhancement method along with a small network scenario to exemplify its usage.
基金This work was partially supported by the National Natural Science Foundation of China(61300216,Wang,H,www.nsfc.gov.cn).
文摘Computer networks face a variety of cyberattacks.Most network attacks are contagious and destructive,and these types of attacks can be harmful to society and computer network security.Security evaluation is an effective method to solve network security problems.For accurate assessment of the vulnerabilities of computer networks,this paper proposes a network security risk assessment method based on a Bayesian network attack graph(B_NAG)model.First,a new resource attack graph(RAG)and the algorithm E-Loop,which is applied to eliminate loops in the B_NAG,are proposed.Second,to distinguish the confusing relationships between nodes of the attack graph in the conversion process,a related algorithm is proposed to generate the B_NAG model.Finally,to analyze the reachability of paths in B_NAG,the measuring indexs such as node attack complexity and node state transition are defined,and an iterative algorithm for obtaining the probability of reaching the target node is presented.On this basis,the posterior probability of related nodes can be calculated.A simulation environment is set up to evaluate the effectiveness of the B_NAG model.The experimental results indicate that the B_NAG model is realistic and effective in evaluating vulnerabilities of computer networks and can accurately highlight the degree of vulnerability in a chaotic relationship.
文摘电力系统状态估计(power system state estimation,PSSE)在现代智能电网的稳定运行中起着至关重要的作用,但它也容易遭受网络攻击。虚假数据注入攻击(false data injection attacks,FDIA)是最常见的网络攻击方式之一,它可以篡改量测数据并绕过不良数据检测(bad data detection,BDD)机制,从而导致不正确的状态估计结果。文中提出一种基于数据驱动的针对PSSE的FDIA防御框架,该框架包含异常检测子框架和数据恢复子框架。异常检测部分采用改进的图卷积网络(improved graph convolutional network,IGCN)模型,该模型采用动态的边缘条件滤波器作用于图结构中,有效利用电力系统的拓扑信息、节点特征和边特征,从而检测出异常值。数据恢复部分采用变分自编码器(variational auto-encoder,VAE)模型,该模型将深度学习思想与贝叶斯推理相结合,可以有效地将异常数据恢复到在正常运行情况下的数值。针对不同攻击强度和攻击程度下的IEEE 14系统进行案例研究,以评估防御框架的检测与恢复性能。仿真结果表明,基于IGCN的异常检测子框架性能优于常规的数据驱动模型框架,其总体精确率为99.348%,召回率为99.331%,F1值为99.324%,基于VAE的数据恢复子框架的总体平均绝对误差为0.00534 p.u.,证明了防御框架优异的检测与恢复性能。
