A color petri net (CPN) based attack modeling approach is addressed. Compared with graph-based modeling, CPN based attack model is flexible enough to model Internet intrusions, because of their static and dynamic feat...A color petri net (CPN) based attack modeling approach is addressed. Compared with graph-based modeling, CPN based attack model is flexible enough to model Internet intrusions, because of their static and dynamic features. The processes and rules of building CPN based attack model from attack tree are also presented. In order to evaluate the risk of intrusion, some cost elements are added to CPN based attack modeling. This extended model is useful in intrusion detection and risk evaluation. Experiences show that it is easy to exploit CPN based attack modeling approach to provide the controlling functions, such as intrusion response and intrusion defense. A case study given in this paper shows that CPN based attack model has many unique characters which attack tree model hasn’t.展开更多
The rate of passive and active attacks has been on the increase lately affecting both individuals and institutions. Even when internal control procedures are in place, malicious codes from intruders into the network h...The rate of passive and active attacks has been on the increase lately affecting both individuals and institutions. Even when internal control procedures are in place, malicious codes from intruders into the network have left so much to be desired. As a result, many Chief Information Security Officers have grown grey hair because of their inability to effectively handle attacks from various ends. Various attempts and technologies have been made in the time past with a measure of success. Intrusion Detection Software (IDS), Intrusion Prevention Software, firewall, honey pots and honey nets have been deployed and with great respite from losses arising from cyber-attacks. Cyber security is the duty of everyone and all must see it as such. As tiers of government and law enforcement agents are doing their best, everybody must be seen to play their parts. Fraudsters have also not seemed to be tired of seeking vulnerabilities to exploit. Then, cyber security experts should not let off their guards but make efforts to harden their security. A way of doing is to intelligently provide a solution that has the capability of detecting and proactively hardening security. This paper proposes a honey net model that is captcha-based and capable of extracting details from hackers with a view to building a robust defense against black hat attackers. This research was able to prevent the botnet with the use of captcha and also redirect suspected traffic to the honeynet which was then captured for the purpose of improving the security of the network. The result showed that any bandwidth greater than the set threshold was not allowed to go into the network but redirected to honeynet where details were logged. Also, with a threshold of 100 mbs, inbound traffic of higher bandwidth such as 110 mbs and 150 mbs was denied access thereby giving 100% detection rate.展开更多
以模糊Petri网(Fuzzy Petri net,FPN)理论为基础,定义了一种面向检测的新型网络攻击模型FPAN,提出了FPAN的生成算法,并通过实验验证了算法的正确性,该模型比攻击树(Attack Tree)更能够反映各个步骤之间的关系,可重用性也更强,具有较好...以模糊Petri网(Fuzzy Petri net,FPN)理论为基础,定义了一种面向检测的新型网络攻击模型FPAN,提出了FPAN的生成算法,并通过实验验证了算法的正确性,该模型比攻击树(Attack Tree)更能够反映各个步骤之间的关系,可重用性也更强,具有较好的实用性。展开更多
基金Supperted by the Nation High Technology Research and Development Program of China (863 Program) (No.2002AA001042) and the Tackle Key Problem Program of Sichuan Province (No. 01GG0712)
文摘A color petri net (CPN) based attack modeling approach is addressed. Compared with graph-based modeling, CPN based attack model is flexible enough to model Internet intrusions, because of their static and dynamic features. The processes and rules of building CPN based attack model from attack tree are also presented. In order to evaluate the risk of intrusion, some cost elements are added to CPN based attack modeling. This extended model is useful in intrusion detection and risk evaluation. Experiences show that it is easy to exploit CPN based attack modeling approach to provide the controlling functions, such as intrusion response and intrusion defense. A case study given in this paper shows that CPN based attack model has many unique characters which attack tree model hasn’t.
文摘The rate of passive and active attacks has been on the increase lately affecting both individuals and institutions. Even when internal control procedures are in place, malicious codes from intruders into the network have left so much to be desired. As a result, many Chief Information Security Officers have grown grey hair because of their inability to effectively handle attacks from various ends. Various attempts and technologies have been made in the time past with a measure of success. Intrusion Detection Software (IDS), Intrusion Prevention Software, firewall, honey pots and honey nets have been deployed and with great respite from losses arising from cyber-attacks. Cyber security is the duty of everyone and all must see it as such. As tiers of government and law enforcement agents are doing their best, everybody must be seen to play their parts. Fraudsters have also not seemed to be tired of seeking vulnerabilities to exploit. Then, cyber security experts should not let off their guards but make efforts to harden their security. A way of doing is to intelligently provide a solution that has the capability of detecting and proactively hardening security. This paper proposes a honey net model that is captcha-based and capable of extracting details from hackers with a view to building a robust defense against black hat attackers. This research was able to prevent the botnet with the use of captcha and also redirect suspected traffic to the honeynet which was then captured for the purpose of improving the security of the network. The result showed that any bandwidth greater than the set threshold was not allowed to go into the network but redirected to honeynet where details were logged. Also, with a threshold of 100 mbs, inbound traffic of higher bandwidth such as 110 mbs and 150 mbs was denied access thereby giving 100% detection rate.
