网络与信息安全学报 ›› 2022, Vol. 8 ›› Issue (4): 87-97.doi: 10.11959/j.issn.2096-109x.2022047

• 学术论文 • 上一篇    下一篇

基于期望收益率攻击图的网络风险评估研究

刘文甫1,2, 庞建民1, 周鑫1, 李男1, 岳峰1   

  1. 1 信息工程大学，河南 郑州 450001
    2 电子信息系统复杂电磁环境效应重点实验室，河南 洛阳 471003
  • 修回日期:2021-07-28 出版日期:2022-08-15 发布日期:2022-08-01
  • 作者简介:刘文甫（1986− ），男，河南卫辉人，信息工程大学博士生，主要研究方向为大数据分析、自然语言处理、信息安全
    庞建民（1964− ），男，河北沧州人，博士，信息工程大学教授、博士生导师，主要研究方向为数据库理论、数据挖掘、机器学习、高性能计算、信息安全
    周鑫（1994− ），男，辽宁沈阳人，信息工程大学博士生，主要研究方向为人工智能、漏洞挖掘、信息安全
    李男（1977− ），男，河北保定人，博士，信息工程大学副教授，主要研究方向为高性能计算和大数据隐私保护
    岳峰（1985− ），男，山西长治人，博士，信息工程大学讲师，主要研究方向为高性能计算、信息安全、大数据挖掘
  • 基金资助:
    国家自然科学基金(61802433);之江实验室“先进工业互联网安全平台”项目(2018FD0ZX01)

Research on network risk assessment based on attack graph of expected benefits-rate

Wenfu LIU1,2, Jianmin PANG1, Xin ZHOU1, Nan LI1, Feng YUE1   

  1. 1 Information Engineering University, Zhengzhou 450001, China
    2 State Key Laboratory of Complex Electromagnetic Environment Effects on Electronics and Information System, Luoyang 471003, China
  • Revised:2021-07-28 Online:2022-08-15 Published:2022-08-01
  • Supported by:
    The National Natural Science Foundation of China(61802433);Zhijiang Laboratory Advanced Industrial Internet Security Platform(2018FD0ZX01)

在线阅读

43

pdf下载

347

摘要：

随着互联网应用和服务越来越广泛，层出不穷的网络攻击活动导致信息系统的安全面临极大的风险挑战。攻击图作为基于模型的网络安全风险分析技术，有助于发现网络节点间的脆弱性和评估被攻击的危害程度，已被证实是发现和预防网络安全问题的有效方法。攻击图主要分为状态攻击图和属性攻击图，由于状态攻击图存在状态爆炸的问题，研究者大多偏向于基于属性攻击图的网络风险评估研究。针对现有的属性攻击图研究过度依赖网络节点本身脆弱性和原子攻击本质属性进行量化分析，忽略了理性攻击者通常以攻击利益最大化来选择具体的攻击路径，提出了基于期望收益率攻击图的网络风险评估框架和攻击收益率量化模型。所提网络风险评估框架以公开的漏洞资源库、漏洞挖掘系统发现的新漏洞以及与网络攻防相关的大数据为基础数据源，以开源大数据平台为分析工具，挖掘计算攻击成本和攻击收益相关要素；借用经济学中的有关成本、收益以及收益率等概念构建原子攻击期望收益率计算模型；通过构建目标网络的属性攻击图，计算攻击路径上的原子攻击期望收益率，生成所有可能攻击路径的期望收益率列表；以期望目标为出发点，依据特定的优化策略（回溯法、贪心算法、动态规划）展开搜索，得到最大收益率的完整攻击路径，为网络风险评估提供依据。仿真实验结果表明了所提期望收益率攻击图网络风险评估方法的有效性及合理性，能够为发现和预防网络安全问题提供支撑。

关键词: 攻击图, 风险评估, 攻击路径, 期望收益率, 收益率攻击图

Abstract:

As Internet applications and services become more and more extensive, the endless network attacks lead to great risks and challenges to the security of information systems.As a model-based network security risk analysis technology, attack graph is helpful to find the vulnerability between network nodes and the harm of being attacked.It has been proved to be an effective method to find and prevent network security risks.Attack graph is mainly divided into state-based attack graph and attribute-based attack graph.Due to the problem of state explosion in state-based attack graph, most researchers prefer the attribute-based attack graph for network risk assessment.In view of the existing researches on attribute-based attack graph, they excessively rely on the vulnerability of network nodes and the essential attributes of atomic attack.However, they ignore that rational attackers usually choose specific attack paths by maximizing attack benefits.Then, a network risk assessment framework and a quantification method of attack benefits-rate based on expected benefits-rate attack graph were proposed.The network risk assessment framework took the open vulnerability resource database, the new vulnerabilities found by the vulnerability mining system and the big data related to network attack and defense as the basic data source.The network risk assessment framework also took the open source big data platform as the analysis tool to mine and calculate the elements related to attack cost and attack benefit.Using the concepts of cost, benefit and benefit-rate in economics, the calculation model of expected benefit-rate of atomic attack was constructed.By constructing the attribute-based attack graph of the target network, the expected benefit-rate of atomic attack on the attack path was calculated, and the expected benefit-rate list of all possible attack paths was generated.Furthermore, taking the expected goal as the starting point, the search was carried out according to the specific optimization strategy (backtracking method, greedy algorithm, dynamic programming).And the complete attack path with the maximum benefit-rate was obtained, which provided the basis for network risk assessment.The simulation results show the effectiveness and rationality of the proposed expected benefit-rate attack graph network risk assessment method, which can provide support for discovering and preventing network security problems.

Key words: attack graph, risk assessment, attack path, expected benefits-rate, attack graph of benefits-rate

中图分类号: 

No Suggested Reading articles found!