基于攻击图的主机安全评估方法

doi:10.11959/j.issn.1000-436x.2022030

摘要/Abstract

摘要：

针对目前主机安全评估方法中无法准确计算主机安全值，忽略攻击图中主机关联性等问题，提出一种基于攻击图的主机安全评估方法。首先，生成主机攻击图，从漏洞自身、时间、环境和操作系统可利用性4个角度量化原子攻击概率并计算主机攻击概率。然后，根据专家先验评估和相关性定权法计算主机资产重要性，依据攻击图中主机间的关联关系计算主机的拓扑结构重要性。最后，依据主机漏洞影响值、主机重要性和主机攻击概率计算主机安全值。实验结果表明，所提方法得到的主机重要性和安全值符合真实网络情况，能够更全面准确地反映主机的安全状况；所提方法得到的主机安全值标准差为 0.078，大于其他方法得到的安全值标准差，表明所提方法得到的安全值离散程度更大，更易于区分安全等级和后续的风险处置优先级。

关键词: 主机安全, 攻击图, 原子攻击概率, 资产重要性, 拓扑结构重要性, 安全评估

Abstract:

In order to solve the problems of inaccurate calculation of host security value and ignoring host correlation in attack graph, a host security assessment method based on attack graph was proposed.First, the host attack graph was generated to quantify the atomic attack probability and the attack probability of the host was calculated from four perspectives, such as vulnerability itself, time, environment and operational system availability.Then, the host assets importance was calculated according to expert transcendental evaluation and correlation weighting method, and the topology importance of host was calculated according to the association relationship between hosts in attack graph.Finally, the host security value was calculated according to the impact value of host vulnerability, host importance and host attack probability.The experimental results show that the importance and security value of the proposed method accord with the real network situation and can reflect the security condition of the host more completely and accurately.The standard deviation of host safety value obtained by the proposed method is 0.078, which is larger than that obtained by other methods, indicating that the safety value obtained by the proposed method is more discrete and easier to distinguish the safety level from the subsequent risk disposal priority.

Key words: host security, attack graph, atomic attack probability, asset importance, topology importance, security assessment

中图分类号:

TP393.08

杨宏宇, 袁海航, 张良. 基于攻击图的主机安全评估方法[J]. 通信学报, 2022, 43(2): 89-99.

Hongyu YANG, Haihang YUAN, Liang ZHANG. Host security assessment method based on attack graph[J]. Journal on Communications, 2022, 43(2): 89-99.

图/表 18

图1

图2

表1

图3

图4

表2

表3

图5

图6

表4

表5

表6

表7

图7

表8

图8

图9

表9

参考文献 18

[1]	吴晨思, 谢卫强, 姬逸潇 ,等. 网络系统安全度量综述[J]. 通信学报, 2019,40(6): 14-31.
	WU C S , XIE W Q , JI Y X ,et al. Survey on network system security metrics[J]. Journal on Communications, 2019,40(6): 14-31.
[2]	丁绍虎, 齐宁, 郭义伟 . 基于 M-FlipIt 博弈模型的拟态防御策略评估[J]. 通信学报, 2020,41(7): 186-194.
	DING S H , QI N , GUO Y W . Evaluation of mimic defense strategy based on M-FlipIt game model[J]. Journal on Communications, 2020,41(7): 186-194.
[3]	罗智勇, 杨旭, 刘嘉辉 ,等. 基于贝叶斯攻击图的网络入侵意图分析模型[J]. 通信学报, 2020,41(9): 160-169.
	LUO Z Y , YANG X , LIU J H ,et al. Network intrusion intention analysis model based on Bayesian attack graph[J]. Journal on Communications, 2020,41(9): 160-169.
[4]	席荣荣, 云晓春, 张永铮 . 基于环境属性的网络威胁态势量化评估方法[J]. 软件学报, 2015,26(7): 1638-1649.
	XI R R , YUN X C , ZHANG Y Z . Quantitative threat situational assessment based on contextual information[J]. Journal of Software, 2015,26(7): 1638-1649.
[5]	SHAN C , GAO J , HU C Z ,et al. Network risk assessment method based on asset correlation graph[C]// Trusted Computing and Information Security. Berlin:Springer, 2019: 65-83.
[6]	POKHREL N R , TSOKOS C P . Cybersecurity:a stochastic predictive model to determine overall network security risk using Markovian process[J]. Journal of Information Security, 2017,8(2): 91-105.
[7]	李欢 . 基于贝叶斯网络攻击图的动态风险评估方法研究[D]. 秦皇岛:燕山大学, 2019.
	LI H . Research on dynamic risk assessment method based on Bayesian network attack diagram[D]. Qinhuangdao:Yanshan University, 2019.
[8]	HU H , ZHANG H Q , YANG Y J . Security risk situation quantification method based on threat prediction for multimedia communication network[J]. Multimedia Tools and Applications, 2018,77(16): 21693-21723.
[9]	HU W H , ZHANG L , LIU X Y ,et al. Research on automatic generation and analysis technology of network attack graph[C]// Proceedings of 2020 IEEE 6th Intl Conference on Big Data Security on Cloud (BigDataSecurity),IEEE Intl Conference on High Performance and Smart Computing,(HPSC) and IEEE Intl Conference on Intelligent Data and Security. Piscataway:IEEE Press, 2020: 133-139.
[10]	WANG W R , SHI F , ZHANG M ,et al. A vulnerability risk assessment method based on heterogeneous information network[J]. IEEE Access, 2020,8: 148315-148330.
[11]	SUN X Y , DAI J , LIU P ,et al. Using Bayesian networks for probabilistic identification of zero-day attack paths[J]. IEEE Transactions on Information Forensics and Security, 2018,13(10): 2506-2521.
[12]	李鑫 . 基于攻击图的网络安全评估技术研究与实现[D]. 北京:北京邮电大学, 2017.
	LI X . Research and implementation of network security assessment technology based on attack graph[D]. Beijing:Beijing University of Posts and Telecommunications, 2017.
[13]	RUOHONEN J . A look at the time delays in CVSS vulnerability scoring[J]. Applied Computing and Informatics, 2019,15(2): 129-135.
[14]	FREI S , MAY M , FIEDLER U ,et al. Large-scale vulnerability analysis[C]// Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense-LSAD’06. New York:ACM Press, 2006: 131-138.
[15]	葛海慧 . 信息安全风险多维动态管理模型及相关评估方法研究[D]. 北京:北京邮电大学, 2015.
	GE H H . Research on the multidimensional and dynamic information security risk management model and the related assessment algorithms[D]. Beijing:Beijing University of Posts and Telecommunications, 2015.
[16]	WANG R Y , GAO L , SUN Q ,et al. An improved CVSS-based vulnerability scoring mechanism[C]// Proceedings of 2011 Third International Conference on Multimedia Information Networking and Security. Piscataway:IEEE Press, 2011: 352-355.
[17]	国家质量监督检验检疫总局,中国国家标准化管理委员会. 信息安全技术信息安全风险评估规范:GB/T 20984-2007[S]. 北京:中国标准出版社, 2007.
	General Administration of Quality Supervision,Inspection and Quarantine of the People’s Republic of China,Standardization Administration of the People’s Republic of China. Information security technology-risk assessment specification for information security:GB/T 20984-2007[S]. Beijing:Standards Press of China, 2007.
[18]	周爱民, 周彩霞, 欧阳晋焱 ,等. 基于指标适度标准化的界面风格美综合评价模型[J]. 浙江大学学报(工学版), 2020,54(12): 2273-2285.
	ZHOU A M , ZHOU C X , OUYANG J Y ,et al. Model of synthetic evaluation on interface stylistic beauty based on moderately standardized of index[J]. Journal of Zhejiang University (Engineering Science), 2020,54(12): 2273-2285.

属性	等级标识	重要性赋值
	高（L₁）	5
	较高（L₂）	4
机密性C	一般（L₃）	3
	较低（L₄）	2
	低（L₅）	1
	高（L₁）	5
	较高（L₂）	4
完整性I	一般（L₃）	3
	较低（L₄）	2
	低（L₅）	1
	高（L₁）	5
	较高（L₂）	4
可用性A	一般（L₃）	3
	较低（L₄）	2
	低（L₅）	1

主机	N_attack	N_{host_1}	N_{host_2}	N_{host_3}	N_{host_4}	N_{host_5}	N_{host_6}	N_{host_7}	N_{host_8}	N_{host_9}
N_attack	—	连通	连通	连通	—	—	—	—	—	—
N_{host_1}	—	—	连通	—	—	—	连通	—	—	—
N_{host_2}	—	—	—	—	—	—	连通	—	—	—
N_{host_3}	—	—	连通	—	连通	连通	—	—	—	—
N_{host_4}	—	—	—	—	—	—	—	—	连通	—
N_{host_5}	—	—	—	—	—	—	连通	—	—	—
N_{host_6}	—	—	—	—	—	—	—	连通	—	—
N_{host_7}	—	—	—	—	—	—	—	—	—	—
N_{host_8}	—	—	—	—	—	连通	—	—	—	连通
N_{host_9}	—	—	—	—	—	连通	—	—	—	—
注：—表示未连通。

主机	主机名称	漏洞CVE标识	VE
N_{host_1}	管理控制主机	CVE-2014-0226(f₁)	0.859
N_{host_2}	应用服务器	CVE-2015-1635(f₂)	1
N_{host_3}	应用服务器	CVE-2015-2578(f₃)	0.859
		CVE-2016-3125(f₄)	1
N_{host_4}	业务主机	CVE-2015-0014(f₅)	1
N_{host_5}	业务主机	CVE-2007-0038(f₆)	0.859
N_{host_6}	数据库服务器	CVE-2016-0639(f₇)	1
		CVE-2016-3471(f₈)	0.392
		CVE-2016-3477(f₉)	0.314
N_{host_7}	备份数据库服务器	CVE-2016-3461(f₁₀)	0.315
N_{host_8}	配置管理主机	CVE-2006-2370(f₁₁)	1
N_{host_9}	运行监控主机	CVE-2003-0252(f₁₂)	1

主机	攻击路径	最大攻击概率
N_{host_1}	N_attack-N_{host_1}	0.21
	N_attack-N_{host_2}
N_{host_2}	N_attack-N_{host_1}-N_{host_2}	0.49
	N_attack-N_{host_3}-N_{host_2}
N_{host_3}	N_attack-N_{host_3}	0.24
N_{host_4}	N_attack-N_{host_3}-N_{host_4}	0.16
	N_attack-N_{host_3}-N_{host_5}
N_{host_5}	N_attack-N_{host_3}-N_{host_4}-N_{host_8}-N_{host_5}	0.14
	N_attack-N_{host_3}-N_{host_4}-N_{host_8}-N_{host_9}-N_{host_5}
	N_attack-N_{host_1}-N_{host_6}
	N_attack-N_{host_2}-N_{host_6}
	N_attack-N_{host_1}-N_{host_2}-N_{host_6}
N_{host_6}	N_attack-N_{host_3}-N_{host_2}-N_{host_6}	0.1
	N_attack-N_{host_3}-N_{host_5}-N_{host_6}
	N_attack-N_{host_3}-N_{host_4}-N_{host_8}-N_{host_5}-N_{host_6}
	N_attack-N_{host_3}-N_{host_4}-N_{host_8}-N_{host_9}-N_{host_5}-N_{host_6}
	N_attack-N_{host_1}-N_{host_6}-N_{host_7}
	N_attack-N_{host_2}-N_{host_6}-N_{host_7}
	N_attack-N_{host_1}-N_{host_2}-N_{host_6}-N_{host_7}
N_{host_7}	N_attack-N_{host_3}-N_{host_2}-N_{host_6}-N_{host_7}	0.005
	N_attack-N_{host_3}-N_{host_5}-N_{host_6}-N_{host_7}
	N_attack-N_{host_3}-N_{host_4}-N_{host_8}-N_{host_5}-N_{host_6}-N_{host_7}
	N_attack-N_{host_3}-N_{host_4}-N_{host_8}-N_{host_9}-N_{host_5}-N_{host_6}-N_{host_7}
N_{host_8}	N_attack-N_{host_3}-N_{host_4}-N_{host_8}	0.14
N_{host_9}	N_attack-N_{host_3}-N_{host_4}-N_{host_8}-N_{host_9}	0.11

主机	漏洞影响值
N_{host_1}	6.4
N_{host_2}	10
N_{host_3}	9.8
N_{host_4}	10
N_{host_5}	10
N_{host_6}	26.4
N_{host_7}	6.4
N_{host_8}	6.4
N_{host_9}	10