电信科学 ›› 2021, Vol. 37 ›› Issue (11): 75-85.doi: 10.11959/j.issn.1000-0801.2021212

• 研究与开发 • 上一篇    下一篇

基于贝叶斯攻击图的SDN安全预测方法

尹彦尚, 索同鹏, 董黎刚, 蒋献   

  1. 浙江工商大学信息与电子工程学院（萨塞克斯人工智能学院），浙江 杭州 310018
  • 修回日期:2021-09-11 出版日期:2021-11-20 发布日期:2021-11-01
  • 作者简介:尹彦尚（1998− ），女，浙江工商大学硕士生，主要研究方向为软件定义网络
    索同鹏（1995− ），男，浙江工商大学硕士生，主要研究方向为软件定义网络
    董黎刚（1973− ），男，博士，浙江工商大学信息与电子工程学院院长、教授、硕士生导师，中国电子学会高级会员，浙江省计算机学会理事，主要研究方向为新一代网络和分布式系统
    蒋献（1988− ），男，浙江工商大学实验师，主要研究方向为数字电路和模拟电路
  • 基金资助:
    浙江省重点研发计划项目(2020C01079);浙江省重点研发计划项目(2021C01036);国家自然科学基金资助项目(61871468);浙江省自然科学基金资助项目(LY18F010006);浙江省新型网络标准与应用技术重点实验室基金资助项目(2013E10012);大学生科技成果推广项目(1120KZN0220031G)

SDN security prediction method based on bayesian attack graph

Yanshang YIN, Tongpeng SUO, Ligang DONG, Xian JIANG   

  1. School of Information and Electronic Engineering (Sussex Artificial Intelligence Institute), Zhejiang Gongshang University, Hangzhou 310018, China
  • Revised:2021-09-11 Online:2021-11-20 Published:2021-11-01
  • Supported by:
    Zhejiang Province Key Research and Development Program(2020C01079);Zhejiang Province Key Research and Development Program(2021C01036);The Natural Science Foundation of China(61871468);Zhejiang Provincial Natural Science Foundation of China(LY18F010006);Zhejiang Provincial Key Laboratory of New Network Standards and Application Technology(2013E10012);University Students' Scientific and Technological Achievements Promotion Project(1120KZN0220031G)

在线阅读

17

PDF下载

144

摘要：

现有研究者采用威胁建模和安全分析系统的方法评估和预测软件定义网络（software defined network， SDN）安全威胁，但该方法未考虑SDN控制器的漏洞利用概率以及设备在网络中的位置，安全评估不准确。针对以上问题，根据设备漏洞利用概率和设备关键度结合PageRank算法，设计了一种计算SDN中各设备重要性的算法；根据SDN攻击图和贝叶斯理论设计了一种度量设备被攻击成功概率的方法。在此基础上设计了一种基于贝叶斯攻击图的SDN安全预测算法，预测攻击者的攻击路径。实验结果显示，该方法能够准确预测攻击者的攻击路径，为安全防御提供更准确的依据。

关键词: SDN安全预测, 漏洞利用概率, 攻击图, PR算法

Abstract:

Existing researchers use threat modeling and security analysis system to evaluate and predict SDN (software defined network) security threats, but this method does not consider the vulnerability utilization of SDN controller and the location of devices in the network, so the security evaluation is not accurate.In order to solve the above problems, according to the probability of device vulnerability utilization and device criticality, combined with PageRank algorithm, a algorithm to calculate the importance of each device in SDN was designed; according to SDN attack graph and Bayesian theory, a method to measure the success probability of device being attacked was designed.On this basis, a SDN security prediction method based on Bayesian attack graph was proposed to predict the attacker's attack path.Experimental results show that this method can accurately predict the attacker's attack path and provide more accurate basis for security defense.

Key words: SDN security prediction, vulnerability utilization probability, attack graph, PR algorithm

中图分类号: 

No Suggested Reading articles found!