Abstract:

In order to solve the problems of inaccurate calculation of host security value and ignoring host correlation in attack graph, a host security assessment method based on attack graph was proposed.First, the host attack graph was generated to quantify the atomic attack probability and the attack probability of the host was calculated from four perspectives, such as vulnerability itself, time, environment and operational system availability.Then, the host assets importance was calculated according to expert transcendental evaluation and correlation weighting method, and the topology importance of host was calculated according to the association relationship between hosts in attack graph.Finally, the host security value was calculated according to the impact value of host vulnerability, host importance and host attack probability.The experimental results show that the importance and security value of the proposed method accord with the real network situation and can reflect the security condition of the host more completely and accurately.The standard deviation of host safety value obtained by the proposed method is 0.078, which is larger than that obtained by other methods, indicating that the safety value obtained by the proposed method is more discrete and easier to distinguish the safety level from the subsequent risk disposal priority.

Key words: host security, attack graph, atomic attack probability, asset importance, topology importance, security assessment