摘要
高级可持续性威胁(advanced persistent threat,APT)具有行为隐蔽性强、攻击周期持久的特点,增加了攻击检测的难度。据此,引入攻击图理论评估网络系统在APT攻击下的脆弱节点,提出了一种基于攻击图的APT脆弱节点评估方法,有效地提高了发现攻击的概率。对APT攻击行为的异常特征进行提取和定义,对目标网络系统建立风险属性攻击图(risk attribute attack graph,RAAG)模型;基于APT攻击行为特征的脆弱性对系统节点的行为脆弱性进行评估,并以通用漏洞评分系统(common vulnerability scoring system,CVSS)标准做为参照评估系统节点的通联脆弱性;基于上述2个方面的评估,计算系统中各节点的整体脆弱性,并发现目标网络系统在面向APT攻击时的脆弱节点。实验结果表明,所提方法能够对APT攻击行为特征进行合理量化,对系统节点的脆弱性进行有效评估,在APT攻击检测率上有较好表现。
; The stealthy attack behaviors and long-term attack period of advanced persistent threats cause greater difficulty of attack detection. Based on that, the theoiy of attack graph is introduced into the research of anti-APT attack and the method for assessing vulnerable system nodes on the basis of attack graph is proposed. Firstly, the abnormal characteristics of APT attack is abstracted and defined to establish the Risk Attribute Attack Graph of targeted network system. Secondly, the be-havior-vulnerability of system nodes are evaluated based on the characteristics of attack behaviors and the transmission-vul-nerability of system nodes are evaluated based on the attack graph model. Finally, the overall-vulnerability is calculated to assess the vulnerable node. The experimental result shows that the proposed method can effectively quantify the characteris-tics of attack behavior and evaluate the vulnerability of system nodes.
出处
《重庆邮电大学学报（自然科学版）》
CSCD
北大核心
2017年第4期535-541,共7页
Journal of Chongqing University of Posts and Telecommunications(Natural Science Edition)
基金
重庆市社会科学规划项目(2014SKZ26
2014YBFX103)
国家科技支撑计划项目(2015BAH29F01)~~
作者简介
通讯作者：黄永洪flcxxLlinux@163.com黄永洪（1974―）,男,重庆人,讲师,硕士,主要研究方向为信息安全和电子证据.瓦-mail：flood_linux@163.com.
吴一凡（1993-）,女,贵州凯里人,硕士研究生,主要研究方向为机器学习与可视计算.E-mail：629406177@qq.com.
杨豪璞（1993-）,女,湖北武汉人,硕士研究生,主要研究方向为信息安全.E-mail：memo_yang@163.com.
李翠（1993-）,女,山东菏泽人,硕士研究生,主要研究方向为电子证据.E-mail：369660533@qq.com.
