Method for generating attack graphs based on status transition network attack model

Abstract

The invention provides a method for generating attack graphs based on a status transition network attack model. According to the method, a queue structure is used to save status nodes that can be added to an attack graph, and then one of the status nodes is taken from the queue. Starting from the taken status node, other status nodes related to the taken status node are searched for. If the vulnerability of one other status node can be reached by attacking, and the depth and cost of vulnerability attacking are within acceptable limits, the other status node is joined in both of the queue and the attack graph, in such a way, the status nodes in the queue are looped out in sequence, the loop ends till the queue becomes empty, and the attack graph is generated. During estimation of the attacking cost, the correlation between the attack complexity value Acx and the risk value of being found Dsk is considered, which improves the generating accuracy of the attacking graph. In addition, by means of simulation experiments, the attack graph generated by the embodiment of the invention is more concise than that generated before the improvement disclosed in the invention.

Description

technical field [0001] The invention relates to network attack technology, in particular to an attack graph generation method based on a state transition network attack model. Background technique [0002] The factors affecting the security of the network are multi-faceted and multi-angled. The weaknesses and vulnerabilities in the network are one of the important factors affecting its security. The attacker's attack on the weakness in the network is actually based on the weakness information in the network and the target information, and uses some means to launch an attack to obtain important information or enhance the operation authority. At the same time, the attacker's ability, experience and dominating environment determine his attack success probability. Therefore, an attack targeting a vulnerability is usually a complex multi-step process. A complete attack process generally includes a series of individual attack behaviors, which occur in different network parts but ...

AI Technical Summary

Problems solved by technology

[0005] Ritchey et al. proposed a model detector method that can automatically generate attack graphs. Although this method can automatically generate attack graphs, it can easily lead to state explosion problems and is not suitable for large-scale applications because the model contains all states. scale network

[0006] DapengMan's global attack graph generation algorithm based on breadth-first search reduces the scale of the attack graph by setting a threshold. Although this method can reduce the scale of the attack graph, due to the limitations of breadth-first search, this method generates The attack graph is not suitable for large-scale networks

[0007] The research of senior experts has made considerable achievements in related fields, but in the attack graph modeling process, the selected constraints are different and the emphasis on quantitative indicators is different, resulting in different attack graphs.

At the same time, the inevitable existence of redundant paths in the attack graph not only increases the scale of the attack graph but also affects the objectivity and accuracy of reflecting the real network

Images