Multi-step attack prediction method based on cause-and-effect Byesian network

Abstract

The invention relates to a multi-step attack prediction method based on a cause-and-effect Byesian network. First of all, a multi-step attack mode in an attack scene sample is mined by use of a frequent mode, the multi-step attack mode is depicted through a cause-and-effect Byesian network mode, based on this, a probability of future attacks is calculated through attack evidence, and thus next-step attack behaviors of network multi-step attacks and attack intensions of attackers can be predicted. According to the invention, a multi-step attack prediction method of manually constructing a network attack structure graph is optimized, the multi-step attack mode is mined automatically based on a frequent sequence mode, by means of the cause-and-effect Byesian network mode, the attack mode is depicted, network parameters are learnt, next-step attacks and the attack attentions are predicted, the attack prediction capability for unknown changing multi-step attack modes is improved, next-step attack means and a final attack attention of the multi-step attacks can be rapidly and accurately predicted, and the method has great realistic significance for safeguarding network and computer information security.

Description

technical field [0001] The invention belongs to the technical field of computer network communication, in particular to a multi-step attack prediction method based on a causal Bayesian network. Background technique [0002] With the rapid development of computer network technology, network security issues have increasingly become the focus of attention in the network field. Network attacks are becoming more frequent and the means more diverse and complex, resulting in more and more serious threats to network security. At present, the proportion of multi-step attacks in network attacks is very high. It is a complete attack composed of multiple different attack steps. The attack behavior is not obvious in the early stage, but when the attack is detected, it has already brought great harm to the attack target. serious damage. Quickly and accurately predicting the next attack method and final attack intention of a multi-step attack has important practical significance for prot...

AI Technical Summary

Problems solved by technology

[0004] In order to overcome the deficiencies in the prior art, the present invention provides a multi-step attack prediction method based on the causal Bayesian network, which realizes automatic mining of multi-step attack patterns, reasoning and prediction of the next attack and the final attack, and solves the problem of manually constructing attack patterns and The method of setting prediction parameters cannot well adapt to the problem of dynamic changes in network attack patterns

Images