A method for analyzing network attacker behavior based on attack graph

Abstract

The invention discloses a network attacker behavior analyzing method based on an attack graph. The method comprises the steps of establishing a network attacker behavior analyzing model and attracting attacks of attackers; carrying out comprehensive capturing on attack data through a data capturing mechanism; and generating an attack state transfer graph through combination of a finite-state machine and analyzing behaviors of the attackers according to possibility indexes of attack behaviors, skill level indexes of the attackers and destination indexes of the attackers. According to the network attacker behavior analyzing method based on the attack graph provided by the invention, the good foundation can be laid for design of an active defense system, the network attacks can be defended, the attacks can be prevented before the network attacks occur, one part of the attacks are screened, a cybercrime can be effectively prevented, the defense efficiency is improved, and the defense cost is reduced.

Description

technical field [0001] The invention relates to the field of active attack defense systems, in particular to an attack graph-based network attacker behavior analysis method. Background technique [0002] With the rapid development of computer networks, there are more and more ways of network attacks. Traditional network intrusion prevention technologies, such as firewalls and intrusion detection systems, have been difficult to deal with the endless attacks. In particular, most of these practical technologies are passive defense types, and cannot defend against the latest attacks in a timely manner. Although firewalls can prevent network attacks and improve network security to a certain extent, with the development of network attack technologies and the continuous emergence of tools, the weaknesses of firewalls will be exposed slowly, and attackers will easily Breaking through this layer of protection, another fatal flaw is the inability to protect against virus attacks. I...

AI Technical Summary

Problems solved by technology

However, since the rule database and intrusion analysis module of the intrusion detection system need to change continuously with the emergence of new attack technologies, and the system cannot detect attacks that are not in the rule base, the intrusion detection system will fail to respond to the attack in time and respond to errors. The phenomenon

Images