Intrusion response measure determination method and device

Abstract

The embodiment of the invention provides an intrusion response measure determination method and device, and the method comprises the steps: determining one or more attack paths according to each nodein an attack tree and a node relationship; determining the security utility of candidate response measures which can be used for blocking the attack path; based on multiple iterations of a greedy algorithm, selecting candidate response measures with the maximum security effectiveness for each attack path to form a measure set so as to realize intrusion prevention; wherein in each iteration process, the candidate response measure with the maximum safety effect is selected from the candidate response measures of the attack path to be blocked, the response measure selected this time serves as a deployed measure, and the safety effects of the candidate response measures of the remaining attack path to be blocked are recalculated and used for next iteration selection. According to the method, the overall security effectiveness when a plurality of attack paths are coped can be improved to the maximum extent, and the optimal coping for multi-path attacks is realized.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a method and device for determining an intrusion response measure. Background technique [0002] Network attack techniques are becoming more and more complex and diverse, making it possible for attackers to use multiple paths to invade targets. For example, to steal data, attackers can use both SQL injection attacks and man-in-the-middle attacks. Therefore, it is extremely important to design a suitable Intrusion Response System (IRS) to deal with complex attacks. Since countermeasures will bring both positive effects (such as improving safety performance) and negative effects (such as service quality degradation), how to choose response measures is very important. Traditional intrusion response measures dynamically identify optimal response measures by weighing attack loss and response cost. However, this method ignores the fact that the attacker may achi...

AI Technical Summary

Problems solved by technology

However, this method ignores the fact that the attacker may achieve the intrusion of the target through multiple attack paths, thereby increasing the probability of success

[0003] Since a single response measure is difficult to meet the needs of responding to multiple attack paths, we need to select a reasonable response measure for each exploited attack path

Considering the situation of multiple attack paths, the current method responds to the attack by selecting the optimal response measures for each path independently, but this method ignores the interaction between the response measures of multiple attack paths

Images