A Network Deception Efficiency Evaluation Method Based on Dynamic Bayesian Attack Graph

Abstract

The invention discloses a network deception defense effectiveness evaluation method based on a dynamic Bayesian attack graph, which belongs to the field of network space security. This method analyzes the vulnerability factors in the current network, infers the attacker's ability, and constructs a dynamic Bayesian attack graph model; in view of the defense characteristics of network deception and forgery of real assets, the real node and the decoy node are comprehensively compared in terms of network characteristics, device fingerprints and Consistency in many aspects such as file attributes is used to analyze the concealment of deception schemes and judge whether the defense strategy can achieve the expected effect; and update the attack graph model according to the analysis results and attack-defense confrontation information, and give quantitative indicators to evaluate deception defense effectiveness. The method of the invention can be integrated on a server serving as a control center without modifying other nodes in the network, and has good applicability.

Description

technical field [0001] The invention belongs to the field of cyberspace security, and in particular relates to a network deception effectiveness evaluation method based on a dynamic Bayesian attack graph. Background technique [0002] Cyberspace deception is a defense mechanism evolved from honeypots. It does not focus on the characteristics of attack behavior but on the attacker itself. By interfering with the attacker's cognition, it prompts the attacker to take actions that are beneficial to the defender. Since attackers generally need to rely on the information obtained by network detection to determine the next attack behavior, the cyberspace deception defense technology can forge a fake data or a fake environment for the attacker to protect important assets inside the network, and record and analyze them. Attack activity to get more information about the attacker. Cyberspace deception defense technology does not try to build a system without loopholes, nor does it del...

AI Technical Summary

Problems solved by technology

At present, most of the existing research at home and abroad is only a qualitative evaluation of the defense methods proposed by themselves, and is limited to a single defense layer (such as network layer, system layer, application layer, etc.), lacking a unified and systematic evaluation of the effectiveness of deception defense. method

Images