Network attack stage statistics and prediction method based on Markov chain

Abstract

The invention discloses a network attack stage statistics and prediction method based on a Markov chain, and the method specifically comprises the steps: building a state transition matrix based on the Markov chain, building a state space according to the attack process of a network attack killing chain, and carrying out the probability statistics of the attack state transition of each attack method in the attack process; establishing a Markov chain state transition matrix; correcting the state transition matrix based on the Markov chain, and correcting missing or wrong state data caused by incomplete statistical data in the state transition matrix based on the Markov chain; and predicting an attack stage in the network attack killer chain by using a Markov chain model. According to the method, a network attack chain and a Markov chain which are widely used are combined, so that network attack event statistics is more suitable for being applied to prediction, and the accuracy of an attack prediction model is improved.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a method for using a Markov chain in a network killing chain to carry out statistics and prediction on a network attack stage. Background technique [0002] Usually, a network attack is composed of multiple attack stages, in which the success of the previous stage can trigger the next stage; and the failure of one stage means the failure of the entire attack. If the network attack detection is comprehensive and accurate, we can see that each attack method is connected from one stage to another, and the entire attack stage is similar to a chain. However, due to the long span of network attack events and many attack points (springboards, zombies, reflectors, etc.), it is extremely difficult to completely detect all stages of network attacks, resulting in the inability to fully grasp the entire network attack process. Accurately count the attack methods that oc...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the problems of incomplete attack statistical data and large statistical deviation based on the incomplete data existing in the existing network attack statistical methods, the present invention discloses a network attack stage statistics and prediction method based on Markov chain, which is based on The state transition matrix in the Markov chain counts the detected network attack events, and makes appropriate corrections to the statistical results according to the characteristics of the transition matrix, and then uses the Markov chain to predict the attack stage that may occur later based on the transition matrix

Therefore, this method can effectively avoid the problem of large prediction deviation caused by incomplete statistics of the attack stage in the attack chain

Images