基于攻击树的信息系统安全度量

首先介绍了当前信息系统安全领域研究的现状，指出定量研究正逐渐成为研究的热点。然后介绍了攻击树的概念，并利用其特点对当前比较常见的缓冲区溢出攻击进行定量的建模分析，并对分析过程中用到的概念进行了定义。通过分析发现，利用攻击树模型对信息系统安全进行度量，是比较好的选择。最后对本模型的特点进行了讨论。

Information System Security Metrics Based on Attack Tree

The paper introduces the actuality of information system security research and points out that information system security metrics attracts lots of interests,then introduces the concept of attack trees and tries to use it to establish a model which is used to describe the buffer overflow attacks.Several concepts is defined to describe this model precisely.Throughout analysis,the attack tree model is a good choice to describe the information system security,finally,discusses the characteristics of this model.