基于属性攻击图的动态威胁跟踪与量化分析技术研究

网络多告警信息融合处理是有效实施网络动态威胁分析的主要手段之一。基于此该文提出一种利用网络系统多告警信息进行动态威胁跟踪与量化分析的机制。该机制首先利用攻击图理论构建系统动态威胁属性攻击图；其次基于权限提升原则设计了前件推断算法(APA)、后件预测算法(CPA)和综合告警信息推断算法(CAIIA)进行多告警信息的融合与威胁分析，生成网络动态威胁跟踪图进行威胁变化态势的可视化展示。最后通过实验验证了该机制和算法的有效性。

Research on Dynamic Threat Tracking and Quantitative Analysis Technology Based on Attribute Attack Graph

Network multi-alarm information fusion processing is one of the most important methods to implement effectively network dynamic threat analysis. Focusing on this, a mechanism for dynamic threat tracking and quantitative analysis by using network system multi-alarm information is proposed. Firstly, the attack graph theory is used to construct the system dynamic threat attribute attack graph. Secondly, based on the privilege escalation principle, Antecedent Predictive Algorithm(APA), the Consequent Predictive Algorithm(CPA) and the Comprehensive Alarm Information Inference Algorithm(CAIIA) are designed to integrate the multi-alarm information fusion and do threat analysis. Then, the network dynamic threat tracking graph is generated to visualize the threat change situation. Finally, the effectiveness of the mechanism and algorithm is validates through experiments.