Network security situation evaluation method for multi-step attack

Aiming at analyzing the influence of multi-step attack,as well as reflecting the system’s security situation accurately and comprehensively,a network security situation evaluation method for multi-step attack was proposed.This method firstly clustered security events into several attack scenes,which was used to identify the attacker.Then the attack path and the attack phase were identified by causal correlation of every scene.Finally,combined with the attack phase as well as the threat index,the quantitative standard was established to evaluate the network security situation.The proposed method is assessed by two network attack-defense experiments,and the results illustrate accuracy and effectiveness of the method.     

基于贝叶斯攻击图的SDN安全预测方法

现有研究者采用威胁建模和安全分析系统的方法评估和预测软件定义网络（software defined network, SDN）安全威胁,但该方法未考虑SDN控制器的漏洞利用概率以及设备在网络中的位置,安全评估不准确。针对以上问题,根据设备漏洞利用概率和设备关键度结合PageRank算法,设计了一种计算SDN中各设备重要性的算法;根据SDN攻击图和贝叶斯理论设计了一种度量设备被攻击成功概率的方法。在此基础上设计了一种基于贝叶斯攻击图的SDN安全预测算法,预测攻击者的攻击路径。实验结果显示,该方法能够准确预测攻击者的攻击路径,为安全防御提供更准确的依据。     

Attack path prediction method based on causal knowledge net

The existing attack path prediction methods can not accurately reflect the variation of the following attack path caused by the capability of the attacker.Accordingly an attack path prediction method based on causal knowledge net was presented.The proposed method detected the current attack actions by mapping the alarm sets to the causal knowledge net.By analyzing the attack actions,the capability grade of the attacker was inferred,according to which adjust the probability knowledge distribution dynamically.With the improved Dijkstra algorithm,the most possible attack path was computed.The experiments results indicate that the proposed method is suitable for a real network confrontation environment.Besides,the method can enhance the accuracy of attack path prediction.     

基于攻击图的主机安全评估方法

针对目前主机安全评估方法中无法准确计算主机安全值,忽略攻击图中主机关联性等问题,提出一种基于攻击图的主机安全评估方法.首先,生成主机攻击图,从漏洞自身、时间、环境和操作系统可利用性4个角度量化原子攻击概率并计算主机攻击概率.然后,根据专家先验评估和相关性定权法计算主机资产重要性,依据攻击图中主机间的关联关系计算主机的拓...     

基于细胞自动机模型电力网络攻击预测技术

传统电力网络攻击范围预测技术的预测范围不够广,导致电力网络安全性提升效果不明显。为此,提出基于细胞自动机模型的电力网络攻击预测技术。搭建电力细胞自动机模型,将细胞自动机中的细胞看作电力细胞,建立细胞活力值转换规则,将其与攻击者执行攻击概率相结合,预测电力细胞的发展变化。根据中心电力细胞及邻域电力细胞的变化趋势预测电力网络攻击。实验结果表明：在时间因素影响下,提出的基于细胞自动机模型电力网络攻击预测技术的预测攻击节点位置与原始节点基本一致,预测后负荷切除量始终在100 MW以下,本文所提技术的有效性更好。     

The new threat to internet: DNP attack with the attacking flows strategizing technology

Distributed network paralyzing (DNP) attack, a kind of distributed denial‐of‐service attack that utilize botnet to congest and paralyze autonomous system level network, is a serious threat to network security. In this article, it is indicated that the most difficulty of DNP attack is strategizing DNP attacking flows automatically from the perspective of the attacker. For this outstanding issue, we introduce the DNP attacking flows strategizing technology, which can help an attacker to launch DNP attack efficiently through a series of attacking resources division–target links and attacking paths orientation–flux planning process. Through simulation, we demonstrate that the feasibility of attacking flows strategizing technology and prove that an attacker who controls a large‐scale botnet can utilize DNP attack to seriously threat the network security. At last, from the perspective of the defender, it is indicated that the network security researcher should strengthen the relevant research to defend the DNP attack. Copyright © 2014 John Wiley & Sons, Ltd.     

Research on DDoS detection in multi-tenant cloud based on entropy change

An attacker compromised a number of VMs in the cloud to form his own network to launch a powerful distrib-uted denial of service (DDoS) attack.DDoS attack is a serious threat to multi-tenant cloud.It is difficult to detect which VM in the cloud are compromised and what is the attack target,especially when the VM in the cloud is the victim.A DDoS detection method was presented suitable for multi-tenant cloud environment by identifying the malicious VM at-tack sources first and then the victims.A distributed detection framework was proposed.The distributed agent detects the suspicious VM which generate the potential DDoS attack traffic flows on the source side.A central server confirms the real attack flows.The feasibility and effectiveness of the proposed detection method are verified by experiments in the multi-tenant cloud environment.     

攻击图的网络威胁自动建模方法研究

为了增强网络的安全性,对网络整体进行威胁分析和评估应用,结合攻击图的特点,研究并提出了一种攻击图的网络威胁自动化建模方法。在攻击图生成之前,抽象出网络威胁数学模型,包括主机信息、拓扑信息、漏洞信息和攻击者信息四个组成部分。并针对所建的网络威胁模型提出自动建模方法和具体的自动化流程。基于此,结合攻击事件的Büchi模型和CTL描述,使用符号模型检验算法自动生成攻击图,为攻击图的应用奠定基础。     

基于CSS的认知无线电网络PUEA检测和缓解

针对认知无线电网络中的主用户仿真攻击问题,提出了一种基于能量检测的协作频谱感知方法.首先,假设存在一个智能攻击者,它能知道自己所处环境并可以选择不同的传输策略.然后,调整CSS规则和相关参数为能量探测器确定合适且有效的阈值.最后,利用Neyman-Pearson准则进行能量检测,从而检测出恶意攻击.仿真结果表明,相比传统的基于能量检测的频谱感知方法,该方法可以更好地减轻PUEA在频谱感知中的破坏作用.     

一种基于攻击图模型的网络安全评估方法

随着网络的深入和快速发展,网络安全问题日益严峻,研究网络安全的评估方法,具有重要的现实意义。安全漏洞的大量存在是安全问题的总体形势趋于严峻的重要原因之一。详细介绍了攻击图建模方法,给出了攻击图自动生成算法,提出了一种利用数学模型分析攻击图,并对网络系统进行安全评估的方法,最后通过一个虚拟网络环境对网络安全评估方法进行了验证。该方法对攻击图的研究具有现实意义。     

基于攻击图模型的网络安全态势评估方法

针对网络攻击出现的大规模、协同、多阶段的特点,提出一种基于攻击图模型的网络安全态势评估方法.首先,结合攻击事件的时空特征融合多源告警数据构建网络攻击行为特征;其次,基于告警信息映射攻击节点,关联多步攻击的路径;再次,在构建攻击图的基础上,结合转移序列构建攻击节点转移概率表,将转移概率引入攻击图中,推断攻击者的攻击意图;...     

双重数字水印的抗攻击安全性分析

为了使计算机网络更好地为人类服务,必须很好地解决网络的信息安全问题。数字水印是实现版权保护的有效办法,但目前尚没有一个算法能够真正经得住攻击者所有种类的攻击。笔者通过对攻击原理进行分析,提出解决的对策,重点介绍了利用双水印技术对抗解释攻击的方法。了解这些攻击以及可能还会有的新的攻击方法将助于我们设计出更好的水印方案。     

有组织的网络攻击行为结果的建模

用数学的方法分析了有组织的网络攻击行为对网络信息系统造成的影响，首先对攻击者、被攻击对象、攻击行为和攻击结果进行定义，提出三条模型假设，然后分别针对个人攻击结果和有组织的攻击结果进行建模，对模型结果进行了讨论，最后提出几点安全建议并说明了进一步研究的思路。     

蝙蝠算法优化RVM的校园网络安全研究

传统的应对网络威胁的手段是根据所发生的攻击针对性的提供补救措施,但是这种方式具有较强的滞后性,已难以满足现在快节奏的网络运行环境。如何提供一种对网络安全状况的量化指标,根据对网络安全的走势进行预测已经成为了如今的研究热点。文中针对网络安全的量化评估与预测问题,首先,提出了一种基于层次化评估模型的方法,实现了对网络安全态势的量化手段,将其从定性分析上升到了定量分析;其次,提出了一种基于相关向量机的网络安全态势预测模型,并通过蝙蝠算法提升了该模型的运行效率;最后,通过数据集的样本学习,验证了预测方法的有效性,该方法具有较高的精度和可靠性。     

Survey on application of attack graph technology

Attack graph technology was a measure to predict the pattern and process used by attacker to compromise the target network,so as to guide defender to take defensive measures and improve network security.The basic component,types of attack graphs and respective advantages and disadvantages of each type were reviewed.The application status of attack graph technology in risk assessment and network hardening,intrusion detection and alarm correlation,and other aspects were introduced.Several kinds of existing attack graph generation and analysis tools were also presented.At last a survey of some challenges and research trends in future research work was provided.     

项目反应理论在实时网络风险评估中的应用

为提高传统网络风险评估方法的准确性,针对大部分网络风险评估方法未考虑攻击能力值的问题,提出了一种基于项目反应理论的实时网络风险评估方法。该方法利用项目反应理论引入的攻击能力值参数以及服务安全等级参数,对传统攻击威胁值和攻击成功概率计算方法进行改进,并采用三标度层次分析法构建出更准确的服务重要性权重,最终获得符合网络环境的评估态势。仿真结果表明：该方法可以提高评估结果的准确度,并实时地绘制更符合真实网络环境的安全态势图。     

Network intrusion intention analysis model based on Bayesian attack graph

Aiming at the problem of ignoring the impact of attack cost and intrusion intention on network security in the current network risk assessment model,in order to accurately assess the target network risk,a method of network intrusion intention analysis based on Bayesian attack graph was proposed.Based on the atomic attack probability calculated by vulnerability value,attack cost and attack benefit,the static risk assessment model was established in combination with the quantitative attack graph of Bayesian belief network,and the dynamic update model of intrusion intention was used to realize the dynamic assessment of network risk,which provided the basis for the dynamic defense measures of attack surface.Experiments show that the model is not only effective in evaluating the overall security of the network,but also feasible in predicting attack paths.     

分布式DNS反射DDoS攻击检测及控制技术

分布式DNS反射DDoS攻击已经成为拒绝服务攻击的主要形式之一,传统的基于网络流量统计分析和网络流量控制技术已经不能满足防护需求。提出了基于生存时间值（TTL）智能研判的DNS反射攻击检测技术,能够准确发现伪造源IP地址分组;基于多系统融合的伪造源地址溯源阻断技术,从源头上阻断攻击流量流入网络。     

DDoS attack detection method based on conditional entropy and GHSOM in SDN

Software defined networking (SDN) simplifies the network architecture,while the controller is also faced with a security threat of “single point of failure”.Attackers can send a large number of forged data flows that do not exist in the flow tables of the switches,affecting the normal performance of the network.In order to detect the existence of this kind of attack,the DDoS attack detection method based on conditional entropy and GHSOM in SDN (MBCE&G) was presented.Firstly,according to the phased features of DDoS,the damaged switch in the network was located to find the suspect attack flows.Then,according to the diversity characteristics of the suspected attack flow,the quaternion feature vector was extracted in the form of conditional entropy,as the input features of the neural network for more accurate analysis.Finally,the experimental environment was built to complete the verification.The experimental results show that MBCE&G detection method can effectively detect DDoS attacks in SDN network.     

网络安全态势的云预测

针对现有网络安全态势预测算法存在的主观因素影响较大、预测结果与选取数据关联程度较高的情况,以云的网络安全态势预测规则挖掘算法为基础,提出了一个改进算法。该改进算法不仅拥有原挖掘算法无需对初始数据进行预先处理的优点,同时避免了预测规则与实际情况相孤立造成预测错误的情况,并通过实验验证了算法的可行性和有效性。基于云的网络安全态势预测改进算法,有效地提高了网络安全态势预测的准确性。