基于攻击模式的反向搜索攻击图生成算法

在使用攻击图方法分析网络中脆弱性之间关系时,网络规模一直是制约攻击图生成算法效率的根本因素.本文提出了一个基于攻击模式的高效攻击图反向生成算法.首先,对已有网络模型做出改进,提出了新型的基于网络中关键属性的模型,该模型使用子网掩码压缩网络连接关系,达到缩小网络规模的目的.其次,使用网络模型中的关键属性对脆弱性进行描述,...

A Backward Search Approach to Attack Graph Generation Based on Attack Patterns

Automated generation of attack graphs always encounters efficiency problem when using attack graphs to analyse the vulnerabilities of large networks.This paper proposes a backward approach to attack graphs generation based on attack patterns with great efficiency.Firstly,we propose a novel model of network based on the key attributes of networks,which is improved upon the previous models.This model optimizes the network connections and downsizes the network.Secondly,after abstracting a large number of vulnerabilities,we sum up a few attack patterns,based on which we build an efficiency approach to attribute attack graphs generation.Thirdly,the backward approach we propose solves the problem of loop attack paths.Finally,the experimental result shows that,our backward approach generates partial attack graphs which illustrate the potential interrelations among the known vulnerabilities just related to the given attack goal in the targeted network,while other forward approaches generate full attack graphs.And we show the experimental evidence that our attribute attack graph generation algorithm is very efficient,the complexity of the algorithm is between O(|H|2) and O(|H|3).