【摘要】 针对传统安全威胁评估方法难以理解攻击渗透的相关性,且难以量化相关渗透对于网络环境的影响问题,结合攻击图渗透动作危害性、渗透相关性和主机业务重要性,提出双向威胁评估模型和计算方法,能衡量攻击的深入程度和对目标的威胁程度,最后提出了一个能应用于实时告警分析的攻击序列评估方法,并通过实验验证了所提模型的合理性和有效性.更多还原

【Abstract】 For being not falling in as final targets of attackers,the critical resources in network environments should be protected. It is vital to quantify the threat and impact during the process of multi-stage attacks. Aiming at combine threat quantification of individual attack action and significance value of hosts,as well as large amount of attack dependencies in attack graphs,a methodology for threat evaluation was proposed. The bi-directional threat evaluation presented in this article is able to compute progress attackers already,as well as the threat to goal-resources in attack graph,which can be well applied to real-time attack threat evaluation. The proposed was finally verified in experiment and simulation.更多还原