【作者】 余颖；

【导师】 郑康锋；

【作者基本信息】 北京邮电大学 ， 计算机技术， 2021， 硕士

【摘要】 网络安全度量是对网络中的安全要素进行客观分析,给出网络系统安全性的综合性描述,从而指导网络加固的一种主动防御手段,可以有效提升系统的安全性。基于攻击图的网络安全度量是较为成熟的一种度量方法,但相关领域学者已提出的如基于最短攻击路径、基于攻击路径数量等度量方法无法清晰描述攻击者违反安全策略而进行的具体攻击工作,从而难以指导针对性的防御工作;而基于贝叶斯攻击图的度量方法虽然可以清晰地描述攻击过程,但则由于复杂度高,无法适用于实时度量。针对上述问题,本文提出了一种基于攻击路径威胁分析的网络安全度量技术,基于攻击图技术和改进蚁群算法定量度量网络系统安全。该技术首先运用网络建模方法和漏洞知识库自动生成网络攻击图;然后对经典蚁群算法模型中的启发因子和信息素更新规则进行改进,使其适应于攻击路径寻优场景,利用该改进蚁群算法,基于预先定义好的潜在攻击目标节点集合,在攻击图上寻找与攻击目标节点对应的最小攻击代价与最优攻击路径;最后根据最小攻击代价集合与各潜在攻击目标节点的攻击价值,定量计算出目标网络遭受的威胁程度,帮助网络管理员及时发现网络中存在的威胁。基于提出的度量方法,本文设计并实现了网络安全度量系统,系统包括攻击图自动生成与更新模块、网络攻击路径寻优模块和网络安全度量模块。最后,利用仿真网络,对系统各模块的功能进行测试,证实了网络攻击路径威胁度量系统的正确性和有效性。本文提出的安全度量技术对比已有相关技术的创新之处可以总结为以下两点。其一,本文创新性地利用Text-CNN文本分类技术构建和自动更新度量系统中的漏洞知识库,使其能够与最新披露的网络漏洞保持同步,提高了度量方法的准确度。其二,本文利用改进的MMAS蚁群算法进行攻击路径寻优,对比贝叶斯攻击图等路径寻优技术,能够有效缩短算法执行时间,使得本文提出的度量技术能够适用于实时度量。更多还原

【Abstract】 Network security measurement is an objective analysis of the security elements in the network,giving a comprehensive description of the security of the network system,thereby guiding the network reinforcement as an active defense method,which can effectively improve the security of the system.Network security measurement based on attack graphs is a relatively mature measurement method,but the measurement methods based on the shortest attack path and the number of attack paths that have been proposed by scholars in related fields cannot clearly describe the specific attack work carried out by the attacker.Therefore,it is difficult to guide targeted defense work.Although the measurement method based on Bayesian attack graph can clearly describe the attack process,it is not suitable for real-time measurement due to its high complexity.In response to the above problems,this thesis proposes a network security measurement technology based on attack path threat analysis,which quantitatively measures network system security based on attack graph technology and ant colony algorithm.The technology first uses network modeling methods and vulnerability knowledge bases to automatically generate network attack graphs.The heuristic factors and pheromone update rules in the classic ant colony algorithm model are improved to adapt them to the attack path optimization scenario.Using the improved ant colony algorithm,based on the pre-defined set of potential attack target nodes,look for the minimum attack cost and optimal attack path corresponding to the attack target node in attack graph.Finally,according to the minimum attack cost set and the attack value of each potential attack target node,the threat level of the target network is quantitatively calculated,and the network administrator can find the existence of the network in time Threat.Based on the proposed network security measurement method,this paper designs and implements a network security measurement system,which includes an attack graph automatic generation and update module,a network attack path optimization module and a network security measurement module.Finally,the simulation network was used to test the functions of the various modules of the system,which confirmed the correctness and effectiveness of the network attack path threat measurement system.Compared with the innovation of existing related technologies,the security measurement technology proposed in this paper can be summarized as the following two points.First,this article innovatively uses Text-CNN text classification technology to construct and automatically update the vulnerability knowledge base in the measurement system,so that it can keep up with the latest disclosed network vulnerabilities and improve the accuracy of the measurement method.Second,this article uses the improved MMAS ant colony algorithm to optimize the attack path,which can effectively shorten the algorithm execution time when comparing to Bayesian attack graph and other path optimization techniques,making the measurement technology proposed in this article suitable for real-time measurement.更多还原