【作者】 张玉；

【导师】 罗智勇；

【作者基本信息】 哈尔滨理工大学 ， 计算机技术（专业学位）， 2023， 硕士

【摘要】 伴随着互联网行业的飞速发展,网络的架构也变得多样化。其中,软件定义网络(SDN)通过将控制层和数据层进行分离以及可编程的特点,不但能降低了设备的负载,而且减少了对网络的运营成本,成为目前新型网络中的焦点。但是,由于不同网络本身的特点,导致SDN网络和传统网络的安全问题都成为目前所研究的重点。以往对网络进行入侵检测仅仅只是利用设备的脆弱性以及设备漏洞来对设备进行威胁建模,以此判断所处网络中的设备被入侵的风险。但忽略了设备的重要性和漏洞之间所存在的依赖关系,以及SDN网络中控制器漏洞所带来的影响。根据以上所提到的问题,本文根据传统网络和SDN网络的不同特点,分别从以下几方面对其进行展开研究。首先,针对目前已有的软件定义网络(software-defined network,SDN)安全预测方法中未考虑攻击代价以及控制器漏洞对SDN网络安全所产生的影响,提出了一种基于贝叶斯攻击图的SDN攻击意图评估方法。考虑到攻击者的攻击行为具有目的性,本文先利用PageRank算法计算出各个设备的重要性,然后与攻击经验进行结合计算出对设备的攻击成本,再与攻击收益、攻击偏好以及设备漏洞等4个指标对设备攻击概率进行计算,更准确地预测了攻击者对每个设备所攻占的概率。通过对贝叶斯信念网络和攻击图相结合,对网络进行风险评估以及模型的建立,利用计算所得到的总体可达概率,进行对攻击路径的预测,并有效地提高了预测的准确性。其次,针对目前传统网络风险评估模型中对节点关联性考虑的不全面,提出了一种基于贝叶斯攻击图的传统网络攻击意图评估方法。通过CVSS3.1计算出漏洞价值,利用PageRank算法求出节点关键度,与漏洞价值中的可利用性结合得到攻击成本,分析得到的攻击收益等三个指标求出节点入侵概率,并利用静态和动态可达概率进行分析节点被入侵的可能性,计算出到达目标节点的所有可能性,最终得到最有可能的入侵路径。最后,通过详细的实验对本文所提出的攻击意图评估策略进行验证。更多还原

【Abstract】 Along with the rapid development of the Internet industry,the architecture of the network has become diversified.Among them,software-defined network(SDN),by separating the control layer and data layer and programmable features,not only can reduce the load on the equipment,but also reduce the operating costs of the network,and become the focus of the new network.However,the security issues of both SDN networks and traditional networks are currently the focus of research due to the characteristics of the different networks themselves.In the past,the intrusion detection of the network only used the vulnerability of the device and device vulnerability to model the threat to the device,so as to determine the risk of intrusion of the device in the network.However,the importance of the device and the dependencies that exist between vulnerabilities and the impact of controller vulnerabilities in SDN networks are ignored.Based on the above mentioned issues,this thesis investigates the traditional network and SDN network from the following aspects according to their different characteristics.First,a Bayesian attack intent assessment method based on Bayesian attack graphs is proposed for SDN security prediction methods that do not consider the cost of attack and the impact of controller vulnerabilities on SDN network security.Considering that the attacker’s attack behavior is purposeful,this thesis first uses the PageRank algorithm to calculate the importance of each device,and then combines it with the attack experience to calculate the cost of attack on the device,and then calculates the probability of attack on the device with four indicators such as attack gain,attack preference and device vulnerability,which more accurately predicts the probability of the attacker’s attack on each device.By combining Bayesian belief networks and attack graphs,risk assessment of the network as well as model building is performed,and the overall achievable probability obtained from the calculation is used to perform prediction of attack paths and effectively improve the accuracy of the prediction.Second,a traditional network attack intent assessment method based on Bayesian attack graph is proposed to address the incomplete consideration of node correlation in the current traditional network risk assessment model.The vulnerability value is calculated through CVSS3.1,the node criticality is calculated using the PageRank algorithm,the attack cost is obtained by combining with the exploitability in the vulnerability value,the node invasion probability is obtained by analyzing the three indicators such as the obtained attack benefit,and the possibility of the node being invaded is analyzed using the static and dynamic reachable probabilities,all possibilities of reaching the target node are calculated,and finally the most likely The most likely intrusion path.Finally,the attack intent evaluation strategy proposed in this thesis is validated by detailed experiments.更多还原