Research On Network Systems Security Assessment Technology

With the fast development of Internet technologies recently, computer networks have played an increasingly important role in the fields of politics, economy, military, and social life. Although network technologies bring endless convenience for people's life and work, the openness and interconnection of networks make network attacks become more universal, and network security problems have attracted wide attention. Risk always exists in the real network environment.In order to ensure normal operation of networks, hidden troubles in networks must be identified and analyzed, and proper measures must be adopted to decrease the risk according to analysis results. Therefore, how to accurately evaluate the security of a network becomes an important problem, and it has been one of the research focuses in the field of network security. From technical perspective, the key technologies of vulnerability and attack threat assessment involved in network security evaluation are researched deeply in this paper. It mainly includes:Firstly, we carry out research on modeling methods for network vulnerability. In order to analyze the security of single target and the overall security of networks, a depth-first attack graph generation method (DFAGG) and a breadth-first attack graph generation method (BFAGG) are proposed. Given that the attack target is determined, DFAGG algorithm searches the correlation of network vulnerabilities based on depth-first, and constructs attack graphs according to the correlation. BFAGG algorithm searches all the network states at which attackers can arrive on the basis of breadth-first. Strategies of limiting the number of attack steps and success probability of attack paths are adopted in both methods. The effects of optimization strategies on the accuracy of evaluation results are analyzed by mathematical calculation and experiments. Secondly, we study analysis methods for network vulnerability. Based on introducing the definition of state node attraction coefficient, a method to calculate the reachability of state nodes and vulnerabilities in attack graphs is presented. On this ground, a quantitative assessment method for network security based on the vulnerability correlation and security requirements is proposed. The proposed method calculates the vulnerability reachability by using attack graphs at first. Then, the effects of vulnerabilities on availability, confidentiality and integrity of hosts are calculated. The security of hosts and network are assessed based on the security requirements at last. In addition, a quantitative method to make strategies for the enhancement of network security is proposed. The method calculates the effects of arrived network states on network security firstly. Then, the effects of security elements on network security are calculated. The security elements are removed based on maximum influence degree in the end.Thirdly, we study assessment methods for network threat. A method for real-time assessing network threat based on Hidden Markov Model (HMM) is proposed. The algorithms for calculating threat indices of hosts and networks are presented. Baum-Welch algorithm is used to estimate model parameters for improving the automation of evaluation process. The model is used to calculate the probability that hosts are in attacked states, and threat indexes are assessed with probability, hosts values and importance of attack events. Threat situation curves of hosts and networks are got by a secondary treatment method of threat indices. The law of threat situation's variation is found by the curves.Finally, for the network environments of large-scale and multiple administrative domains, a distributed network security evaluation system (DNSES) is designed and implemented. The system consists of three parts: manager, analyzer, and information collector. The three parts is of hierarchical relation. In order to fuse the assessment results of multiple administrative domains, the cooperative relation between analyzers in the different administrative domains is constructed by a directory server. The system introduces key technologies depicted in former chapters. It can analyze the vulnerability and the threat of target networks, and synthetically evaluate the security of network by logic reasoning technologies.