Research On The Technologies Of Assessment And Analysis For Network Vulnerability

The rapid development of internet technologies not only brings great convenience to the people, but also provides more opportunities to network intruders to start attack. In recent years continued network attacks make people aware of the importance of network security.Vulnerability assessment technique is able to identify the security risks and vulnerabilities which can be exploited by the intruders in networks. It can also find the problems before real attack and fix them, enhances the network security in a large scale.In this thesis, several key techniques of the network vulnerability assessment have been studied, including network attack graph generation method, attack graph optimization technique and vulnerability assessment quantitative method.On the basis of existing methods to generate attack graph, a new complexity-reduction method has been introduced, which combines attack steps limitation with attack probability limitation, effectively reduces the scale of the attack graph. Also in this thesis, the host-specific attack graph generation algorithm has been extended to the global network; the global network attack graph generation algorithm has been implemented.Existing methods of vulnerability assessment are mostly host-based and service-based; this thesis draws on the idea of hierarchical analysis, the concept of security factor has been introduced. In the thesis, security factor has been considerate the main element for quantitative analysis of network. A security-enhanced strategy has also been introduced to enhance the network system security.At the end of this thesis, the implement of the prototype system, which uses the methods mentioned above, has been described, with a focus on data structure, process flow and database.