Research Of Network Security Risk Assessment Technology Based On Attack Graph

The ever-increasing complexity of computer network and various new types of bugs make the network security become an ever-growing serious challenge. In the evaluation of network security risk, the attack graph model is one of the most effective models to represent the relationship between vulnerability and cause-and-effect. The attack graph model has been widely used in network security risk assessment.Focused on the poor readability problem in the procedure of traditional network attack graph generating, we propose a method for probabilistic attack graph generation based on the defense cost. Firstly, we propose a method to quantify the cost of defense, and then introduce the quantitative indicators into the attack graph model; Secondly, we makes a rational analysis and classification on the vulnerabilities of the host, and then using a vulnerability fusion algorithm, so to simplify the number of vulnerabilities; Finally, we generate the probabilistic attack graph model based on the defense cost according to the attack graph generation algorithm. Experimental results show that our method can simplify the attack graph effectively, making the attack graph easier to analyze and understand, so to facilitate the network security administrators making more reasonable security strategies based on attack graph.The cause-and-effect relationship between multiple attack steps can be described well in an attack graph model. However, its test result is uncertain. Focused on this issue, the method of fusing attack graph model and hidden Markov model(HMM) was proposed. Firstly, the network environment and attacker’s aggressive behavior were abstracted by the attack graph model; Secondly, the probabilistic mapping that was between network observation and attack status was established by the HMM; Finally, the Viterbi algorithm was used to calculate the maximum probability state transition sequence. Experimental results show that the maximum probability of the state transition sequence can be effectively calculated and then the attack intention can be accurately inferred by this dual model; This method provides a good configuration for network security administrators.