关键词: 计算机系统结构, 攻击树, SPRINT计划, 攻击场景, 原子攻击

Abstract: An improved augmented attack tree and attack tree algorithms were proposed, which can identify malicious activities from authorized insiders in terms of their SPRINT plan. The algorithm is divided into three phases: in pruning attack tree phase, SPRINT plan aiming at each insider, an algorithm to verify the existance of a subtree is developed. In minimal attack tree phase, by removing invalid branches and checking whether a minimal attack tree still exists, a customized minimal attack tree is generated. In risk analysis phase, the current attack probability for each node of the minimal attack tree is dynamically generated. It can help system administrators make sound decision by a more accurate quantitative approach.

Key words: computer systems organization, attack tree, SPRINT plan, attack scenario, atomic attack