关键词: 计算机应用, 网络安全, 安全评估, 脆弱性分析, 攻击图

Abstract: Existing attack graph generation methods have the problem of state explosion, which results in the scale of the generated graphs to be large. To solve this problem, a depthfirst attack graph generation method was proposed on the basis of formal description of network security elements. The depthfirst search algorithm was employed to find the attack paths in the network. The strategies to restrain the number of the attack steps and the success probability of attack paths were adapted to reduce the scale of the attack graphs. Experiment results show that the proposed method can efficiently remove the redundant edges and nods in the attack graphs, consequently decreases the scale of the attack graphs.

Key words: computer application, network security, risk assessment, vulnerability analysis, attack graph