吉林大学学报(工学版) ›› 2014, Vol. 44 ›› Issue (5): 1392-1397.doi: 10.7964/jdxbgxb201405027

Previous Articles     Next Articles

Automatic recognition model of intrusive intention based on three layers attack graph

LUO Zhi-yong1,YOU Bo2,XU Jia-zhong2,LIANG Yong1,3   

  1. 1.School of Computer Science and Technology, Harbin University of Science and Technology, Harbin 150080, China;
    2.School of Automation, Harbin University of Science and Technology, Harbin 150080, China;
    3.School of Information Technology, Eastern Liaoning University, Dandong 118003,China
  • Received:2013-03-06 Online:2014-09-01 Published:2014-09-01

RICH HTML

0   

PDF (PC)

477

Abstract: In order to solve the difficulties of predicting intrusion attempts and finding network vulnerability, an automatic identification method of intrusion attempts is proposed, which is based on three layers attack graph. This method builds the network's three layers attack graph based on the analysis of the underlying alarm data. Then it determines the quantitative attack graph from the analysis of the probability of the intrusion attempts. Finally, the critical host in the network is found by the generation algorithm of the minimum key point set. Thus, the manager can get the right network security policy. It is verified that the proposed intrusion identification method is feasible, effective and simple.

Key words: computer engineering, network security, intrusion detection, intrusion intention, attack graphs

CLC Number: 

  • TP309.2
[1] 彭武,胡昌振,姚淑萍,等. 基于时间自动机的入侵意图动态识别方法[J].计算机研究与发展,2011,48(7):1288-1297.Peng Wu, Hu Chang-zhen, Yao Shu-ping, et al. A dynamic intrusive intention recognition method based on timed automata[J]. Journal of Computer Research and Development, 2011, 48(7):1288-1297.
[2] 孙广路,郎非,杨明明.基于混合方法的流量测量系统[J].电机与控制学报,2011, 15(6):91-96.Sun Guang-lu, Lang Fei, Yang Ming-ming.Traffic measurement system based on hybrid methods[J].Electric Machines and Control, 2011, 15(6):91-96.
[3] Bratman M. Intentions, Plans and Practical Reason[M]. Massachusetts: Harvard University Press, 1987.
[4] Heinze C. Modeling intention recognition for intelligent agent systems[D]. Melbourne: the University of Melbourne, Australia, 2003.
[5] Tahboub K A. Intelligent human-machine interaction based on dynamic bayesian networks probabilistic intention recognition[J]. Journal of Intelligent and Robotic Systems, 2006, 45(1):31-52.
[6] Sheyner Oleg, Haines Joshua, Jha Somesh, et al. Automated generation and analysis of attack graphs[C]∥Proceedings of the 2002 IEEE Symposium on Security and Privacy, Washington, 2002:273-284.
[7] Noel S, Jajodia S. Understanding complex network attack graphs through clustered adjacency matrices[C]∥Proc of the 21st Annual Computer Security Applications Conf, Washington, 2005:160-169.
[8] Ou X, Govindavajhala S, Appel A W. MulVAL: a logic-based network security analyzer[C]∥Proceedings of the 14th Usenix Security Symposium, New York: ACM, 2005:336-345.
[9] Williams L, Lippmann R, Ingols K. GARNET: a graphical attack graph and reachability network evaluation tool[C]∥LNCS 5210:Proc of VizSec 2008. Berlin: Springer, 2008:44-59.
[10] 苘大鹏,杨武,杨永田. 基于攻击图的网络脆弱性分析方法[J]. 南京理工大学学报:自然科学版,2008,32(4):416-419.Man Da-peng, Yang Wu, Yang Yong-tian. Method based on attack graph for network vulnerability analysis[J]. Journal of Nanjing University of Science and Technology(Natural Science), 2008, 32(4):416-419.
[11] 叶云,徐锡山,贾焰,等. 基于攻击图的网络安全概率计算方法[J]. 计算机学报,2010, 33(10):1987-1996.Ye Yun, Xu Xi-shan, Jia Yan, et al. An attack graph-based probabilistic computing approach of network security[J]. Chinese Journal of Computers,2010,33(10):1987-1996.
[12] 罗智勇,孙广路,刘嘉辉,等. 攻击图算法在入侵防御系统中的应用[J]. 云南大学学报:自然科学版,2012,34(3):271-275.Luo Zhi-yong, Sun Guang-lu, Liu Jia-hui, et al. Application of attack graphs algorithms in intrusion prevention system[J]. Journal of Yunnan University(Natural Sciences Edition), 2012, 34(3):271-275.
[1] HU Guan-yu, QIAO Pei-li. Chaos covariance matrix adaptation evolution strategy optimization algorithm [J]. 吉林大学学报(工学版), 2017, 47(3): 937-943.
[2] HU Guan-yu, QIAO Pei-li. High dimensional differential evolutionary algorithm based on cloud population for network security prediction [J]. 吉林大学学报(工学版), 2016, 46(2): 568-577.
[3] REN Wei-wu, HU Liang, ZHAO Kuo. Intrusion alert correlation model based on data mining and ontology [J]. 吉林大学学报(工学版), 2015, 45(3): 899-906.
[4] NIU Xiao-xia, WU Yan-xia, ZHU Ruo-ping, GU Guo-chang, LIU Hai-bo. Hardware/software partitioning algorithm based on multiple hardware implementation exploration [J]. 吉林大学学报(工学版), 2014, 44(4): 1088-1093.
[5] LIU Xiao-wu, WANG Hui-qiang, LYU Hong-wu, AN Shu-zhao. Quantitative awareness of network security situation based on fusion [J]. 吉林大学学报(工学版), 2013, 43(06): 1650-1657.
[6] ZHENG Ming, SHEN Wei, BAI Tian, LIU Gui-xia, GONG Lei-guang. Novel instant message system based on extensible markup language [J]. , 2012, (06): 1548-1552.
[7] LI Zhi-dong, YANG Wu, WANG Wei, MAN Da-peng. Network security threat situation evaluation based on spread analysis [J]. 吉林大学学报(工学版), 2012, 42(01): 145-149.
[8] HUANG Wan-feng, WANG Feng, LIU Xiao-dan, YU Li-hong. Construction of community health service network based on reversal SSL-VPN technology [J]. 吉林大学学报(工学版), 2011, 41(增刊2): 279-282.
[9] MA Xin,LIANG Yan-chun,TIAN Ye,YU Tao. An immune and contract net protocol-based multi-agent intrusion detection system [J]. 吉林大学学报(工学版), 2011, 41(01): 176-0181.
[10] LIU Yan-Bin, ZHOU Chun-Guang, ZHANG Zhong-Yi, ZHOU Xu, ZHAI Yan-Dong, ZOU Shu-Xue. Resource interlinking of semantic bioinformatics database based on ontology [J]. 吉林大学学报(工学版), 2010, 40(06): 1650-1654.
[11] WU Jing,LIU Yan-heng,Lü Rong. Distribute learning algorithm based on fuzzy C-means [J]. 吉林大学学报(工学版), 2010, 40(01): 171-0175.
[12] LIU Yan-Heng, SUN Lei, TIAN Da-Xin, WU Jing. Method of anomaly detection based on fusion principal components match [J]. 吉林大学学报(工学版), 2009, 39(05): 1314-1320.
[13] MAN Da-peng, ZHANG Bing, ZHOU Yuan, YANG Wu, YANG Yong-tian . Depthfirst method for attack graph generation [J]. 吉林大学学报(工学版), 2009, 39(02): 446-0452.
[14] ZHANG Xiao-wei1，LIU San-yang1，CHI Xiao-ni2 . Efficient interval-genetic algorithm for multipeak global optimization [J]. 吉林大学学报(工学版), 2008, 38(04): 876-879.
[15] Hong Zheng;Wu Li-fa;Wang Yuan-yuan . Three worm propagation models to establish scalefree worm networks [J]. 吉林大学学报(工学版), 2008, 38(03): 690-0694.
Viewed
Full text


Abstract

Cited
  Shared   
  Discussed   
No Suggested Reading articles found!
Copyright © Journal of Jilin University(Engineering and Technology Edition), All Rights Reserved.
Tel: +86-431-85095297　Fax: +86-431-85094074　E-mail: xbgxb@jlu.edu.cn
Powered by Beijing Magtech Co. Ltd