基于服务影响分析的网络安全态势定量感知方法..docx

基于服务影响分析的网络安全态势定量感知方法第38 卷增刊(I) 东南大学学报(自然科学版) Vol.38 Sup(I)2008 年9 月JOURNAL OF SOUTHEAST UNIVERSITY (Natural Science Edition) Sept. 2008基于服务影响分析的网络安全态势定量感知方法梁颖王慧强刘磊1(哈尔滨工程大学计算机科学与技术学院, 哈尔滨150001)摘要: 根据服务与配置间的资源依存关系，选取服务可用性与服务性能作为影响分析的重要指标，将网络服务运行状态抽象为安全态势基本要素．引入混合策略博弈刻画网络空间攻防双方的安全交互，建立网络攻防博弈形式化模型，并对模型中的策略空间、转移规则、效用函数等给出了明确定义．实验结果表明，该方法可定量刻画Nash 均衡时博弈双方的收益情况，完成了网络安全态势的量化分析与自动生成，为安全管理员正确决策提供支持．采用服务影响分析方法屏蔽了系统配置及入侵行为细节，效率高、实时性强，有助于网络安全态势感知研究的发展．关键词: 网络安全; 态势感知; 混合策略博弈; 可用性; 性能中图分类号: TP393．08 文献标识码: A 文章编号: 1001-0505(2008)增刊(I)-0064-04Service impact analysis-based quantitative method fornetworksecurity situational awarenessLiang Ying Wang Huiqiang Liu Lei(College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, China)Abstract: According to dependencies between service and configuration, service availability andperformance were selected as important indexes in impact analysis, and network service states wereabstracted as basic security situational elements．Mixed strategy game was introduced to depict thesecurity interaction between attackers and defenders in cyberspace, and formal modeling of networkattack-defense game was constructed in which parameters, such as strategy space, transition rules andpayoff functions were clearly defined．Experimental results show that payoffs of game players at Nashequilibrium can be quantified, further more quantitative analysis and automatic generation of networksecurity situation is achieved, which will help security administrators make correct decisions．Adoptingservice impact analysis can shield details about system configurations and intrusions, and it is of highefficiency and real-time performance and helpful in development of network security situationalawareness．Key words: network security; situational awareness; mixed strategy game; availability; performance目前网络恶意入侵行为呈现出组织严密化、行为趋利化和目标直接化等特点，如何保证网络系统的安全性已成为安全领域的研究热点，也是亟需解决的关键问题之一．据统计[1]，越来越多的攻击行为利用网络服务或网络协议的脆弱性对系统发起攻击并导致服务的偏移或失效，造成了严重的安全问题．目前已有不少学者利