一种面向攻击树建模的描述语言.pdfVIP

2007年 12月 北 京 航 空 航 天 大 学 学 报 Deeember 2007 第33卷 第l2期 Journal of Beijing University of Aeronautics and Astronautics Vo1．33 No．12 一 种面向攻击树建模的描述语言 唐淑君 李肖坚 屠守中 韦 刚 (北京航空航天大学 计算机学院，北京100083) 摘 要：目前网络安全仿真研究中存在缺乏攻击建模方法以及统一描述的问题，因 此在采用攻击树建立攻击模型，描述攻击企图、特征和步骤执行过程的基础上，提出一种攻击 描述语言CNADL(Computer Network Attack Description Language)．攻击树用于对攻击进行建 模，并转化为自动机模型．CNADL采用上下文无关文法，用统一的形式描述攻击的目的、方法 和步骤，由解释器生成相应操作的命令交付攻击演练系统执行．利用基于GTNetS仿真平台的 攻击演练系统对CNADL进行实验验证．结果表明，该语言能有效地刻画攻击特征，结合仿真 平台，实现了拒绝服务、蠕虫、口令窃取和IP欺骗4种攻击仿真． 关 键 词：计算机网络攻击；攻击描述语言；攻击树 中图分类号：TP 393．08 文献标识码：A 文章 编 号：1001—5965(2007)12—1486—05 Description language oriented to attack tree model Tang Shujun Li Xiaojian Tu Shouzhong Wei Gang (School of Computer Science and Technology，Beijing University of Aeronautics and Astronautics，Beijing 1 00083，China) Abstract：A main problem of recent researches on network security simulation is the 1ack of methods to model attack and uniform description．Hence computer network attack description language(CNADL)was presented，with attack tree adopted to model attacks and describe purpose，characteristic and process of at— tack．Attack tree was used to model attacks and then transformed to automata mode1．CNADL，which was at— tack tree model oriented and designed in context—free grammar，described the goal，means and process of dif- ferent attacks in uniform format．The interpreter translated CNADL into corresponding orders and sent them to attack drilling system．Based on GTNetS simulator，the attack drilling system tested the validity of CNADL． The experimental results show that CNADL is able to describe attack characteristics efficiently，and simulate denia1 of service(DoS)，worm password attack and IP spoof based on G