一种基于攻击树的网络攻击模型

一种基于攻击树的网络攻击模型重庆大学硕士学位论文学生姓名：代廷合指导教师：吴开贵副教授专业：计算机系统结构学科门类：工学重庆大学计算机学院二OO八年四月ANetworkAttackModelingBasedOnAttackTreeAThesisSubmittedtoChongqingUniversityinPartialFulfillmentoftheRequirementfortheDegreeofMasterofEngineeringbyDaiTingheSupervisor:AssociateProf.WUKaiguiMajor:ComputerSystemArchitectureCollegeofComputerScienceofChongqingUniversity,Chongqing,ChinaApril,2008重庆大学硕士学位论文中文摘要I摘要随着网络攻击和破坏行为的日益普遍和攻击工具的多样化，传统的网络安全防护已经不能满足网络发展的实际需求。一种新型的、能实现网络主动防御的系统——基于攻击树的入侵检测系统IDS（IntrusionDetectionSystem）已经成为近年来的研究热点，而建立IDS的关键在于如何建立一个简单而有效的攻击模型。网络攻击研究的一个关键问题是对攻击的认识和描述。一次完整的攻击过程通常会包括一系列单独的攻击行为,每个攻击行为是对某个系统漏洞（脆弱性）的一次利用。研究的目的是：①由于网络入侵过程的复杂性和入侵形式的多样性，如何进一步降低构造攻击树的复杂度和构建攻击场景，提高攻击模型效率，并降低对网络资源的占用；②构造能够准确描述攻击行为的精确的ID攻击模型，从而在检测中做出正确的判断，为获得良好的检测性能奠定基础；③应用所述内容，初步设计一种具有智能性和完整性的网络攻击模型系统。本文在研究攻击树的基础上，对攻击树的构造，攻击场景的建立及网络攻击系统模型的设计进行了有益的扩展和改进。主要工作如下：①对网络攻击模型进行了比较研究；②攻击树生成算法研究；③分阶段攻击树模型的建立；④具有权值的多层网络攻击树模型；⑤基于风险(Risk)权值的攻击场景的建立；⑥一种基于攻击树的网络攻击系统模型的初步设计。本文中对攻击阶段的划分和基于风险(Risk)权值的攻击场景的建立对于有效维护网络安全仍然是有意义的。关键词：攻击树，攻击场景，Risk权值，网络攻击模型重庆大学硕士学位论文英文摘要IIABSTRACTWiththewidespreadofnetworkattackandthediversificationofattacktool，thetraditionalnetworksecuritytechniquesalreadycannotadapttothedemandofnetworkdevelopment.Anewactivedefensesystem,IntrusionDetectionSystem（IDS）basedonattacktree,hasbecomeahotresearch.ThekeypointofIDSdependsonhowtobuildasimpleandeffectiveattackmodeling.Thekeyquestionofnetworkattackresearchishowtounderstandanddescribetheattack.Acompleteattackprocessusuallyincludesaseriesofattackactions,andeveryattackactionisauseofsystemvulnerability.Thegoalsoftheresearchis：①Accordingtothecomplexityofnetworkintrusionprocessandthediversificationofintrusionform,howtobuildattackscenarioandreducethecomplexityofbuildingattacktree,improveattackmodelingefficiencyandtherebyreduceoccupationtonetworkresource;②BuildingIDattackmodelingthatcandescribepreciselyattackaction,therebygivingoutacorrectchoiceinintrusiondetection,establishingthefoundationtoobtaingooddetectionability；③Designinganetworkattacksystemmodelingwithintelligenceandcompletionaccordingtoattacktreeandattackscenario.Thispaperexpandedandimprovedtheestablishmentofattacktreeandattackscenario,andthedesignofanetworkattackmodelingsystemapplyingtheresearchtoattacktree.Theprimaryworksofthedissertationareasfollows:①Comparisonresearchofnetworkattackmodel;②Generationalgorithmresearchofattacktree;③Establishmentofstageattackmodel;④Multi-StageNetworkAttackModelwithweights;⑤EstablishmentofattackscenariobasedonRiskweights;⑥Preliminarydesignofnetworkattackmodelsystembasedonattacktree.TheDivisionofattackstageandtheestablishmentofattackscenariobasedonriskweightsisstillmeaningfultomaintainnetworksecurity.Keywords：AttackTree,AttackScenario,RiskWeights,NetworkAttackModeling重庆大学硕士学位论文目录III目录中文摘要......................................................................................................................................I英文摘要.....................................................................................................................................II1绪论..........................................................................................................................................11.1问题的提出...........................................................................................................................11.2网络安全事故增多和危害增大的原因...............................................................................31.3网络攻击主要类型................................................................................................................41.4国内外研究现状综述...........................................................................................................41.4.1入侵检测系统(IntrusionDetectionSystem)原理..........................................................41.4.2入侵检测系统IDS研究现状........................................................................................51.4.3入侵检测面临的主要问题.............................................................................................71.4.4入侵检测的发展趋势....................................................................................................81.5本文研究的目的和研究内容................................................................................................91.5.1本文研究的目的............................................................................................................91.5.2本文研究的内容............................................................................................................92网络攻击模型研究和分析........................................................................................102.1几种常见的攻击模型.........................................................................................................102.2几种常见的攻击模型的比较研究.....................................................................................122.3攻击树模型研究和分析......................................................................................................142.3.1几种常见的树型结构攻击模型比较...........................................................................142.3.2攻击树分析................................................