有效的多协议攻击自动化检测系统

针对当前计算机网络中多个安全协议并行运行时可能出现的多协议攻击问题,提出了一个多协议攻击自动化检测系统(ADMA)。该系统由协议搜索子系统和攻击确认子系统两部分组成,其中协议搜索子系统根据多协议攻击中目标协议与辅助协议加密消息类型一致性条件,自动化搜索可能对目标协议构成威胁的候选辅助协议。攻击确认子系统通过改进的SAT模型检测方法,自动化确认目标协议与候选辅助协议是否存在多协议攻击。试验结果表明,ADMA系统能够实现多协议攻击自动化检测,并且检测中发现了新的多协议攻击。

An effective automatic detection system for multi-protocol attack

Since there exists multi-protocol attack when several security protocols are co-executed in a computer network, an automatic detection system for multi-protocol attack (ADMA) is proposed. The system is composed of two parts named protocol search subsystem and attack verification subsystem. According to the consistency condition of the type of encrypted messages between the target protocol and the secondary protocol, the protocol search subsystem can automatically search for the candidate secondary protocols, which may be used to attack the target protocol. By improving the SAT-based model checking, attack verification subsystem can automatically verify whether multi-protocol attack exists between the target protocol and the candidate secondary protocols or not. The experiment results show that ADMA system can implement automatic detection for multi-protocol attack, and some new multi-protocol attacks are found in the detection.