基于攻击者能力状态的入侵建模方法

为解决反应式容忍入侵系统中入侵模型的构建问题,提出了一个基于攻击者能力的入侵模型及相应的模型构建与描述算法。该模型以攻击者对系统操控能力的状态转移过程来描述入侵,首先在警报关联过程中发现入侵者的攻击逻辑并据此构建元攻击模型,然后将元攻击模型转化为一种简单的覆盖形式,并证明了元攻击、覆盖与攻击模型三者之间的一一对应关系,从理论上获得了该入侵模型的存在性与唯一性证明,提出了自动描述该模型的TIBC算法。最后,在警报关联系统中测试了该入侵模型及其构建与描述算法,获得了较高的识别率与较低的虚警率。

Modeling the intrusion based on the capability of attacker

Modeling the intrusion is an open problem in intrusion tolerance system.A model of state transition and its constructing algorithm are presented.The model is focused on the influence of the intrusion upon the system and describes the intrusion as the state transition process of the attackers' capability.The constructing algorithm correlates the intrusion detection alerts into meta-attack,and defines cover as the reduction of meta-attack.Then the method of transforming the cover of meta-attack to intrusion model is proposed and the proofs of the equivalence among intrusion model,meta-attack and its cover are given.An algorithm for describing the intrusion model adaptively is presented,in which the manual work is not employed like the existing methods.In the end,both the intrusion model and the algorithms for constructing and describing this model show their good performances in the correlation experiment.