System for generating assaulting chart facing network safety alarm incident

Abstract

An attack graph generation system facing to network security alarm association in the field of computer network, in the present invention, the network initial configuration information module receives the network topological structure, gateway filtering rule input by the users; OVAL vulnerability scanning report collecting module collects the vulnerabilities in all the apparatuses in the network; the network connectivity analyzing module transmits connectivity between ant two apparatuses to the attack graph generation module; the data structure establishing model respectively establishes a kind of data to describe aiming at the attacker state, apparatus state, implantation vulnerability behavior, atom attack action, system state in the network; the knowledge base stores the network topological structure, gateway filtering rule, vulnerability to transfer by the attack graph generation module; the attack graph generation module transfers the information in the knowledge base, generates the network attack graph and transmits the generated attack graph to the attack graph displaying module to visually display to the user; the system work complexity of the present invention is O(N<5>) and is easy to realize the project.

Description

technical field [0001] The invention relates to a system in the technical field of computer network security, in particular to an attack graph generation system oriented to network security alarm association. Background technique [0002] With the increasingly complex computer network structure, security administrators need to deal with more and more alarms generated by heterogeneous security devices. The alarm correlation technology transforms the complex and disordered network alarm flow into a structured and easy-to-understand attack scenario through the formal description of the correlation knowledge, and assists the administrator to obtain valuable security situation information. The network attack graph can succinctly and completely record the dependencies between penetration steps, and is considered an ideal carrier of associated knowledge. However, the traditional network attack graph generation method has high computational complexity and cannot include all potenti...

AI Technical Summary

Problems solved by technology

However, from the perspective of alarm correlation, the cost of merging is the loss of some potential attack paths, which makes it unable to completely contain all the knowledge required for alarm correlation

Images