Network vulnerability assessment method based on zero-day attack graph

Abstract

The invention discloses a network vulnerability assessment method based on zero-day attack graph. First it is assumed that all services on a host in a network contain a zero-day vulnerability, a zero-day attack graph is generated through logical reasoning of a given pattern, and then the attack cost for utilizing the zero-day vulnerability to attack is quantified based on a vulnerability scanningtechnology and CVSS vulnerability scoring system, and finally, a network centrality theory is utilized to make an analysis to obtain the key vulnerabilities in the network. All possible unknown vulnerabilities in the network are fully considered while known vulnerabilities are dealt with, so that the assessment method has the capability of dealing with unknown vulnerabilities, can discover potential network vulnerabilities through logical reasoning, and assess the security of the current network, thereby providing a reference basis for further network security protection, and improving the security, reliability and availability of the network.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a network vulnerability assessment method based on a zero-day attack graph. Background technique [0002] In the method of using vulnerabilities to assess network vulnerabilities, most researchers only analyze the damage that known vulnerabilities can cause to the network to measure network security. This does not consider the analysis method of unknown vulnerabilities, and lacks the prevention of unknown vulnerabilities. These measures are invalid for unknown vulnerabilities, so unknown vulnerabilities need to be introduced in the network vulnerability assessment. [0003] "Zero-day vulnerabilities", also known as zero-day attacks, refer to security vulnerabilities that are exploited maliciously immediately after being discovered. In layman's terms, that is, within the same day that security patches and flaws are exposed, related malicious programs appear. ...

AI Technical Summary

Problems solved by technology

For example, many vulnerability scoring systems such as CVSS and CWSS can evaluate the severity of a single network vulnerability, but a single vulnerability analysis cannot reflect the complex process of network attacks, nor can it discover potential network threats

In addition, the evaluation method based on the Bayesian network must formulate a priori probability table in advance based on expert experience, and the probability in the Markov transfer model also lacks a basis for selection, and the evaluation is not objective.

And most of the vulnerability analysis does not consider the issue of zero-day vulnerabilities, and can not find potential threats

Images