Network risk blocking method based on attack graph and co-evolution

Abstract

The invention provides a network risk blocking method based on attack graph and co-evolution. The method comprises the steps of 1, scan that network environment with a vulnerability scanning tool to obtain network vulnerable point information, configuration information and topology information, generating an attack graph by using the three kinds of information, and define a plurality of risk measurement attributes and a calculation method of attribute values of each node in the attack graph; 2, according to the calculation method of each risk measurement attribute value, obtaining the data setof each node's risk measurement attribute value in the attack graph, and determining the weight of each risk measurement attribute according to the entropy value method; 3, weighting and fusing the data sets of the risk measurement attribute values of each node to obtain the comprehensive value of the risk measurement attribute values of each node; Fourthly, the comprehensive value of each node 's risk measurement attribute is used as the input of the co-evolutionary algorithm, and the risk evaluation value of each node set is obtained through the initial population determination, fitness function calculation, individual selection, cross-operation and mutation operation, and the network blocking path is evaluated accordingly.

Description

technical field [0001] The invention belongs to the technical field of computer network security, and in particular relates to a network risk blocking method based on attack graph and co-evolution. Background technique [0002] Network security assessment methods are mainly divided into two types, one is the rule-based assessment method, and the other is the model-based assessment method. The traditional rule-based network risk assessment method uses intrusion detection and vulnerability scanning tools, which can only discover the risks exposed in the surface layer of the network environment. Evaluate. The model-based evaluation method can objectively evaluate the overall vulnerability of the current network environment and the existing security risks by taking into account the correlation between hosts or server nodes in the network environment and the correlation between the vulnerable points on it. [0003] The attack graph model considers the network topology informati...

AI Technical Summary

Problems solved by technology

However, the existing network security risk assessment method based on the attack graph model can only be adapted to small networks, and it is often difficult to evaluate and calculate large-scale networks with a large number of host nodes. The calculation takes a long time and the accuracy of the assessment is low.

Images