Network spoofing performance evaluation method based on dynamic Bayesian attack graph

Abstract

The invention discloses a network spoofing defense efficiency evaluation method based on a dynamic Bayesian attack graph, and belongs to the field of network space security. The method comprises the following steps: speculating attacker ability by analyzing vulnerability elements in a current network, and constructing a dynamic Bayesian attack graph model; aiming at the defense characteristics ofnetwork spoofing and counterfeiting real assets, the consistency of real nodes and bait nodes in the aspects of network characteristics, equipment fingerprints, file attributes and the like is comprehensively compared, so that a spoofing scheme is subjected to concealment analysis, and whether a defense strategy can achieve an expected effect or not is judged; and updating the attack graph model according to the analysis result and the attack and defense confrontation information, and giving a quantitative index to evaluate the effectiveness of deception defense. The method can be integrated on a server serving as a control center, other nodes in the network do not need to be modified, and the method has good applicability.

Description

technical field [0001] The invention belongs to the field of network space security, and in particular relates to a network deception effectiveness evaluation method based on a dynamic Bayesian attack graph. Background technique [0002] Cyberspace deception is a defense mechanism evolved from honeypots. It does not focus on the characteristics of the attack behavior but the attacker itself. By interfering with the attacker's cognition, the attacker is prompted to take actions that are beneficial to the defender. Since attackers generally need to rely on the information obtained from network detection to determine the next attack behavior, cyberspace deception defense technology can forge a piece of false data or a false environment for the attacker to protect important assets inside the network, and record and analyze its Attack activity to get more information about the attacker. Cyberspace deception defense technology does not try to build a system without loopholes, nor...

AI Technical Summary

Problems solved by technology

At present, most of the existing research at home and abroad is only a qualitative evaluation of the defense methods proposed by themselves, and is limited to a single defense layer (such as network layer, system layer, application layer, etc.), lacking a unified and systematic evaluation of the effectiveness of deception defense. method

Images