WO2009009975A1 - Procédé et appareil pour prédire une action d'attaque de réseau - Google Patents

Procédé et appareil pour prédire une action d'attaque de réseau Download PDF

Info

Publication number
WO2009009975A1
WO2009009975A1 PCT/CN2008/071218 CN2008071218W WO2009009975A1 WO 2009009975 A1 WO2009009975 A1 WO 2009009975A1 CN 2008071218 W CN2008071218 W CN 2008071218W WO 2009009975 A1 WO2009009975 A1 WO 2009009975A1
Authority
WO
WIPO (PCT)
Prior art keywords
attack behavior
attack
subsequent
behavior
maximum possible
Prior art date
Application number
PCT/CN2008/071218
Other languages
English (en)
French (fr)
Inventor
Xinggao He
Chong Fu
Fengli Zhang
Zhenqi Cao
Dunquan Wang
Niejun Zheng
Chengwei Zhang
Bo Wang
Changyi Lu
Original Assignee
Huawei Technologies Co., Ltd.
University Of Electronic Science And Technology Of China
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd., University Of Electronic Science And Technology Of China filed Critical Huawei Technologies Co., Ltd.
Priority to EP08160556A priority Critical patent/EP2026527A1/en
Publication of WO2009009975A1 publication Critical patent/WO2009009975A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies

Definitions

  • the present invention relates to the field of network communication security, and in particular, to a method and apparatus for predicting network attack behavior. Background technique
  • a description method using an attack tree model using a tree to represent the association between attack behaviors, each node of the tree represents the ultimate goal of the attack.
  • the attack tree is intuitive and easy to understand, but it does not distinguish between attack behavior and attack results. It is difficult to use the attack tree model for attack warning.
  • the other is based on the description of the attack network of the Petri net for the mathematical representation of the discrete parallel system.
  • the site of the Petri net is used to indicate the stage of the attack, the transition represents the attack behavior, and the directed arc represents the attack. process.
  • Another way to represent the attack process is a state transition diagram. The attack process is expressed as a migration between system states.
  • Snort's intrusion rule set detects attacks by a single packet feature.
  • the STATL language describes attack behavior based on state and state transitions, and provides an intrusion signature database for state map based intrusion detection systems.
  • the ESTQ method describes network protocol attacks by ⁇ event, protocol status, time relationship, quantity relationship>.
  • IDIOT uses a colored petri net to model and detect intrusions.
  • ASSQ quaternary Another formal description method of network intrusion behavior and normal behavior in the prior art is based on the ASSQ quaternary, and is redefined and modified based on the existing Petri net model, which can be applied to various intrusions. In detection and related systems, it is used to track and detect intrusion behaviors, to distinguish between normal behavior and intrusion behavior. This technique is a combination of the ESTQ method and the petri network.
  • the ASSQ quaternary is an improvement of the ESTQ method. It is a general description of the intrusion behavior. It analyzes the relationship between the time and quantity of the attack in the system state and the network event, and realizes it through the redefined Petri net model. A description of the quad.
  • Embodiments of the present invention provide a method and apparatus for predicting a network attack behavior, which can predict and block subsequent attack behaviors.
  • a method for predicting network attack behavior includes: monitoring network state parameters, and obtaining attack behavior information according to changes in network state parameters; according to correspondence between attack behavior and subsequent attack behavior, from the attack Selecting a maximum possible subsequent attack behavior in the subsequent attack behavior corresponding to the behavior, the maximum possible subsequent attack line
  • the embodiment of the present invention further provides an apparatus for predicting network attack behavior, including: an attack behavior management unit, configured to detect a change of a network state parameter, and find an attack behavior information according to a change of a network parameter, according to an attack behavior and a subsequent attack behavior. Correspondence, The maximum possible subsequent attack behavior is predicted from the subsequent attack behavior corresponding to the attack behavior.
  • the embodiment of the present invention describes the relationship between the attack behavior process and the attack behavior in the attack process in detail, and searches for the most likely subsequent attack from all subsequent attack lines of the attack behavior according to the correspondence between the attack behavior and its subsequent attack behavior.
  • FIG. 1 is a structural diagram of a weighted directed graph describing a network attack behavior according to an embodiment of the present invention
  • FIG. 2 is a structural diagram of an index table and a subsequent attack behavior table describing a network attack behavior according to an embodiment of the present invention
  • FIG. 3 is a flow chart of predicting network attack behavior according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of an attack support tree for describing a network attack behavior according to an embodiment of the present invention
  • FIG. 5 is another flow chart of an attack support tree for describing a network attack behavior according to an embodiment of the present invention
  • FIG. 6 is a schematic structural diagram of an apparatus for predicting network attack behavior according to an embodiment of the present invention. detailed description
  • the correspondence between the attack behavior and its subsequent attack behavior can be represented by a weighted directed graph.
  • 1 is a structural diagram of a weighted directed graph describing a network attack behavior according to an embodiment of the present invention, where a circle is a vertex in an attacked directed graph, each vertex represents an attack behavior, and a letter in a circle The name of the specific attack behavior; the arrow line is the arc of the attack behavior with the weighted directed graph, the arc represents the pointing relationship from the attack behavior to the subsequent attack behavior, the arc tail connects the predecessor attack behavior, and the arc head points to the subsequent attack behavior, such as A For the predecessor attack behavior, B, C, and D are the follow-up attacks of A; the letters on the arrow line are the weights of the arcs in the attack-bearing directed graph, describing the attack from the predecessor attack behavior to the subsequent attack behavior.
  • the number of historical occurrences of a sequence of behaviors E.g
  • the weight of the arc AB is i, which means that the attack behavior A to the attack behavior B has occurred i times; the weight of the arc AC is j, and if i>j, the attack behavior sequence from the attack behavior A to the attack behavior B
  • the number of occurrences in history is greater than the sequence of attack behaviors from attack behavior A to attack behavior C; conversely, if i ⁇ j, the number of attacks from the attack behavior A to the attack behavior C history is greater than the attack behavior A to the attack behavior B. Sequence of attack behavior.
  • FIG. 2 is a structural diagram of an index table and a subsequent attack behavior table describing a network attack behavior according to an embodiment of the present invention.
  • the correspondence between the attack behavior name, the attack behavior state and the subsequent attack behavior is represented by an index table, the name of the subsequent attack behavior, the state of the subsequent attack behavior, the number of occurrences from the attack behavior to the subsequent attack behavior, and the prevention of the maximum possible subsequent attack behavior.
  • the correspondence between the generated policies is represented by a successor attack table.
  • an index table 21 and a plurality of subsequent attack behavior tables 22 are created.
  • the structure of each item in the index table 21 is name 211, active 212, *next_table 213.
  • Name 211 is the name of the attack behavior, name E n, n is the set of attack behavior names; active 212 indicates the attack behavior status, where Y indicates that the attack behavior is not blocked; N indicates that the attack behavior is blocked, and the initial value of active is Y. Blocked attacks cannot be traversed and looked up when looking for attacks. It is also not shown on the directed graph of the attack behavior. It is convenient to quickly find the maximum possible subsequent attack behavior. *next—table213 is a pointer to the subsequent attack behavior table, pointing to the subsequent attack behavior table corresponding to the attack behavior.
  • the subsequent attack behavior table 22 is used to store all relevant information of the subsequent attack behavior, and the items in the table are respectively used to describe the arcs of the attack behavior weighted directed graph.
  • the initial value of active is Y.
  • the masked arc is set to the hidden state and is not displayed on the attack behavior with the weighted directed graph.
  • *respond224 is a pointer to a response subunit that prevents subsequent attack behavior from occurring.
  • the specific process of establishing the index table 21 and the subsequent attack behavior table 22 in this embodiment is: learning the precursor and successor relationship between the vertices of FIG. 1 according to the previously generated attack behavior information, and determining the weight data of the arc by using the historical sample data. . Then build index table 21, will all The name of the attack behavior is filled in the name 211 field in each entry in the index table 21, and the active 212 field is set to Y.
  • a subsequent attack behavior table 22 For each attack behavior, a subsequent attack behavior table 22 is established, and all subsequent attack behavior names of the attack behavior are filled in the next_name 221 field in the subsequent attack behavior table 22, and each subsequent attack behavior corresponds to one entry;
  • the *next_table 213 pointer of the entry corresponding to each attack behavior is directed to the corresponding subsequent attack behavior table 22; according to the historical sample data, the weight of the arc in each subsequent attack behavior table 22 is filled in num 222; the active 223 field is Set to Y; point the *respond 224 pointer in each entry of the subsequent attack behavior table 22 to the response sub-unit used to block the subsequent attack behavior.
  • the embodiments of the present invention describe in detail the important relationship between attack behaviors during an attack process, and no longer describe a certain attack.
  • FIG. 3 is a flow chart of predicting network attack behavior according to an embodiment of the present invention.
  • step S31 detecting network state parameters, if the network state parameter changes, indicating that an attack behavior occurs, the attack behavior information is obtained according to the change of the network parameter.
  • Step S32 determining whether the attack behavior is uniquely determined? If the attack behavior is the only determined attack behavior, go to step S33; otherwise, go to step S34.
  • Step S33 According to the correspondence between the attack behavior and the subsequent attack behavior, all subsequent attack behaviors of the attack behavior are put into the set GP.
  • Step S331 searching for the maximum possible subsequent attack behavior in the collection GP.
  • the greater the weight of the arc the more times the corresponding subsequent attack behavior occurs.
  • the subsequent attack behavior pointed to by the weight of the largest arc is the maximum possible subsequent attack behavior.
  • Step S332 the response subunit corresponding to the maximum possible subsequent attack behavior is blocked.
  • Step S333 Determine whether the response subunit blocks the occurrence of the maximum possible subsequent attack behavior. If the response subunit prevents the occurrence of the maximum possible subsequent attack behavior, then go to step S334; otherwise, go to step S335.
  • Step S334 the response subunit blocks the occurrence of the maximum possible subsequent attack behavior.
  • the weight of the arc pointing to the maximum possible subsequent attack behavior is increased by 1, indicating that the warning of the network attack behavior is successful, and the process ends.
  • Step S335 the response subunit prevents the maximum possible subsequent attack behavior from failing, and the network state is not restored to the safe state, and the weight of the arc pointing to the maximum possible subsequent attack behavior is decremented by one.
  • Step S336 removing the maximum possible subsequent attack behavior in the aggregate GP.
  • step S337 it is judged whether the set GP is empty. If it is empty, the process goes to step S31; otherwise, the process goes to step S331.
  • Step S34 the attack behavior is one of several possible attack behaviors, and according to the correspondence between the attack behavior and the subsequent attack behavior, the common maximum possible subsequent attack behavior is found in the subsequent attack behaviors of several possible attack behaviors.
  • step S341 it is determined whether there are common maximum possible subsequent attack behaviors of the subsequent attack behaviors of several possible attack behaviors. If yes, go to step S342, otherwise go to step S31.
  • Step S342 The response subunit corresponding to the common maximum possible subsequent attack behavior blocks the response.
  • Step S343 Determine whether the response subunit prevents the occurrence of the maximum possible subsequent attack behavior. If the response subunit prevents the occurrence of the maximum possible subsequent attack behavior, then go to step S344; otherwise, go to step S345.
  • Step S344 the response subunit blocks the occurrence of the maximum possible subsequent attack behavior, and restores the network state to the security state, and the weight of the arc pointing to the maximum possible subsequent attack behavior is added by ⁇ /k, where ⁇ is between 0 and 1.
  • ⁇ is between 0 and 1.
  • the value, k is the number of possible attack behaviors, indicating that the warning of the network attack behavior is successful, and the process ends.
  • Step S345 the response subunit prevents the maximum possible subsequent attack behavior from failing, and the network state is not restored to the safe state, and the weight of the arc pointing to the maximum possible subsequent attack behavior is reduced by ⁇ /k, where ⁇ is between 0 and 1.
  • k is the number of possible attacks.
  • A, B, C, and D are all aggressive behaviors.
  • B, C, and D are all subsequent attack behaviors of A.
  • the weight of arc AB is i
  • the weight of arc AC is j
  • the weight of arc AD is k.
  • response subunits 1, 3, and n prevent the occurrence of attack behaviors B, C, and D, respectively.
  • the current network status parameter changes, it is determined that the current attack behavior is A, then The subsequent attack behaviors A, C, and D of A form the set GP, and find the maximum possible subsequent attack behavior in the set GP. If i>j>k, then B is the maximum possible subsequent attack behavior, and the response subunit corresponding to B is called.
  • the prediction is successful, the weight i of the arc AB is incremented by 1, and the flow ends; if the response subunit 1 does not block B, the network state is not restored to the safe state, It indicates that the prediction fails, the weight of the arc AB is reduced by 1, and B is removed from the GP, and then returned to the GP to continue to search for the maximum possible subsequent attack behavior until the response subunit blocks the maximum possible subsequent attack behavior or the GP is empty.
  • the current network status parameter changes and determines that the current attack behavior may be B or D, find the maximum possible subsequent attack behavior of B and D respectively.
  • the attacks E, F, and C are the subsequent attack behaviors of attack B.
  • the weights of the arcs BE, BF, and BC are d, e, and a; the attacks C, F, and G are the subsequent attack behaviors of the attack D.
  • the weights of the arcs DC, DF, and DG are b, g, and h, respectively. If d>e, d>a, h>b, h>g, then the maximum possible subsequent attack behavior of B is E, and the maximum possible subsequent attack behavior of D is G, that is, B and D have no maximum possible subsequent attack behavior. Continue to monitor network status.
  • the response subunit 5 corresponding to F is called, and if the response subunit 5 blocks F, the network status After returning to the safe state, the prediction is successful.
  • the weights e and g of the arc BF and DF are respectively increased by ⁇ /2, and the flow ends. If the response subunit 5 does not block F, and the network state is not restored to the safe state, the prediction fails, and the arc
  • the weights e and g of BF and DF are reduced by ⁇ /2, respectively, and then the network state parameters are continuously monitored.
  • the above embodiment analyzes the subsequent attack behavior to find the maximum possible subsequent attack behavior, and the response sub-unit blocks the maximum possible subsequent attack behavior, achieving the purpose of early warning.
  • FIG. 4 is a flow chart of an attack support tree describing a network attack behavior according to an embodiment of the present invention.
  • the attack support tree is obtained by simplifying the directed graph of the attack behavior, including:
  • a weight threshold t is set according to historical data and experience.
  • step S42 the subsequent attack behavior table is accessed, and the num222 entry is traversed.
  • step S43 it is judged whether all the subsequent attack behavior tables are traversed. If the traversal is completed, the process goes to step S46, otherwise the process goes to step S44.
  • Step S44 comparing the value of num222 in the current successor attack behavior table with t, if the value of num222 in the current subsequent attack behavior table is less than t, then proceeding to step S45, otherwise turning Step S42.
  • step S45 the value of num222 in the subsequent attack behavior table is less than t, indicating that the probability of occurrence of the subsequent attack behavior is relatively small, and can be considered to be safe, so the arc corresponding to the num222 value in the current successor attack behavior table is masked.
  • the subsequent attack behavior pointed to by the arc is not searched and traversed.
  • the masked arc is hidden on the attack behavior weighted directed graph and is not displayed.
  • Step S46 after all the subsequent attack behavior tables are traversed, determine whether the attack behavior is directed to the directed graph because some arcs are blocked, and the vertices of some arcs become orphaned, if the attack behavior has a weighted directed graph If an orphan point occurs, go to step S47, otherwise go to step S48.
  • Step S47 shielding the above-mentioned orphan points.
  • the orphan point indicates the specific attack behavior.
  • the blocked attack behavior is not traversed and searched. Quickly find the most likely subsequent attack behavior.
  • Step S48 the attacking behavior of the above-mentioned arc and the orphan point is directed to the weighted directed graph, which is the attack support tree.
  • the specific includes:
  • Step S51 determining a specific attack behavior by monitoring changes in network state parameters.
  • Step S52 Determine whether the attack behavior is blocked. If it is masked, go to step S53, otherwise go to step S56. It is determined whether the attack behavior is masked as follows: The index table 21 is searched. If the acctive 212 corresponding to the attack behavior is N, it means that it is masked, and if it is Y, it means that it is not masked.
  • step S53 the mask of the vertex is cancelled, and the acctive 212 is changed to Y.
  • Step S54 canceling the shielding of the arc of the attack behavior to all of its subsequent attack behaviors.
  • the specific implementation steps are as follows: Find all subsequent attack behavior tables 22 corresponding to the attack behavior, and change the active 223 in all subsequent attack behavior tables 22 to Y.
  • step S55 the mask of the vertex corresponding to all subsequent attack behaviors of the attack behavior is cancelled.
  • the specific implementation steps are as follows: Step S54: Obtain the name next_name 221 of all subsequent attack behaviors of the attack behavior, search the index table 21, and select all entries corresponding to the next_name 221 The acctive212 inside is changed to Y.
  • step S56 the obtained new map is the requested attack support tree.
  • the above embodiment can establish the attack support tree by simplifying the attack behavior with the weighted directed graph, and can quickly judge the current attack mode and shorten the detection response time, thereby improving the efficiency of predicting the network attack behavior.
  • FIG. 6 is a structural diagram of an apparatus according to an embodiment of the present invention, including an attack behavior management unit 61 and an alarm unit 62, wherein the alarm unit further includes a response subunit 621 and a weight management subunit 622.
  • the attack behavior management unit 61 mainly monitors the network status parameter, determines the attack behavior when the network status parameter changes, and finds the maximum possible subsequent attack behavior of the attack behavior according to the correspondence between the attack behavior and the subsequent attack behavior, and passes the alarm unit.
  • the control response sub-unit 621 blocks the maximum possible subsequent attack behavior.
  • the response sub-unit 621 stores a policy for preventing the occurrence of a corresponding subsequent attack behavior for preventing the occurrence of subsequent attack behavior.
  • the weight management sub-unit 622 updates the number of occurrences from the attack behavior to the maximum subsequent attack behavior based on the blocking result of the response sub-unit 621 on the subsequent attack behavior. If the response sub-unit 621 prevents the subsequent attack behavior from succeeding and restores the network state to a secure state, the weight management sub-unit 622 increases the number of occurrences from the attack behavior to the maximum subsequent attack behavior. If the response sub-unit 621 prevents the subsequent attack behavior from failing and the network state is not restored to the secure state, the weight management sub-unit 622 reduces the number of occurrences from the attack behavior to the maximum subsequent attack behavior. By updating the number of occurrences from attack behavior to maximum subsequent attack behavior, it is possible to describe and predict the occurrence of cyber attack behavior more accurately and timely.
  • the attack behavior management unit 61 determines the attack behavior and the attack behavior occurs, and finds that B is the maximum successor attack behavior of A, the control response sub-unit 621 blocks B. If the response sub-unit 6211 prevents B from succeeding, restoring the network state to the secure state, the weight management sub-unit 622 updates i to i+1; if the response sub-unit 621 prevents B from failing, the network state is not restored to the secure state, then The weight management sub-unit 622 updates i to il.
  • the attack behavior management unit 61 determines that one of the attack behaviors B or D has an attack behavior, it searches for the common maximum successor attack behavior in the subsequent attack behaviors of B and D, and if the common maximum successor attack behavior is found to be F, then control The response sub-unit 621 blocks F. If the response sub-unit 621 prevents the F from succeeding, the network state is restored to the secure state, then the right The re-management sub-unit 622 updates e and g to e + ⁇ /2 and g+p/2; if the response sub-unit 621 prevents the F from failing, the network state is not restored to the secure state, then the weight management sub-unit 622 sets the e and g is updated to e - ⁇ /2 and g - ⁇ /2. Where ⁇ is a value between 0 and 1.
  • the embodiment of the present invention describes the relationship between the attack behavior and the attack behavior during the attack process, and according to the correspondence between the attack behavior and the subsequent attack behavior, all subsequent attacks from the attack behavior occur. Find the most likely subsequent attack behavior in the line, and block the response sub-unit corresponding to the maximum possible subsequent attack behavior, so as to predict and block the subsequent attack behavior, and realize the early warning of the subsequent attack behavior, thereby improving The security of the network.
  • the present invention can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases, the former is a better implementation. the way.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium, including a plurality of instructions for making a A computer device (which may be a personal computer, server, or network device, etc.) performs the methods described in various embodiments of the present invention.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

一种预测网络攻击行为的方法及装置 本申请要求于 2007 年 07 月 16 日提交中国专利局、 申请号为 200710130232.9、 发明名称为"一种预测网络攻击行为的方法及装置 "的中 国专利申请的优先权， 其全部内容通过引用结合在本申请中。 技术领域
本发明涉及网络通信安全领域， 特别是涉及一种预测网络攻击行为的 方法及装置。 背景技术
随着计算机网络技术的飞速发展， 社会的信息化程度不断提高， 网络 在给人们带来巨大的经济效益和社会效益的同时， 也面临着日益严重的安 全问题， 针对网络的攻击层出不穷。 攻击数量、 种类越来越多； 攻击越来 越复杂； 对依赖网络的用户危害也越来越大。 因此对网络攻击行为特点的 深入研究势在必行。
对网络攻击的研究不能仅从攻击的个体出发， 需要对整个网络攻击系 统有整体的认识。 但一方面攻击行为的复杂性、 多样性， 难于归纳总结， 特别是针对大规模网络的描述， 就更加困难。 另一方面现有的攻击模型大 多应用于入侵检测， 很少有从预警的角度对网络攻击行为进行描述分析。
如今大部分关于网络攻击的描述集中于归纳、 分类漏洞和攻击方法 上。 比如一种利用攻击树模型的描述方法， 使用树来表示攻击行为之间的 关联， 树的每个节点表示攻击的最终目标。 攻击树直观、 易于理解， 但是 它不区分攻击行为和攻击结果， 难以利用攻击树模型进行攻击预警。 另外 一种是基于对离散并行系统的数学表示 Petri 网的攻击网描述方法， 使用 Petri网的库所（ Place )表示攻击的阶段， 变迁（ Transition )表示攻击行为， 有向弧（Connection )表示攻击过程。 还有一种表示攻击过程的方法是状 态转换图。 攻击过程表示为系统状态之间的迁移， 通过检测攻击过程的各 个状态是否得到了满足判断是否发生了攻击， 可以根据已检测到的攻击行 为预测系统将会达到的危害状态， 但并没有考虑各种攻击过程之间的关 系。 现有入侵检测技术通过匹配已知攻击方法的特征对攻击行为进行检 测。如 Snort的入侵规则集通过单包特征对攻击进行检测。 STATL语言基于 状态和状态转移对攻击行为进行描述， 为基于状态图的入侵检测系统提供 入侵特征库。 ESTQ方法通过<事件， 协议状态， 时间关系， 数量关系>对 网络协议攻击进行描述。 IDIOT釆用有色 petri网对入侵进行建模和检测。
现有技术的另一种网络入侵行为和正常行为的形式化描述方法是以 ASSQ四元组为理论基础， 在已有 Petri网模型的基础上进行了重新定义和 修改，可以应用在各种入侵检测和相关系统中，用来跟踪、检测入侵行为， 区分系统正常行为和入侵行为。这项技术是 ESTQ方法和 petri网相结合的描 述方法。 ASSQ四元组是 ESTQ方法的改进，是对入侵行为的总体上的描述， 对攻击在系统状态和网络事件中表现出来的时间和数量上的关系进行分 析， 通过重新定义的 Petri网模型来实现对四元组的描述。
在实现本发明过程中， 发明人发现现有技术中， 要么对攻击过程中攻 击行为的描述过于简单， 不能对攻击过程进行清晰的描述， 没有体现出大 规模网络攻击的整体性， 不适用于宏观网络。 要么只是单纯通过四元组对 入侵行为进行定义，并以 petri网描述入侵过程，没有进一步提出如何对下 一步入侵行为进行预测和描述。 发明内容
本发明实施例提供一种预测网络攻击行为的方法及装置，可对后继攻 击行为进行预测和阻止。
本发明实施例提供的一种预测网络攻击行为的方法， 包括： 监测网络状态参数，并根据网络状态参数的变化，获得攻击行为信息； 根据攻击行为与后继攻击行为的对应关系， 从所述攻击行为对应的后 继攻击行为中选择一个最大可能后继攻击行为， 所述最大可能后继攻击行
本发明实施例还提供一种预测网络攻击行为的装置， 包括： 攻击行为管理单元， 用于检测网络状态参数的变化， 根据网络参数发 生变化，查找到攻击行为信息，根据攻击行为与后继攻击行为的对应关系， 从所述攻击行为对应的后继攻击行为中预测最大可能后继攻击行为。 本发明的实施例通过详细描述攻击行为过程及攻击过程中攻击行为 之间的关系， 根据攻击行为与其后继攻击行为的对应关系， 从所发生攻击 行为的所有后继攻击行中查找最大可能的后继攻击行为， 并对最大可能后 继攻击行为所对应的响应子单元对其进行阻止， 这样可对后继攻击行为进 行预测和阻止， 提出了预警的方法， 达到了预警的目的， 从而提高了网络 的安全性。 附图说明
图 1 是本发明实施例的一种描述网络攻击行为的带权有向图的结构 图；
图 2是本发明实施例的一种描述网络攻击行为的索引表和后继攻击行 为表的结构图；
图 3是本发明实施例的一种预测网络攻击行为的流程图；
图 4是本发明实施例的一种描述网络攻击行为的攻击支撑树流程图； 图 5 是本发明实施例的另一种描述网络攻击行为的攻击支撑树流程 图；
图 6 是本发明实施例提供的一种预测网络攻击行为的装置结构示意 图。 具体实施方式
下面结合附图和实施例，对本发明的具体实施方式作进一步详细描 述。
攻击行为与其后继攻击行为之间的对应关系可带权有向图来表示。 图 1是本发明实施例的一种描述网络攻击行为的带权有向图的结构图， 圓圈 是攻击行为带权有向图中的顶点， 每个顶点表示一种攻击行为， 圓圈内的 字母表示具体攻击行为的名称； 箭头线是攻击行为带权有向图中的弧， 弧 代表由攻击行为到后继攻击行为的指向关系， 弧尾连接前驱攻击行为， 弧 头指向后继攻击行为， 例如 A为前驱攻击行为， B、 C、 D是 A的后继攻 击行为； 箭头线上的字母是攻击行为带权有向图中的弧的权重， 描述的是 从前驱攻击行为到后继攻击行为这一攻击行为序列的历史发生次数。 例如 弧 AB的权重为 i, 则表示以前从攻击行为 A到攻击行为 B发生过 i次； 而弧 AC的权重为 j , 如果 i>j , 则表明由攻击行为 A到攻击行为 B的攻击 行为序列历史上发生次数大于由攻击行为 A到攻击行为 C的攻击行为序 列； 反之， 如果 i<j , 由攻击行为 A到攻击行为 C的攻击行为序列历史上 发生次数大于由攻击行为 A到攻击行为 B的攻击行为序列。
图 2是本发明实施例的一种描述网络攻击行为的索引表和后继攻击行 为表的结构图。 攻击行为名称、 攻击行为状态与后继攻击行为之间的对应 关系用索引表来表示， 后继攻击行为名称、 后继攻击行为状态、 由攻击行 为到后继攻击行为发生次数以及阻止所述最大可能后继攻击行为发生的 策略之间的对应关系用后继攻击表来表示。 根据图 1 , 建立一个索引表 21 和多个后继攻击行为表 22。 索引表 21中每一项的结构为 name 211, active 212,*next— table 213。 其中， name 211是攻击行为名称， name E n, n是攻击 行为名称集合； active 212表示攻击行为状态， 其中 Y表示该攻击行为没 有被屏蔽； N表示该攻击行为被屏蔽， active初始值均为 Y。 在查找攻击 行为时， 被屏蔽的攻击行为不能够被遍历和查找。 在攻击行为带权有向图 上也不显示出来。 方便快速查找最大可能后继攻击行为。 *next— table213 是指向后继攻击行为表的指针， 指向该攻击行为对应的后继攻击行为表。 后继攻击行为表 22用于存储后继攻击行为的所有相关信息， 表中的各项 分别用来描述攻击行为带权有向图中的各条弧。 每一个表项的结构为 next— name 221 , num 222 , active 223, *respond 224。 其中 next— name 221是 后继攻击行为名称， next name E n; num 222是由攻击行为到后继攻击行为 发生次数； active 223 表示后继攻击行为状态， 具体是指攻击行为与其后 继攻击行为之间的弧的状态， 其中 Y表示该弧没有被屏蔽； N表示该弧被 屏蔽。 active初始值均为 Y。 被屏蔽的弧被设置为隐藏状态， 在攻击行为 带权有向图上不显示出来。 *respond224 是指向阻止后继攻击行为发生的 响应子单元的指针。
本实施例中建立索引表 21和后继攻击行为表 22的具体过程为： 根据先前发生的攻击行为信息获知如图 1的各顶点之间的先驱和后继 关系， 利用历史样本数据确定弧的权重数据。 然后建立索引表 21 , 将所有 攻击行为名称填入索引表 21 中的每一个表项中的 name 211字段， active 212字段均设为 Y。 针对每一个攻击行为， 建立一个后继攻击行为表 22 , 将该攻击行为的所有后继攻击行为名称填入后继攻击行为表 22 中的 next— name 221 字段内， 每一个后继攻击行为对应一个表项； 将每一个攻 击行为所对应表项的 *next— table 213指针指向对应的后继攻击行为表 22; 根据历史样本数据， 填写每个后继攻击行为表 22中的弧的权重 num 222; active 223字段均设为 Y; 将后继攻击行为表 22每一项中的 *respond 224 指针指向用于阻止该后继攻击行为的响应子单元。 通过上述步骤得到索引 表 21和后继攻击行为表 22。
通过以上实施例可以看出，本发明实施例详细描述了攻击过程中攻击 行为之间的重要关系， 不再单一描述某一攻击。
图 3是本发明实施例的一种预测网络攻击行为的流程图。 参照图 3 , 步骤 S31 , 检测网络状态参数， 如果网络状态参数发生变化， 说明发 生攻击行为， 则根据网络参数的变化， 获得攻击行为信息。
步骤 S32, 判断该攻击行为是否为唯一确定的？ 攻击行为， 如果是唯 一确定的攻击行为， 则转步骤 S33; 否则转步骤 S34。
步骤 S33 , 根据攻击行为与其后继攻击行为的对应关系， 将该攻击行 为的所有后继攻击行为放入集合 GP中。
步骤 S331 , 在集合 GP中查找最大可能的后继攻击行为。 遍历所有指 向后继攻击行为的弧的权重， 弧的权重越大， 表明对应的后继攻击行为发 生的次数越多。 数值最大的弧的权重所指向的后继攻击行为即为最大可能 后继攻击行为。
步骤 S332 , 最大可能后继攻击行为所对应的响应子单元对其进行阻 止。
步骤 S333 , 判断该响应子单元是否阻止了最大可能后继攻击行为的 发生。 如果该响应子单元阻止了最大可能后继攻击行为的发生， 则转到步 骤 S334; 否则转到步骤 S335。
步骤 S334 , 该响应子单元阻止了最大可能后继攻击行为的发生， 将 网络状态恢复到安全状态，则指向最大可能后继攻击行为的弧的权重加 1 , 说明对网络攻击行为的预警成功， 流程结束。
步骤 S335 , 该响应子单元阻止了最大可能后继攻击行为失败， 网络 状态未恢复到安全状态， 则指向最大可能后继攻击行为的弧的权重减 1。
步骤 S336, 在集合 GP中除去最大可能后继攻击行为。
步骤 S337 , 判断集合 GP是否为空， 如果为空， 则转到步骤 S31 ; 否 则， 转到步骤 S331。
步骤 S34, 该攻击行为是几个可能攻击行为之一， 则根据攻击行为与 后继攻击行为的对应关系， 在几个可能攻击行为的后继攻击行为中查找共 同的最大可能后继攻击行为。
步骤 S341 , 判断几个可能攻击行为的后继攻击行为是否存在共同的 最大可能后继攻击行为，如果存在，则转到步骤 S342, 否则转到步骤 S31。
步骤 S342 , 共同的最大可能后继攻击行为所对应的响应子单元对其 进行阻止。
步骤 S343 , 判断该响应子单元是否阻止了最大可能后继攻击行为的 发生。 如果该响应子单元阻止了最大可能后继攻击行为的发生， 则转到步 骤 S344; 否则转到步骤 S345。
步骤 S344 , 该响应子单元阻止了最大可能后继攻击行为的发生， 将 网络状态恢复到安全状态， 则指向最大可能后继攻击行为的弧的权重加 β/k, 其中 β在 0至 1之间取值， k是可能攻击行为的个数， 说明对网络攻 击行为的预警成功， 流程结束。
步骤 S345 , 该响应子单元阻止了最大可能后继攻击行为失败， 网络 状态未恢复到安全状态， 则指向最大可能后继攻击行为的弧的权重减 β/k, 其中 β在 0至 1之间取值， k是可能攻击行为的个数。 图 1、 图 2, A、 B、 C、 D均为攻击行为， B、 C、 D均为 A的后继攻击 行为， 弧 AB的权重为 i, 弧 AC的权重为 j , 弧 AD的权重为 k。 如图 2 所示， 响应子单元 1、 3、 n分别阻止攻击行为 B、 C、 D的发生。
如果当前网络状态参数发生变化， 确定当前发生的攻击行为是 A, 则 由 A的后继攻击行为8、 C、 D组成集合 GP, 并在集合 GP中查找最大可 能后继攻击行为， 如果 i>j>k, 则 B为最大可能后继攻击行为， 调用 B 对应的响应子单元 U1, 如果响应子单元 U1阻止了 B, 网络状态恢复到安 全状态， 则预测成功， 弧 AB的权重 i加 1, 流程结束； 若响应子单元 1 没有阻止 B, 网络状态未恢复到安全状态， 则表明预测失败， 弧 AB的权 重 i减 1, 并将 B从 GP中去除， 然后返回到 GP, 继续寻找最大可能后继 攻击行为， 直到响应子单元阻止了最大可能后继攻击行为或 GP为空。
如果当前网络状态参数发生变化，确定当前发生攻击行为可能是 B或 D, 则分别查找 B、 D的最大可能后继攻击行为。 在图 1中， 攻击 E、 F、 C均为攻击 B的后继攻击行为， 弧 BE、 BF、 BC的权重分别为 d、 e、 a; 攻击 C、 F、 G为攻击 D的后继攻击行为， 弧 DC、 DF、 DG的权重分别为 b、 g、 h。 如果 d>e, d>a, h>b, h>g, 则 B的最大可能后继攻击行为 为 E, D的最大可能后继攻击行为为 G, 即 B和 D没有最大可能后继攻 击行为， 则继续监测网络状态。 如果 e>d, e>a, g>b, g>h, B和 D的 最大可能后继攻击行为均为 F, 调用 F对应的响应子单元 5, 如果响应子 单元 5阻止了 F, 网络状态恢复到安全状态， 则预测成功， 弧 BF、 DF的 权重 e、 g分别增加 β/2, 流程结束； 如果响应子单元 5没有阻止了 F, 网 络状态未恢复到安全状态， 则预测失败， 弧 BF、 DF的权重 e、 g分别减 小 β/2, 然后继续监测网络状态参数。
以上实施例通过分析后继攻击行为， 查找最大可能后继攻击行为， 由 响应子单元对最大可能后继攻击行为进行阻止， 达到了预警的目的。
图 4是本发明实施例的一种描述网络攻击行为的攻击支撑树流程图。 攻击支撑树是对攻击行为带权有向图进行简化得到的， 具体包括：
步骤 S41, 根据历史数据和经验， 设定一个权重阔值 t。
步骤 S42, 访问后继攻击行为表， 对 num222表项遍历。
步骤 S43, 判断是否所有后继攻击行为表遍历完毕， 如果遍历完毕， 则转步骤 S46, 否则转步骤 S44。
步骤 S44, 用当前后继攻击行为表中的 num222数值与 t进行比较， 如果当前后继攻击行为表中的 num222数值小于 t, 则转步骤 S45, 否则转 步骤 S42。
步骤 S45 , 后继攻击行为表中的 num222数值小于 t, 则表明该后继攻 击行为发生的几率比较小， 可以认为是安全的， 所以屏蔽该当前后继攻击 行为表中的 num222数值对应的弧。 不对该弧指向的后继攻击行为进行查 找和遍历。 被屏蔽的弧在攻击行为带权有向图上被隐藏， 不显示出来。
步骤 S46, 当所有后继攻击行为表遍历完毕后， 判断所述攻击行为带 权有向图是否因为屏蔽一些弧， 而使一些弧的顶点变成孤点， 如果所述攻 击行为带权有向图出现孤点， 则转步骤 S47 , 否则转步骤 S48。
步骤 S47 , 屏蔽上述孤点。 孤点表示具体的攻击行为， 在查找最大可 能后继攻击行为时， 对被屏蔽的攻击行为不进行遍历和查找。 以快速查找 到最大可能后继攻击行为。
步骤 S48, 屏蔽了上述弧和孤点的攻击行为带权有向图即为所求的攻 击支撑树。
如果判断到的攻击行为所对应的顶点是被屏蔽的， 则取消对该顶点以 及和其关联的弧的屏蔽。 如果某个被屏蔽的弧所对应的攻击序列再次出 现， 则取消对其的屏蔽。 如图 5所示， 具体包括：
步骤 S51 , 通过监测网络状态参数的变化， 确定了某个具体攻击行为 发生。
步骤 S52 , 判断该攻击行为是否被屏蔽。 如果被屏蔽， 则转步骤 S53 , 否则转步骤 S56。 判断该攻击行为是否被屏蔽具体为： 查找索引表 21 , 如 果该攻击行为对应的 acctive212为 N, 则表示被屏蔽， 为 Y, 则表示未被 展蔽。
步骤 S53 , 取消对该顶点的屏蔽， 即将 acctive212改为 Y。
步骤 S54, 取消对该攻击行为指向其所有后继攻击行为的弧的屏蔽。 具体实施步骤为： 查找该攻击行为对应的所有后继攻击行为表 22 ,将所有 后继攻击行为表 22内的 active 223改为 Y。
步骤 S55 ,取消对该攻击行为的所有后继攻击行为对应的顶点的屏蔽。 具体实施步骤为： 由步骤 S54, 得到该攻击行为所有后继攻击行为的名称 next— name 221 , 查找索引表 21 , 将所有名称与 next— name 221对应的表项 内的 acctive212改为 Y。
步骤 S56, 得到的新图即为所求的攻击支撑树。
以上实施例通过简化攻击行为带权有向图来建立攻击支撑树，可以更 快的判断当前攻击的模式， 缩短检测的响应时间， 从而提高了预测网络攻 击行为的效率。
图 6是本发明实施例的一种装置结构图， 包括攻击行为管理单元 61 和告警单元 62, 其中告警单元又包括响应子单元 621 和权重管理子单元 622。 攻击行为管理单元 61主要是监测网络状态参数， 当网络状态参数发 生变化， 确定攻击行为发生， 根据攻击行为与后继攻击行为的对应关系， 找出攻击行为的最大可能后继攻击行为， 并通过告警单元 62控制响应子 单元 621对最大可能后继攻击行为进行阻止。 响应子单元 621存储了阻止 对应后继攻击行为发生的策略， 用于阻止后继攻击行为的发生。 权重管理 子单元 622是根据响应子单元 621对后继攻击行为的阻止结果来更新由攻 击行为到最大后继攻击行为的发生次数。 如果响应子单元 621阻止后继攻 击行为成功， 将网络状态恢复到安全状态， 则权重管理子单元 622增加由 攻击行为到最大后继攻击行为的发生次数。 如果响应子单元 621阻止后继 攻击行为失败， 未将网络状态恢复到安全状态， 则权重管理子单元 622减 小由攻击行为到最大后继攻击行为的发生次数。 通过更新由攻击行为到最 大后继攻击行为的发生次数， 可以更加准确、 及时的描述和预测网络攻击 行为的发生。
如果攻击行为管理单元 61确定攻击行为 Α发生攻击行为， 找到 B为 A的最大后继攻击行为， 则控制响应子单元 621对 B进行阻止。 如果响应 子单元 6211阻止 B成功， 将网络状态恢复到安全状态， 则权重管理子单 元 622把 i更新为 i+1 ; 如果响应子单元 621阻止 B失败， 未将网络状态 恢复到安全状态， 则权重管理子单元 622把 i更新为 i-l。
如果攻击行为管理单元 61确定攻击行为 B或 D中间的一个发生攻击 行为， 则在 B和 D的后继攻击行为中寻找共同的最大后继攻击行为， 如 果找到共同的最大后继攻击行为为 F, 则控制响应子单元 621对 F进行阻 止。 如果响应子单元 621阻止 F成功， 将网络状态恢复到安全状态， 则权 重管理子单元 622把 e和 g更新为 e +β/2和 g+p/2; 如果响应子单元 621 阻止 F失败， 未将网络状态恢复到安全状态， 则权重管理子单元 622把 e 和 g更新为 e -β/2和 g -β/2。 其中 β在 0至 1间取值。
通过以上实施例，可以看出本发明实施例通过对攻击行为过程及攻击 过程中攻击行为之间的关系的描述， 根据攻击行为与其后继攻击行为的对 应关系， 从所发生攻击行为的所有后继攻击行中查找最大可能的后继攻击 行为， 并对最大可能后继攻击行为所对应的响应子单元对其进行阻止， 这 样可对后继攻击行为进行预测和阻止， 实现了对后继攻击行为的预警， 从 而提高了网络的安全性。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到本 发明可借助软件加必需的通用硬件平台的方式来实现， 当然也可以通过硬 件， 但很多情况下前者是更佳的实施方式。 基于这样的理解， 本发明的技 术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式 体现出来， 该计算机软件产品存储在一个存储介质中， 包括若干指令用以 使得一台计算机设备（可以是个人计算机， 服务器， 或者网络设备等）执 行本发明各个实施例所述的方法。
以上所述仅是本发明的优选实施方式， 应当指出， 对于本技术领域的 普通技术人员来说， 在不脱离本发明原理的前提下， 还可以做出若干改进 和润饰， 这些改进和润饰也应视为本发明的保护范围。

Claims

权 利 要 求
1、 一种预测网络攻击行为的方法， 其特征在于， 包括：
监测网络状态参数，并根据网络状态参数的变化，获得攻击行为信息； 根据攻击行为与后继攻击行为的对应关系， 从所述攻击行为对应的后 继攻击行为中选择一个最大可能后继攻击行为， 所述最大可能后继攻击行
2、 如权利要求 1 所述预测网络攻击行为的方法， 其特征在于， 如果 所述攻击行为包括一个攻击行为， 则在所述攻击行为的所有后继攻击行为 中查找最大可能后继攻击行为。
3、 如权利要求 1 所述预测网络攻击行为的方法， 其特征在于， 如果 所述攻击行为是多个可能攻击行为， 则在多个可能攻击行为中查找共同的 最大可能后继攻击行为。
4、 如权利要求 1 所述预测网络攻击行为的方法， 其特征在于， 在将 对所述最大可能后继攻击行为进行阻止；
如果阻止所述最大可能后继攻击行为成功， 则增加由所述攻击行为到 所述最大可能后继攻击行为的发生次数；
如果阻止所述最大可能后继攻击行为失败， 则减小由所述攻击行为到 所述最大可能后继攻击行为的发生次数。
5、 如权利要求 4所述预测网络攻击行为的方法， 其特征在于， 增加 或减小由所述攻击行为到所述最大可能后继攻击行为的发生次数， 具体 为：
如果所述攻击行为是唯一确定的攻击行为， 则由所述攻击行为到所述 最大可能后继攻击行为的发生次数增加或减小 1 ;
如果所述攻击行为是多个可能攻击行为之一， 则由所述攻击行为到所 述最大可能后继攻击行为发生的可能性系数增加或减小 β/k, 其中 β在 0 至 1之间取值， k是可能攻击行为的个数。
6、 如权利要求 1 所述预测网络攻击行为的方法， 其特征在于， 在监 测网络状态参数之前， 还包括： 为之间的对应关系；
建立后继攻击行为名称、 后继攻击行为状态、 由所述攻击行为到后继 攻击行为的发生次数以及阻止所述最大可能后继攻击行为发生的策略之 间的对应关系。
7、 如权利要求 6所述预测网络攻击行为的方法， 其特征在于， 在建 立所述对应关系之后， 还包括：
判断由所述攻击行为到后继攻击行为的发生次数是否小于权重阔值； 如果是， 则屏蔽所述后继攻击行为及由所述攻击行为到所述后继攻击 行为的指向关系。
8、 如权利要求 7 所述预测网络攻击行为的方法， 其特征在于， 如果 被屏蔽的所述后继攻击行为的前驱攻击行为发生攻击， 则取消对所述后继 攻击行为的屏蔽， 并取消对由所述前驱攻击行为到其所有后继攻击行为的 指向关系的屏蔽。
9、 一种预测网络攻击行为的装置， 其特征在于， 包括： 攻击行为管 理单元， 用于检测网络状态参数的变化， 根据网络参数发生变化， 查找到 攻击行为信息， 根据攻击行为与后继攻击行为的对应关系， 从所述攻击行 为对应的后继攻击行为中预测最大可能后继攻击行为。
10、 如权利要求 9所述预测网络攻击行为的装置， 其特征在于， 还包 括：
告警单元， 用于对所述攻击行为管理单元预测出的最大可能后继攻击 行为进行阻止， 更新由所述攻击行为到其最大可能后继攻击行为的发生次 数。
11、 如权利要求 9所述预测网络攻击行为的装置， 其特征在于， 所述 告警单元还包括：
所述响应子单元， 用于阻止后继攻击行为进行攻击；
所述权重管理子单元， 用于更新由所述攻击行为到其最大可能后继攻 击行为的发生次数。
12、 如权利要求 11 所述预测网络攻击行为的装置， 其特征在于， 所 述权重管理子单元更新由所述攻击行为到其最大可能后继攻击行为的发 生次数，
如果所述响应子单元阻止所述最大可能后继攻击行为成功， 则所述权 重管理子单元增加由所述攻击行为到其最大可能后继攻击行为的发生次 数；
如果所述响应子单元阻止所述最大可能后继攻击行为失败， 则所述权 重管理子单元减小由所述攻击行为到其最大可能后继攻击行为的发生次 数。
PCT/CN2008/071218 2007-07-16 2008-06-06 Procédé et appareil pour prédire une action d'attaque de réseau WO2009009975A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP08160556A EP2026527A1 (en) 2007-07-16 2008-07-16 Method and device for predicting a network attack action

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2007101302329A CN101075917B (zh) 2007-07-16 2007-07-16 一种预测网络攻击行为的方法及装置
CN200710130232.9 2007-07-16

Publications (1)

Publication Number Publication Date
WO2009009975A1 true WO2009009975A1 (fr) 2009-01-22

Family

ID=38976746

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2008/071218 WO2009009975A1 (fr) 2007-07-16 2008-06-06 Procédé et appareil pour prédire une action d'attaque de réseau

Country Status (4)

Country Link
US (1) US20090307777A1 (zh)
EP (1) EP2026527A1 (zh)
CN (1) CN101075917B (zh)
WO (1) WO2009009975A1 (zh)

Families Citing this family (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101075917B (zh) * 2007-07-16 2010-08-25 华为技术有限公司 一种预测网络攻击行为的方法及装置
CN101754241B (zh) * 2008-12-18 2012-12-19 中兴通讯股份有限公司 一种用于无线通信的预警系统及方法
CN102447695B (zh) * 2011-11-14 2015-12-09 中国科学院软件研究所 一种识别业务系统中关键攻击路径的方法
US8863293B2 (en) * 2012-05-23 2014-10-14 International Business Machines Corporation Predicting attacks based on probabilistic game-theory
US10095978B2 (en) * 2013-01-05 2018-10-09 Microsoft Technology Licensing, Llc Monitor-mine-manage cycle
CN103281317B (zh) * 2013-05-09 2016-06-08 浙江师范大学 一种软件定义网络的攻击测试方法
US9171167B2 (en) * 2013-06-20 2015-10-27 The Boeing Company Methods and systems for use in analyzing cyber-security threats in an aviation platform
CN105683987B (zh) 2013-10-24 2018-11-16 三菱电机株式会社 信息处理装置和信息处理方法
US9253204B2 (en) * 2014-03-19 2016-02-02 International Business Machines Corporation Generating accurate preemptive security device policy tuning recommendations
US9680855B2 (en) 2014-06-30 2017-06-13 Neo Prime, LLC Probabilistic model for cyber risk forecasting
CN105488393B (zh) * 2014-12-27 2018-07-03 哈尔滨安天科技股份有限公司 一种基于数据库蜜罐的攻击行为意图分类方法及系统
FR3033971B1 (fr) * 2015-03-20 2018-06-15 Airbus Defence And Space Procede, serveur et systeme de determination d'une strategie a mener par un observateur contre un agent hostile
CN106487534B (zh) 2015-08-24 2019-08-13 华为技术有限公司 网络控制策略的生成方法、装置及网络控制器
US10262132B2 (en) * 2016-07-01 2019-04-16 Entit Software Llc Model-based computer attack analytics orchestration
CN106506567A (zh) * 2017-01-12 2017-03-15 成都信息工程大学 一种基于行为评判的隐蔽式网络攻击主动发现方法
WO2019028341A1 (en) * 2017-08-03 2019-02-07 T-Mobile Usa, Inc. SIMILARITY SEARCH FOR DISCOVERY OF MULTI-VECTOR ATTACKS
IL258345B2 (en) * 2018-03-25 2024-01-01 B G Negev Technologies And Applications Ltd At Ben Gurion Univ – 907553 A rapid framework for ensuring cyber protection, inspired by biological systems
US10749890B1 (en) * 2018-06-19 2020-08-18 Architecture Technology Corporation Systems and methods for improving the ranking and prioritization of attack-related events
US11429713B1 (en) 2019-01-24 2022-08-30 Architecture Technology Corporation Artificial intelligence modeling for cyber-attack simulation protocols
WO2020195229A1 (ja) * 2019-03-28 2020-10-01 日本電気株式会社 分析システム、方法およびプログラム
US11403405B1 (en) 2019-06-27 2022-08-02 Architecture Technology Corporation Portable vulnerability identification tool for embedded non-IP devices
US11902312B2 (en) * 2019-11-01 2024-02-13 Cymulate Ltd. Security threats from lateral movements and mitigation thereof
CN110855715B (zh) * 2019-11-29 2022-02-18 国家电网有限公司客户服务中心 基于随机Petri网的DOS攻防模拟方法
US11930026B1 (en) * 2020-07-09 2024-03-12 EJ2 Communications, Inc. Automating interactions with web services
CN114765555A (zh) * 2021-01-12 2022-07-19 华为技术有限公司 一种网络威胁的处理方法和通信装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6513122B1 (en) * 2001-06-29 2003-01-28 Networks Associates Technology, Inc. Secure gateway for analyzing textual content to identify a harmful impact on computer systems with known vulnerabilities
US20030110396A1 (en) * 2001-05-03 2003-06-12 Lewis Lundy M. Method and apparatus for predicting and preventing attacks in communications networks
CN1770699A (zh) * 2004-11-01 2006-05-10 中兴通讯股份有限公司 一种网络安全预警方法
CN101075917A (zh) * 2007-07-16 2007-11-21 华为技术有限公司 一种预测网络攻击行为的方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030110396A1 (en) * 2001-05-03 2003-06-12 Lewis Lundy M. Method and apparatus for predicting and preventing attacks in communications networks
US6513122B1 (en) * 2001-06-29 2003-01-28 Networks Associates Technology, Inc. Secure gateway for analyzing textual content to identify a harmful impact on computer systems with known vulnerabilities
CN1770699A (zh) * 2004-11-01 2006-05-10 中兴通讯股份有限公司 一种网络安全预警方法
CN101075917A (zh) * 2007-07-16 2007-11-21 华为技术有限公司 一种预测网络攻击行为的方法及装置

Also Published As

Publication number Publication date
EP2026527A1 (en) 2009-02-18
US20090307777A1 (en) 2009-12-10
CN101075917A (zh) 2007-11-21
CN101075917B (zh) 2010-08-25

Similar Documents

Publication Publication Date Title
WO2009009975A1 (fr) Procédé et appareil pour prédire une action d&#39;attaque de réseau
US20170288974A1 (en) Graph-based fusing of heterogeneous alerts
CN103685575B (zh) 一种基于云架构的网站安全监控方法
US8839440B2 (en) Apparatus and method for forecasting security threat level of network
Zhengbing et al. A novel network intrusion detection system (nids) based on signatures search of data mining
US20100268818A1 (en) Systems and methods for forensic analysis of network behavior
US10476752B2 (en) Blue print graphs for fusing of heterogeneous alerts
CN111200575B (zh) 一种基于机器学习的信息系统恶意行为的识别方法
Balkanli et al. Feature selection for robust backscatter DDoS detection
Chkirbene et al. A combined decision for secure cloud computing based on machine learning and past information
Liao et al. Secure machine learning, a brief overview
CN110557397A (zh) 一种基于混沌理论分析的DDoS攻击检测方法
Wu et al. Mitigation measures of collusive interest flooding attacks in named data networking
CN103501302B (zh) 一种蠕虫特征自动提取的方法及系统
Al-Araji et al. Attack prediction to enhance attack path discovery using improved attack graph
WO2017176676A1 (en) Graph-based fusing of heterogeneous alerts
Liu et al. A survey of cyber security approaches for prediction
Marhusin et al. An overview of recent advances in intrusion detection
WO2010071625A1 (en) Systems and methods for forensic analysis of network behavior
Bhuyan et al. Alert management and anomaly prevention techniques
Bing et al. Data mining approaches for signatures search in network intrusion detection
Neil Using new edges for anomaly detection in computer networks
Bo et al. A new approach for early detection of internet worms based on connection degree
Jemili et al. Hybrid Intrusion Detection and Prediction multiAgent System HIDPAS
Kolaczek et al. Attack pattern analysis framework for multiagent intrusion detection system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 08757629

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 4476/KOLNP/2009

Country of ref document: IN

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 08757629

Country of ref document: EP

Kind code of ref document: A1