2008年 第10卷 第8期
反应式容侵系统入侵预测的混合式贝叶斯网络方法
1. 东南大学计算机科学与工程学院, 南京 210018;
2. 江苏大学计算机科学与通信工程学院, 江苏镇江 212013;
3. 西安电子科技大学计算机网络与信息安全教育部重点实验室, 西安 710071
下一篇 上一篇
摘要
为解决反应式容忍入侵系统中的入侵预测问题，提出了新的混合式贝叶斯网络方法。该方法中，提出了一种基于系统安全状态的入侵模型，以攻击者能力上升的过程来描述入侵，关注入侵对系统的影响，适合于反应式容侵系统根据当前状态选择合适的响应机制。提出了基于入侵模型的混合式贝叶斯网络(HyBN, hybrid bayesian network)模型，将入侵模型中攻击行为和系统安全状态节点分离为攻击层和状态层两个网络层次，两层间使用收敛连接，而两层内部的节点间使用连续连接。在特定的信度更新算法的支持下，实验说明该贝叶斯网络方法用于入侵预测的有效性，比较说明HyBN方法的优点。
图片
图 1
图 2
图 3
图 4
图 5
图 6
图 7
参考文献
[ 1 ] VerissimoPE, NevesNF, CorreiaMP.Intrusion-tolerant Architectures:ConceptsandDesign[ J] .LectureNotesinComputerScience, 2003, 2677:90-109 链接1
[ 2 ] 崔竞松,王丽娜,张焕国,等.一种并行容侵系统研究模型———RC模型[J].计算机学报,2004,27(4):500-506 链接1
[ 3 ] MarshA, SchneiderB.CODEX:a robustandsecure secret distribution System[J] .IEEE Transactions on Dependable and Secure Computing, 2004, 1 ( 1) :34 -47 链接1
[ 4 ] KursaweK.Asynchronous Byzantine Group Communication.21st IEEE Symposiumon Reliable Distributed Systems[C] .Osaka, Japan, 2002:352-357 链接1
[ 5 ] LiuPeng, JingJiwu.The Design and Implementation of a SelfHealing Database System[ J] .Journal of Intelligent Information Systems, 2004, 23 ( 3) :247-269 链接1
[ 6 ] WangRong, WangFeiyi, GregoryB.Design and implementation of acceptance monitor for building intrusion tolerant systems[J] . Software-Practice and Experience, 2003, 33 ( 14) :1399 -1417 链接1
[ 7 ] JulischK.Mining alarm clusters to improve alarm handling efficiency[A] .17th Annual Computer Security Applications Conference( ACSAC′01) [ C] .NewYork, 2001:12-21 链接1
[ 8 ] UndercofferJ, PinkstonJ.Modeling computer attacks:a targetcentric ontology for intrusion detection[A] .The Sixth In ternational Symposiumon Recent Advancesin Intrusion Detection[ C] . Pittsburgh, PA, USA, 2003 链接1
[ 9 ] CheungS, LindqvistU, MartinW.Modeling multi-step cyber attacks for scenario recognition[ A] .DARPA Information Survivability Conference and Exposition[ C] .Washington, DC, 2003 链接1
[10] ZhouJimmy, HeckmanM, ReynoldsB, etal, Modeling network intrusion detection alerts for correlation[ J] .ACM Transactions on Information and System Security, 2007, 10( 1 ) :1-31 链接1
[11] NingPeng, CuiYun, ReevesDS, etal.Techniques and tools for analyzing intrusion alerts[ J] .ACM Transactions on Information and System Security, 2004, 7 ( 2) :274-318 链接1
[12] Ramasubramanian P, Kannan A.Quick propneural network short term forecasting framework for a database intrusion prediction system[ J] .Lecture Notes in Artificial Interlligence, 2004, 3070:847 -852
[13] Qin Xin zhou, Li Wenke.Attack plan recognition and prediction using causal networks[ A] .Proceeding of 20th Annual Security Application Conference( ACSAC´ 04) [ C] .Tucson, Arizona, December2004 链接1
[14] Wang Ling yu, Liu Anyi, Sushil J.An efficient and unified approach to correlating, hypothesizing, and predicting intrusion alerts[ A] .Proceedings of the 10th European Symposium on Research in Computer Security( ESORICS2005 ) [ C] .Germany: Springer Press, 2005:247-266 链接1
京公网安备 11010502051620号
