Abstract: In order to accurately evaluate the vulnerability of computer network,a new evaluation algorithm is proposed by combining Bayesian network with attack graph.An attack graph model is constructed,which is named RSAG.On the basis of eliminating the loop in the attack graph,the model is transformed into a Bayesian network attack graph model,which is named BNAG,and the node accessibility probability is calculated by introducing the node attack difficulty and node state transition measurement index.The analysis results of an example show that the evaluation results of network vulnerability by this algorithm are true and effective,which can fully reflect the difference between attacked node.Meanwhile,the calculation of attack graph with mixed structure is less,which can accurately highlight the harm degree of vulnerability in the chaotic relationship.

Key words: attack graph, Bayesian network, state accessdibility, accessibility probability, vulnerability

摘要： 为准确评估计算机网络的脆弱性，结合贝叶斯网络与攻击图提出一种新的评估算法。构建攻击图模型RSAG，在消除攻击图中环路的基础上，将模型转换成贝叶斯网络攻击图模型BNAG，引入节点攻击难度和节点状态变迁度量指标计算节点可达概率。实例分析结果表明，该算法对网络脆弱性的评估结果真实有效，能够体现每个节点被攻击的差异性，并且对于混合结构攻击图的计算量较少，可准确凸显混乱关系下漏洞的危害程度。

关键词: 攻击图, 贝叶斯网络, 状态变迁, 可达概率, 脆弱性

CLC Number: 

• TP309