Abstract: As the generation of attack graph without loops leads to missing of attack paths, this paper puts forward the concept of complete attack graph and builds its automatic generation method. It obtains the network connectivity automatically by analyzing the firewall configuration files, to get rid of tedious manual input. Then the attack patterns are enriched to cover almost all network attack types and based on them, an efficient approach to complete attack graph generation is built. In the end, a model to generate complete attack graph automatically using the algorithm is built. Experimental result shows that this method has less time consumption, high degree of automation, and it can be applied to large networks.

Key words: network security, vulnerability, attack graph, network connectivity, firewall, attack pattern

摘要： 无圈攻击图结构简单，但在构建过程中会导致部分路径缺失。为此，给出完备攻击图的概念，提出基于攻击模式的完备攻击图自动生成方法。通过分析网络防火墙的配置文件，自动获取网络连通性。完善攻击模式知识库以优化攻击者能力建模，并在此基础上设计广度优先前向搜索的攻击图生成算法，实现自动生成完备攻击图的原型。实验结果表明，该方法的自动化程度高、时间消耗少，可应用于大型网络。

关键词: 网络安全, 脆弱性, 攻击图, 网络连通性, 防火墙, 攻击模式

CLC Number: 

• TP309.2