The invention belongs to the technical field of network security, and discloses an attack path analysis method based on a hierarchical attack graph. Firstly, dividing an original network into a plurality of logic subnets through a community discovery algorithm, wherein the logic subnets and connection relations thereof form a network logic structure; generating two layers of attack graphs based onthe network logic structure and the network basic information; and finally, reducing an attack path on the two layers of attack graphs by utilizing monotonicity of attack behaviors. The method comprises the following specific steps: (1) realizing community discovery; (2) establishing a hierarchical attack graph model; (3) generating an attack path; (4) analyzing the attack path to provide a defense strategy. According to the attack path analysis method, unreasonable attack path generation is avoided from the perspective of attackers, the real-time performance of attack path analysis is effectively improved, and the problem that an existing attack path analysis method is poor in real-time performance when the network scale is large and the vulnerability is high is solved.

Attack path analysis method based on hierarchical attack graph

The invention discloses a flow attack defense system based on an SDN cloud security service tree model. The system comprises a cloud security resource management module, a cloud security resource scheduling module, a security service tree policy customization module, a security service chain path customization module and a global security data monitoring module. By utilizing the flexibility of separation of a data plane and a control plane of an SDN, and easy extensibility provided by a virtual cloud environment, a cloud security service tree framework model is built. Flow to be detected is guided into an entry of a cloud security service tree; deep packet analysis of coarse granularity is carried out at the entry; if the flow is normal flow, the flow is rapidly forwarded to a destinationreceiver; and if the flow is abnormal flow, the flow is introduced into security service chains of subsequent tree branches to carry out fine granularity detection and processing. By utilizing massivecloud security resources and flexible resource scheduling, various granularities of network flow attacks of unknown types are detected and an attack elimination strategy capable of being flexibly customized is provided.

Flow attack defense system based on SDN cloud security function service tree model

Embodiments of the invention provide an attack chain detection method and device. The method comprises steps of: constructing an attack event diagraph according to an attack stage to which each attackevent belongs and a host node transferring each attack event, and calculating betweenness centrality of each host node according to the attack event diagraph; for any adjacent attack event sequence,calculating membership grade of the adjacent attack event sequence according to the betweenness centrality of each host node; acquiring each attack path in the attack event diagraph, if each attack path comprises a core host node, reversely searching a host node initiating the attack event with the core host node as a start point based on a D-S evidence theory according to the membership grade ofthe adjacent attack event sequence of each host node, and using the searched host node and the core node as an attack chain. The method can detect a more accurate attack chain, and can accurately detect an APT event.

Attack chain detection method and device

The invention discloses a method, a device and a system for tracking a long-chain attack by a network. The method comprises the following steps of firstly, enabling each network node to check a data segment by itself; collecting data segment copies on each network node; combining the data with historical big data; analyzing whether the data fragments are abnormal or not and whether logic association exists among the abnormal data fragments or not, so that abnormal points and path points are determined and marked, a potential attack track is obtained, the purpose of tracking the attack fragments in a large number of network nodes is achieved, an analysis model is assisted to be continuously trained, and tracking accuracy is improved.

Method, device and system for tracking long-chain attack through network

The embodiment of the invention provides an intrusion response measure determination method and device, and the method comprises the steps: determining one or more attack paths according to each nodein an attack tree and a node relationship; determining the security utility of candidate response measures which can be used for blocking the attack path; based on multiple iterations of a greedy algorithm, selecting candidate response measures with the maximum security effectiveness for each attack path to form a measure set so as to realize intrusion prevention; wherein in each iteration process, the candidate response measure with the maximum safety effect is selected from the candidate response measures of the attack path to be blocked, the response measure selected this time serves as a deployed measure, and the safety effects of the candidate response measures of the remaining attack path to be blocked are recalculated and used for next iteration selection. According to the method, the overall security effectiveness when a plurality of attack paths are coped can be improved to the maximum extent, and the optimal coping for multi-path attacks is realized.

Intrusion response measure determination method and device

The invention belongs to the technical field of network security, and particularly relates to a network attack target identification method and a network attack target identification system based on an attack graph, wherein the method comprises the following steps: modeling for a state migration process of an attacker in a network, acquiring a network attack graph model and all possible attack paths, and generating a network attack graph; mapping the network attack graph to a Markov chain, and constructing a state transition probability matrix which absorbs the Markov chain; and in combinationwith the state transition probability matrix, acquiring an expectancy for success probability matrix of attack intention of the attacker; through the expectancy for success probability matrix, finding out a state node corresponding to the maximum probability value, and completing attack target identification With the method and the system provided by the invention, an average probability value of realizing different intentions of the attacker can be evaluated more objectively and accurately, a problem that the conventional method is limited by ideal cumulative probability when evaluating probability of occurrence of attacks is solved, computation complexity is low, operations are simple and convention to execute, and more reliable guidance is provided for assisting a security administrator to make a decision and improving network security performance

Network attack target identification method and network attack target identification system based on attack graph

The invention relates to a network safety service architecture based on a safety service chain, and a realization method thereof. The architecture comprises a safety service management platform for receiving a user safety request, extracting safety service chain information and transmitting the same to a safety function compiling engine and a traffic traction engine; the safety function compilingengine for selecting a service node for bearing instances according to the safety service chain information, forming a safety function instance deployment view, and delivering the safety function instance deployment view to the traffic traction engine; the traffic traction engine for acquiring a routing path between the safety function instances according to the safety service chain information and the safety function instance deployment view, and guiding the creation of the safety service chain according to the routing path information. By flexibly combining the instances, precisely segmenting the traffic and selecting the optimal service node of the bearing instances and establishing the multi-path routing between the service nodes, the customizable safety service is provided by sufficiently utilizing the network safety resource, and the delay of the safety service is reduced.

Network safety service architecture based on safety service chain and realization method thereof

The invention belongs to the technical field of networks, and especially relates to a method and a system for cross-domain service chain mapping in an SDN/NFV (Software Defined Network/Network Function Virtualization) environment. The method comprises the steps of: initializing bottom layer physical network resource information; receiving a service chain building request, and judging, by a globalservice agent, whether cross-domain mapping is required according to a bottom layer physical resource state collected from each regional service agent; if the service chain building request requires the cross-domain mapping, dividing the service chain building request according to a minimum mapping overhead service chain division scheme, and mapping a service chain into a bottom layer physical network; and otherwise, directly mapping the service chain into the bottom layer physical network. Through adoption of the method of the invention, according to the service chain building request, a virtual network function instance deployment position is determined on the condition of meeting resource constraint, and a flow route path is planed, then service chain division solving is performed through a bat algorithm, and the minimum mapping overhead service chain division scheme is output, thereby reducing algorithm computing complexity and resource consumption, and efficiently achieving mapping of a cross-domain service chain building request.

Method and system for cross-domain service chain mapping in SDN/NFV environment

Popular Tasks used by Researchers

How can I help with your research?

Get more enhanced response by uploading the PDFs you want me to reference.

No relevant PDFs in your library

SciSpace is the AI research assistant for academics. Run systematic literature reviews on 280M+ papers, and write papers with cited sources. Trusted by 1M+ students, PhDs & researchers.

SciSpace | AI for Research

We encountered an error while loading the panel. Please try refreshing the page.

Something went wrong

Analyze PDFs

Code & Manuscripts

Funding & Grants

Literature & Patents

Medical & Clinical Data

Systematic Review

Visualize & Present

Web & Data

Build a Google Scholar-like website for your research.

Build a website

Create charts and images for your research

Create a Chart

Write a paper for submission to a journal

Draft a manuscript

Patent Search

Design eye-catching scientific posters in minutes.

Scientific Poster Generation

Systematic Literature Review

Anyone with the link can view this chat. You can switch it back to private anytime.

One task is running at the moment. Your messages will be shown right after.

Drag and drop or click here to browse

Loved by <highlight>1 million+</highlight> researchers

Extract a list of specific topics and their sources from unstructured text

Topics

Compare and analyze relevant papers that matches with your search

Papers

Get insights from PDFs and bookmarked papers from your library

My library

Recent searches

Try searching for:

Catch AI-generated content in scholarly and non-scholarly content

{ai} Detector

Ai Writer

Get PDF Summaries, highlighted text explanations 

Chat with PDF

Effortlessly create in-text citations and bibliographies in APA and 2,500 other formats

Citation generator

Get explanations, summaries, and answers on academic papers

Ease up your research workflow with {scispace}'s cohort of exciting AI tools

Elevate your academic writing skills and convey your ideas the way you want

Paraphraser

Explore our range of reading and writing tools

Your file is being prepared and should be ready in a few minutes. If it's a large file, it might take a bit longer. You can close this window, and we'll email you the file when it's done.

You have reached a maximum limit of <strong>{limit}</strong> columns in the table. Remove at least <strong>1</strong> column to add or create another one.

Wang Yigong

Author Tools

Chat about Author

Papers

Network attack target identification method and network attack target identification system based on attack graph

Network safety service architecture based on safety service chain and realization method thereof

Method and system for cross-domain service chain mapping in SDN/NFV environment