针对当前攻击图模型中很少考虑攻击事件对所有属性节点置信度的动态影响,提出一种基于贝叶斯攻击图的动态风险评估(dynamic risk assessment based on Bayesian attack graphs,DRABAG)模型。该模型运用贝叶斯信念网络建立用于描述攻击行为中多步原子攻击间因果关系的概率攻击图,其中,采用通用漏洞评分系统指标计算漏洞利用成功概率,并利用局部条件概率分布表评估属性节点的静态安全风险;进而结合入侵检测系统观测到的实时攻击事件,运用贝叶斯推理方法对单步攻击行为的后验概率进行动态更新,最终实现对目标网络整体安全性的评估。实验结果表明,该模型可评估动态安全风险和推断攻击路径,为实施安全防护策略提供依据。
This paper focuses on the intrusion classification of huge amounts of data in a network intrusion detection system. An intrusion detection model based on deep belief nets （DBN） is proposed to conduct intrusion detection,and the principles regarding DBN are discussed.The DBN is composed of a multiple unsupervised restricted Boltzmann machine （RBM） and a supervised back propagation （BP）network.First,the DBN in the proposed model is pre-trained in a fast and greedy way,and each RBM is trained by the contrastive divergence algorithm.Secondly,the whole network is fine-tuned by the supervised BP algorithm,which is employed for classifying the low-dimensional features of the intrusion data generated by the last RBM layer simultaneously.The experimental results on the KDD CUP 1999 dataset demonstrate that the DBN using the RBM network with three or more layers outperforms the self-organizing maps （SOM）and neural network （NN）in intrusion classification.Therefore,the DBN is an efficient approach for intrusion detection in high-dimensional space.
