关键词: 意图识别, 贝叶斯攻击图, 漏洞利用, 报警置信度, 报警关联强度

Abstract: The existing intrusion intention recognition methods lack the validity consideration of alert evidence, which affects the recognition accuracy. Therefore, the intrusion intention recognition method based on Bayesian attack graph is proposed. Firstly, the model of Bayesian attack graph is constructed, and then the isolated alerts with low confidence are removed by setting the alert confidence and correlation strength. Secondly, the Bayesian posteriori reasoning is performed based on the extracted effective alert evidence. Furthermore, the probability of each state node being attacked is dynamically updated in the attack graph, which aims to identify the previous and potential attack behaviors in the network. Finally, the experimental results show that the proposed method can effectively extract the alert evidence and improve the prediction accuracy of the network intrusion.

Key words: intention recognition, Bayesian attack graph, vulnerability exploitation, alert confidence level, alert correlation strength