Abstract: The existing intrusion intention recognition methods lack the validity consideration of alert evidence, which affects the recognition accuracy. Therefore, the intrusion intention recognition method based on Bayesian attack graph is proposed. Firstly, the model of Bayesian attack graph is constructed, and then the isolated alerts with low confidence are removed by setting the alert confidence and correlation strength. Secondly, the Bayesian posteriori reasoning is performed based on the extracted effective alert evidence. Furthermore, the probability of each state node being attacked is dynamically updated in the attack graph, which aims to identify the previous and potential attack behaviors in the network. Finally, the experimental results show that the proposed method can effectively extract the alert evidence and improve the prediction accuracy of the network intrusion.

Key words: intention recognition, Bayesian attack graph, vulnerability exploitation, alert confidence level, alert correlation strength

摘要： 现有入侵意图识别方法对报警证据的有效性缺乏考虑，影响了入侵意图识别的准确性。为此提出基于贝叶斯攻击图的入侵意图识别方法。首先建立贝叶斯攻击图模型，然后通过定义报警的置信度及报警间的关联强度，去除低置信水平的孤立报警；根据提取到的有效报警证据进行贝叶斯后验推理，动态更新攻击图中各状态节点遭受攻击的概率，识别网络中已发生和潜在的攻击行为。实验结果表明，该方法能有效提取报警证据，提高网络入侵预测的准确性。

关键词: 意图识别, 贝叶斯攻击图, 漏洞利用, 报警置信度, 报警关联强度