Abstract: Attack graph is a common tool for qualitative analysis of network security, which provides important basis for network security administrators to prevent malicious?intrusions. To evaluate the security of network and perform active defense, the paper presents a defense graph model and an improved binary particle swarm optimization algorithm. It builds defense measure set with weights based on each intrusion action in the attack graph, intends to highlight the defense costs. In order to minimize the cost to prevent malicious attacks, it introduces and improves binary particle swarm optimization algorithm BPSO, and obtains the minimum critical measure set of the attack graph. Simulation results show that it can effectively obtain the optimization solution of the minimum critical measure set, and through the comparison with traditional greedy algorithm experiments, it proves that it is a more efficient optimization algorithm.

Key words: minimum critical measure set, Binary Particle Swarm Optimization（BPSO）, attack graph, defence cost

摘要： 攻击图是网络安全定性分析的常用工具，能为安全管理员阻止恶意入侵提供重要依据。为了进行网络安全测评和主动防御，提出防御策略模型和基于该模型的改进二进制粒子群算法。基于攻击图中的每个入侵动作，构建带权防御策略集，意在突出防御代价。为以最小代价阻止网络恶意入侵，引入并改进了二进制粒子群算法BPSO，获取了攻击图的最小关键策略集。仿真实验证明，能有效获取最小关键策略集的优化解，并通过与蚁群算法及贪心算法进行对比实验，证明其更高效。

关键词: 最小关键策略集, 二进制粒子群算法, 攻击图, 防御代价