FSM-Based Cyber Security Status Analysis Method.
Yulu Qi,Jincheng Zhong,Rong Jiang,Yan Jia,Aiping Li,Li Huang,Weihong Han
DOI: https://doi.org/10.1109/dsc.2019.00083
2019-01-01
Abstract:Cyber-attacks occur frequently within the Internet, and the forms of occurrence are ever-changing. In simple terms, attacks are divided into single-step attacks and APT attacks. For the two types of attack, this paper is based on the corresponding attack analysis model: diamond model and kill-chain model, respectively analyze single-step attacks and APT attacks. First, the commonality of each type of attack is obtained by analyzing the above models, and then, according to the commonality, list the characteristics of each stage of the known attack on the network. Therefore, the cyber-security status knowledge base is obtained. This knowledge base is part of the cyber-security knowledge graph. Thence, the first and most important thing that must be done is to build cyber-security knowledge graph. By emulating the attacks and collecting data on the simulation platform, the collected data is subjected to pre-processing such as fusion and de-redundancy, the security status features of different hosts at each moment are obtained. Match these network security status features with the cyber-security knowledge graph, correlate the security status of different hosts, and obtain the security status of the entire network. At the same time, utilize the trigger mechanism of the finite-state machine, and the fault tolerance mechanism is added in the matching process to ensure the accuracy of the analysis results and reduce false positives and false positives.