Modeling for Security Protection Capability of Information System Based on CPN

doi:10.16182/j.issn1004731x.joss.201810013

Abstract

Abstract: Modeling plays an important role in assessment for security protection capability. Oriented to the features that evaluation has many methods which update quickly, the analysis frame is proposed based on detect, analyse and respond. Aimed at the problems that it is difficult to model the intelligent learning and coordination process for protective device, analysis model is built based on CPN. The colors of message color sets represent the different properties of events. Detect, analysis and respond components which represent different process of security protection capability are defined. Two theorems are proved, and model complexity is analyzed. The usability of model is verified, and excellent versatility, scalability and analyzability are reached by analyzing the application process. Results show that the model can provide data and model support for the evaluation on security protection capability.

Key words: security protection capability, analysis frame, CPN, analysis model

CLC Number:

TP391.9A

Chen Qiangjun, Zhang Mingqing, Kong Hongshan, Liu Xiaohu, Shao Lianjie. Modeling for Security Protection Capability of Information System Based on CPN[J]. Journal of System Simulation, 2018, 30(10): 3699-3710.

References

[1] 360互联网安全中心. 2015年中国互联网安全报告[EB/OL]. (2016-02-29)[ 2016-09-06]. http://www.360.cn/ weishi/2015_sr.html.
360 Center for Internet Security: 2015 Chinese Internet Security Report [EB/OL]. (2016-02-29) [2016-09-06] http://www. 360.cn/weishi/2015_sr.html.
[2] Nayot Poolsappasit, Rinku Dewri, Indrajit Ray.Dynamic Security Risk Management Using Bayesian Attack Graphs[J]. IEEE Transactions on Dependable and Secure Computing (S1941-0018), 2012, 9(1): 61-74.
[3] 万雪莲, 张京河. 基于攻、防的信息系统安全综合评估方法的研究[J]. 计算机科学, 2016, 43(S1): 322-327.
Wan Xuelian, Zhang Jinghe.Research on Comprehensive Assessment Method of Information System Security Based on System Attack and Defense[J]. Computer Science, 2016, 43(S1): 322-327.
[4] 戴方芳. 基于攻击图理论的网络安全风险评估技术研究 [D]. 北京: 北京邮电大学, 2015.
Dai Fangfang.Research on Network Security Risk Assessment Technology Based on Attack Graph Theory [D]. Beijing, China: Beijing University of Posts and Telecommunications, 2015.
[5] 高翔, 刘洋, 贺筱媛. 基于GSCPN模型的网络安全加固措施制定方法[J]. 系统仿真学报(S1004-731X), 2016, 28(5): 1009-1016.
Gao Xiang, Liu Yang, He Xiaoyuan.Method for Network Security Reinforcement Based on GSCPN Model[J]. Journal of System Simulation (S1004-731X), 2016, 28(5): 1009-1016.
[6] You Y, Cho I, Lee K.An advanced approach to security measurement system[J]. The Journal of Supercomputing (S0920-8542), 2016, 72(9): 3443-3454.
[7] 吴迪, 冯登国, 连一峰, 等. 一种给定脆弱性环境下的安全措施效用评估模型[J]. 软件学报, 2012, 23(7): 1880-1898.
Wu Di, Feng Dengguo, Lian Yifeng, et al.An efficiency evaluation model of system security measures in the given vulnerabilities set[J]. Journal of Software, 2012, 23(7): 1880-1898.
[8] Roland Rieke.Modelling and Analysing Network Security Policies in a Given Vulnerability Setting[M]// Critical Information Infrastructures Security. Germany: Springer Berlin Heidelberg, 2006: 67-78.
[9] Laborde R, Nasser B, Grasset F.A formal approach for the evaluation of network security mechanisms based on RBAC policies[J]. Electronic Notes in Theoretical Computer Science (S1571-0661), 2005, 121(0): 117-142.
[10] Laborde R, Nasser B, Grasset F, et al.Network security management: A formal evaluation tool based on RBAC policies[M]// Network Control and Engineering for QoS, Security and Mobility, III. USA: Springer US, 2005: 69-80.
[11] 陈小军, 时金桥, 徐菲, 等. 面向内部威胁的最优安全策略算法研究[J].计算机研究与发展, 2014, 51(7): 1565-1577.
Chen Xiaojun, Shi Jinqiao, Xu Fei, et al.Algorithm of Optimal Security Hardening Measures Against Insider Threat[J]. Journal of Computer Research and Development, 2014, 51(7): 1565-1577.
[12] 李志, 单洪, 马春来, 等. 基于攻防图的网络主动防御策略选取研究[J]. 计算机应用研究, 2015, 32(12): 3729-3734.
Li Zhi, Shan Hong, Ma Chunlai.Network active defense strategy selection based on attack-defense graph[J]. Application Research of Computers, 2015, 32(12): 3729-3734.
[13] Feng, Nan, Wang, et al. A security risk analysis model for information systems: Causal relationships of risk factors and vulnerability propagation analysis[J]. Information Sciences (S0020-0255), 2014, 256(1): 57-73.
[14] Ghani H, Luna J, Suri N.Quantitative assessment of software vulnerabilities based on economic-driven security metrics[C]// Risks and Security of Internet and Systems (CRiSIS), 2013 International Conference on. USA: IEEE, 2013: 1-8.
[15] 吕慧颖, 彭武, 王瑞梅, 等. 基于时空关联分析的网络实时威胁识别与评估[J]. 计算机研究与发展, 2014, 51(5): 1039-1049.
Lü Huiying, Peng Wu, Wang Ruimei, et al.A Real-time Network Threat Recognition and Assessment Method Based on Association Analysis of Time and Space[J]. Journal of Computer Research and Development, 2014, 51(5): 1039-1049.
[16] 张恒巍, 张健, 王晋东, 等. 基于连通度算子的系统漏洞风险评估[J]. 计算机工程与设计, 2015, 36(1): 65-70.
Zhang Hengwei, Zhang Jian, Wang Jindong, et al.System vulnerability risk evaluation based on connectivity operator[J]. Computer Engineering and Design, 2015, 36(1): 65-70.
[1] Wang L, Jajodia S, Singhal A, et al.k-zero day safety: A network security metric for measuring the risk of unknown vulnerabilities[J]. IEEE Transactions on Dependable and Secure Computing (S1941-0018), 2014, 11(1): 30-44.
[2] Visumathi J, Shunmuganathan K L.A computational intelligence for evaluation of intrusion detection system[J]. Indian Journal of Science and Technology (S0974-5645), 2011, 4(1): 40-45.
[3] 高翔, 祝跃飞, 刘胜利. 一种基于广义随机颜色Petri网的网络攻击组合模型[J]. 电子与信息学报, 2013, 38(11): 2608-2614.
Gao Xian, Zhu Yuefen, Liu Shengli.Attack Composition Model Based on Generalized Stochastic Colored Petri Nets[J]. Journal of Electronics & Information Technology, 2013, 38(11): 2608-2614.
[4] 陈小军, 方滨兴, 谭庆丰, 等. 基于概率攻击图的内部攻击意图推断算法研究[J]. 计算机学报, 2014, 37(1): 62-72.
Chen Xiaojun, Fang Binxing, Tan Qingfeng, et al.Inferring attack intent of malicious insider based on probabilistic attack graph model[J]. Chinese Journal of Computers, 2014, 37(1): 62-72.
[5] Igor Kotenko, Andrey Chechulin.Computer Attack Modeling and Security Evaluation based on Attack Graphs.[C]// The 7th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing System: Technology and Applications, Berlin, Germany. USA: IEEE, 2013, 9: 614-619.
[6] 张红旗, 王鲁. 信息安全技术 [M]. 北京: 高等教育出版社, 2008.
Zhang Hongqi, Wang Lu.Information Security Technology [M]. Beijing, China: Higher Education Press, 2008.