CAJ | 학술논문

传统的安全漏洞评估方法只是孤立地对单个漏洞进行评估,评估结果不能反映出漏洞对整个网络的影响程度.针对这个问题,提出了一种新的漏洞风险评估方法.该方法根据攻击图中漏洞间的依赖关系与漏洞的CVSS评分,首先计算出漏洞被利用的可能性与被利用后对整个网络的危害程度,并在此基础上计算出漏洞具有的风险值.由该方法计算出的漏洞风险能够准确地反映出漏洞对整个网络的影响程度,并通过实验证明了该方法的准确性与有效性.
전통적안전루동평고방법지시고입지대단개루동진행평고,평고결과불능반영출루동대정개망락적영향정도.침대저개문제,제출료일충신적루동풍험평고방법.해방법근거공격도중루동간적의뢰관계여루동적CVSS평분,수선계산출루동피이용적가능성여피이용후대정개망락적위해정도,병재차기출상계산출루동구유적풍험치.유해방법계산출적루동풍험능구준학지반영출루동대정개망락적영향정도,병통과실험증명료해방법적준학성여유효성.
The conventional methods for vulnerability risk evaluation just concentrate on individual vulnerability,which can't reveal impact on the whole network. For this problem, this paper put forward a new method for vulnerability risk evaluation. Based on casual relationship between vulnerabilities in attack graph and CVSS score of vulnerabilities, this method first computed the probabilities of exploits and the impact on the whole network after exploits, and then computed vulnerability risk. The vulnerability risk can exactly reveal its impact on the whole network. Experiment validates its veracity and validity.