CAJ | 학술논문

目前国家信息化水平正在逐步提升，但信息化发展过程中也凸显出日益严重的信息安全问题。信息系统中的软件漏洞层出不穷，攻击者通过攻击多个低级别的软件漏洞来触发高级别的软件漏洞，使用多步攻击方法提升自己的权限，达到损害或控制信息系统的目的。文中以软件漏洞之间的位置关系为基础，深入分析了不同情况下软件漏洞之间的关联关系并提出相应的量化方法，为正确评估软件漏洞对整个系统的危害提供了有效的依据。
목전국가신식화수평정재축보제승，단신식화발전과정중야철현출일익엄중적신식안전문제。신식계통중적연건루동층출불궁，공격자통과공격다개저급별적연건루동래촉발고급별적연건루동，사용다보공격방법제승자기적권한，체도손해혹공제신식계통적목적。문중이연건루동지간적위치관계위기출，심입분석료불동정황하연건루동지간적관련관계병제출상응적양화방법，위정학평고연건루동대정개계통적위해제공료유효적의거。
Nowadays,state informationization level is gradually improving,and however,increasingly severe information security prob-lem is prominent during the informationization development process. Software vulnerabilities in the information system are emerging in endlessly,by attacking multiple low-level vulnerabilities to trigger the high-level ones,the attackers can improve their own authority thus to achieve the aim of damaging or controlling the imformation system using this multi-step attack method. On the basic of software vulnerability location,this paper deep analyzes the corelation of vulnerability and proposes corresponding quantitative methods, thus provides an effective reference for correctively assessing the software vulnerability of the entire system.