提出一種動(dòng)態(tài)漏洞鏈構(gòu)造推理網(wǎng)絡(luò)攻擊過程的分析方法。以漏洞間推理關(guān)系為前提，從受害主機(jī)入手，構(gòu)造有色加權(quán)有向圖，在多日志中查找漏洞被利用的解釋信息，并由查找結(jié)果對(duì)漏洞鏈動(dòng)態(tài)剪枝，得到主機(jī)漏洞攻擊鏈和攻擊該受害主機(jī)的嫌疑主機(jī)，對(duì)嫌疑主機(jī)迭代分析，推理出網(wǎng)絡(luò)漏洞攻擊鏈。實(shí)例表明該方法能夠快速有效地實(shí)現(xiàn)網(wǎng)絡(luò)攻擊過程分析，并且具有良好的可擴(kuò)展性。
關(guān) 鍵 詞 網(wǎng)絡(luò)取證; 攻擊分析; 漏洞鏈; 安全

Abstract Based on response after the attack incidents, a method of network attack process analysis by dynamic vulnerability linking was designed. The corresponding color weighted diagraph was setup in dependence on the inference relation of the security holes in the intruded machine. With the vulnerability-log relation matrix, we searched different forensic information source and got the corresponding support value which could help to prune the false relation between the nodes and get the remote suspicious host. Then analyzing the suspicious host in the same way. At last, we could get the whole attack process. The illustration indicates that this method can rapidly and effectively get the network attack process，and has the nice scalability.
Key words network forensic; attack analysis; vulnerability; security