Abstract
Abstract-According to the unknown of attack behavior in cyberspace, this paper presents an attack modeling method based on system states aggregation. In the model, the basic principle of the finite automaton is researched and attack entities of cyberspace are classified by attack process, it combines finite automaton with the changes of system state caused by attack entity, building the attack model of finite automaton, making an analysis of the model algorithm, and making a quantitative evaluation on attack cost, the success rate, exposure rate and evaluating severity of attack on cyberspace. Finally, through the analysis of typical attack behavior by using network attack modeling, it shows that the model proposed is feasible and effective.
INTRODUCTION
Cyberspace, constituted by the Internet, telecommunication networks and other forms of network and physical infrastructure, includes a variety of network forms, throughout the various fields including the land, sea and air and the sky, with increasingly close relationship with human society. With the popularization of network technology in military applications, the new form of warfare has been formed in the network system, namely cyber warfare. The cyber warfare, in order to scramble the right of cyberspace, comprehensively utilizes a variety of cyber-attack and defense to contest. Among them, it is particularly important to have a research on cyberspace attack technology. If there is no further research on it, we will not be able to protect the security of our own networks, to find the vulnerability of the rival network. Through the establishment of the applicable attack model, we can have a formalized and structured description and analysis on cyberspace attack technology, so that we can further improve the efficiency of cyberspace attack detection and security early warning, to provide technical support for security and defense of the cyberspace.
INTRODUCTION
In the process of researching attack model from cyberspace, [1] describes in detail Attack Tree Model, Attack Net Model and attack model based on system states aggregation and other common attack modeling methods. The concept of the attack model based on system states aggregation [2] was first proposed by Koral ILgun and others, who published papers in 1995. The method is mainly a description of the attack to attack detection and security warning. It can distinguish between attack behavior and the impact for the system states. [3] proposes an attack model about system states aggregation; [4] determines the introduction of finite automaton into large-scale intrusion detection; [5] , based on the behavioral characteristics of the IP Spoofing attack, puts forward the state analysis. These modeling methods are established on the basis of bulk analysis and research on attack behavior, while the most of attack weapons from cyberspace are controlled by the governments, remaining in the stage of the laboratory simulation, and being not tested in a real network. Therefore, a lot of attack behaviors in cyberspace are unpredictable [6] .
INTRODUCTION
Through the above analysis, this paper proposes the Attack Modeling-Finite Automata (AM-FA), taking the attack behavior as the associated process, classifying the attack entity, then studying the state transfer under the attack behavior, proposing model algorithm and evaluation methods, and finally being able to achieve attack detection and safety warning.
II. RELATED KNOWLEDGE

A. Finite Automaton Theory
Finite automaton [7] , as a model described through the language, is the regular languages recognizer, which can be a good formal analysis. Finite automaton is a five-tuple: 
B. Classification of Attack Entities
Because of the unpredictability of attack behavior from cyberspace, we cannot directly make a formal description of attack behavior, and therefore we only give a description of it from the perspective of the attack process. For making an accurate expression of attack process, it defines as follows:
Definition1
The definition of attack entities: An objective or abstract thing attacks on the network system software and data with network vulnerabilities and security flaw.
Definition2
The definition of system state: A series of follow-up action sequences, given attack entity decided for the target system attributes and conditions of this attribute which is used to describe certain characteristics of the target system. By the definitions, the process of the attack is formed by triggering from the corresponding attack entities, which can cause the change of system state, each of which is caused by a class of corresponding attack entities, which contains a variety of attack behaviors. Reference [6] on the division of the attack entities, which are divided into: reconnaissance entities, scanning entities, access and escalation entities, exfiltration entities, assault entities, sustainment entities, and obfuscation entities, the first six parts can be combined as an attack process. Obfuscation entities also called supportive entities, has an important role on supporting the attack process. There into:
Definition2
 Reconnaissance entities: also called Intelligencegathering, the first step of network attack, by which to realize the basic outline of the target system.  Scanning entities: Mainly used for collecting more detailed information for the target environment and systems, such as the port number of the target host, IP address and other information.  Access and escalation entities: Through cracking passwords and modifying permissions, to obtain the target system and further improve the access permissions.  Exfiltration entities: By means of encryption or using the communication protocol of the target system to steal data in the target system for interest.  Assault entities: To attack on the target system, and destroy its confidentiality, integrity and availability.  Sustainment entities: To ensure that the next attack can smoothly access the target system, sustainment entities added access permission and a back door.  Obfuscation entities: To attack process with the hidden, confused, traps and others, so that the target system administrator could not track, identify attack source and attack purpose. It may exist in the each stage of the process, or before the attack, or after the attack, so it supports the whole attack process.
Definition2
During the actual attack process, with being not completely in accordance with the established order of the first six attack entities, there may be jumping and iteration.
Definition2
Comprehensive analysis on the finite automaton theory and the relationship between the attack entities and system states: the target system can be divided into different states, which are limited. System states can transfer under the action of the attack entities, and the transferred entities are limited, with the system showing the state behaviors. It can bring cyberspace attack behavior into state transfer behavior of finite automaton.
III. ATTACK MODEL BASED ON FINITE AUTOMATON ITS ALGORITHM
Through the above analysis, we put forward an attack model based on finite automaton. This section first presents the definition the system states as symbolic representation, second establishes of attack model, studies its analysis method and algorithm description, and finally evaluates the attack model.
A. Definitions of the System State Symbols
To express succinctly, we will take the obfuscation entities and the six attack entities as h and a n , n=1,2, ... ,6; the effects of the six attack entities to the target system and the state before the attack, after the attack as S m , m=0,1,2, ... ,6,7, such as S 2 expressing the state of the target system after the scanning entities (a 2 ) attacking, specific conditions as shown in Visibly, when the system is in a certain state, an entity attack will cause the system state to change. Therefore, the research on attack process can be converted to the study on the system state transfer. Based on the graphical rules of the finite automaton, attack process built through finite automation can be expressed with transition diagram. With the arrow S pointing out the start state of FA, with the vertex of acceptable state set S 7 marked with a double circle; ( , ) q a p   in the diagram represents a arc marked as a from the vertex q to vertex p. The state transition diagram with the attack process ( as the support for the action hidden entities to attack-hidden) as shown in Figure 1 :
A. Definitions of the System State Symbols
Attack process state transition diagram
Definition3
An attack entity makes the system transfer from one state to another state (including its own state), which is named single-step attack.
Definition4
Multiple single-step attacks forming an attack sequences is called Multi-Step attack.
Definition4
The preconditions when single-step attack occurs: the effective use of the system vulnerabilities and defects that means static configuration; the information and resources that the attack entities obtain from the last step, whether they meet the needs of the attack; the current system state, if the current system state does not meet what the attack behavior requires, the attack behavior cannot occur. When single-step attack successfully attack on the target system, the target system state will transfer for the next state; if not success , it still return to itself state, as shown below:
Definition4
Single-step attack diagram
B. Construction of the Attack Model
By the above analysis, the attack process of cyberspace can meet the basic principles of the finite automaton. Therefore, we build our attack model through the finite automaton. Q is a state collection, one of its elements on behalf of a state node. As shown in TABLE Ⅰ, before the attack, the end of the attack, the attacked system states are set to the nodes,  means, during the attack process, the importance of a single-step attack and the extent of the damage on the target system.  is the integer between 0-10. Such as scanning attack can be set to 1, denial of service attack can be set to 6 or higher. It needs correct and reasonable assessment method to build correct weights. For simplicity, the specific values could be given directly by the experts through scoring.
B. Construction of the Attack Model
S 0 is the node before the attack. . Definition6, which can extend the transfer function to meet the attack demand, increase the success rate of attack, the attack cost and the description of hidden support so that the attack behavior can get quantitative evaluation.
Definition7
An acceptable set of solving finite automaton
Definition7
, a collection consisted of the attack sequences on the target system is called the attack sequence set of the system states.
C. Algorithm Description of Attack Model
Attack entities with the attack process are interrelated and need to make the following expansion: each single-step attack added a timestamp Domain Time, in order to facilitate algorithm description; if this step attack jump, Time is 0, or else Time is 1, each time the single-step attack makes iteration, Time value would be added 1. . Because G is Right-Linear, so the rights of every production-rule only have one symbol. While the finite automaton approach to describing the set of the system states is same with the regular languages carry up the production-rule. For example, there is an attack event with three attack entities (a 1 , a 5 , a 6 ), a 5 gets the attack target in the second one while others get the target only once. The expression is {( ,1),( ,0), ( 1) , and the derivation process as follow:
D. Evaluation Method of Attack Model
The attack process is random, a probability event, vulnerable to the impact of various factors, difficult to accurately measure, can only approximate expression. The paper makes a quantitative evaluation on attack model from the attack cost, the success rate, exposure rate and the degree of attack hazards.
1) Attack cost
From the definition6, we can see bi is attack cost of attack entity a i , and attack entity a i launched the attacks with Time [i] , clearly the attack cost of each step is added, which is called the overall cost of the attack. Time i  , the attack entities take place attack behaviors, the success rates of all attack entities are multiplied, which is called the success rate of the process. 
3) Exposure rate
The support of the obfuscate entities on the attack is nonexposed probability. If attack entities do not exist, then 1   , and during the entire attack procedure non-exposure rate:
3) Exposure rate
4) The degree of attack hazard Definition6 shows that  as the output alphabet set of the finite automaton. It means that the importance of attack and the extent of the damage on the target system. From the view of the defense, the most seriously harmful place is the place which is the most need to defense, namely:
IV. APPLICATION EXAMPLES AND ANALYSIS
Attack target host as the Windows operating system, and get access permissions of its file. Take the above for example, an attack process can be divided into: target reconnaissance (a 1 ) → scanning target host port (a 2 ) → getting host login account and password (a 3 ) → backdoor (a 6 ). Constructing a state transition diagram shown in Figure 3 , where S 0 is the initial state, the attacker conducts reconnaissance on the target host, to collect basic information, such as network topology, and to make it transfer into S 1 ; the target host port scanning into state S 2 ; getting host login information into the S 3 ; backdoor into S 6 .
If 6 7

S S
 , the attack process will end, there will be into an acceptable state. This can get attack sequences (a 1 , a 2 , a 3 , a 6 ) and a description of the set of states (S 0 , S 1 , S 2 , S 3 , S 6 , S 7 ), combined with system states attack sequence sets, it will constitutes one finite automaton which have file access permissions to the Windows. States transition diagram with access authority
S S
If a 2 launched twice attacks, the result will be: Seen from the table, attack entity a 3 bring the most serious harm to the system, which should be a focus on defense. In practical application, according to the network environment and security needs to strengthen the defense of the attack entity a 3 , so that network security will be greatly enhanced.
V. CONCLUSIONS
On the base of research on cyberspace environment, finite automaton theory and the attack model, this paper proposes the attack model based on finite automaton. The analysis of the model can meet the needs of cyberspace attack modeling and be effective on cyberspace attack detection and safety warning. Moreover, make an extension on this model to study offensive and defensive game model of the attack gains and defense costs.

{'paper_id': '55278609', 'title': 'Research of Attack Model Based on Finite Automaton', 's2_url': 'https://api.semanticscholar.org/CorpusID:55278609', 'source': 'S2ORC'}