Abstract: Complex multi-step cyber-attack is a typical network attack method with strong purpose,and state attack-defense graph is an effective method for modeling and analyzing this problem.But it still has some limitation in practice,for example,the computation of the success probability of atomic attack and the definition of attack severity index are not so reasonable.When the operator is not experienced enough,it is very likely that the result can hardly reflect the realsecurity situation of the network.By analyzing the shortages of existing security defense strategy generation method,the attack severity index of atomic attack and attack path were redefined by improving the vulnerability scoring standard and introducing the concepts like accumulated attack success probability and value of information asset.In this way,the considerations for security defense strategy generation is enlarged and the generation method is optimized,to realize the attack scene modeling and the attack intention mining.At last,a case study is made to prove the feasibility and the objectivity of the improved method,which can provide the network managers with effective assistant.

Key words: Attack-defense graph,CVSS,Network security,Defense strategy