Abstract: The analysis of network attack path from the perspective of attackers is of great significance to guide network security defense.The existing analysis methods based on absorbing Markov chain have some problems,such as incomplete consideration of state transition and unreasonable calculation of state transition probability.In order to solve these problems,this paper proposes an attack path analysis method based on absorbing Markov chain.Based on the generation of attack graph and the exploitability score of vulnerability,the situation that the failure state transition of non-absorbing nodes will be fully considered.In order to map the attack graph to the absorbing Markov chain model,this paper proposes a new method to calculate the state transition probability.Then,by using the properties of the state transition probability matrix of the absorbing Markov chain,it calculates the threat ranking of the nodes in the attack path and the expected length of the attack path.Then,the application feasibility of absorbing Markov chain with multi absorbing states is discussed.The results of the experiment show that the proposed method can effectively calculate the node threat ranking and path length expectation.Through comparative analysis,this method is more in line with the actual situation of network attack and defense than the existing methods.

Key words: Absorbing Markov chain, Attack graph, Attack path analysis, Network security, Node threat ranking, Path length expectation