Depth-first attack drawing generating method

Abstract

The invention provides a depth-first attack graph generation method. The steps are as follows: (1) the entire safety factors of the current network are collected to form an initial network state; (2) a prolog system is used to search the entire network states that an attacker is possible to pass through before a target state is reached; (3) attack routes are constructed according to the searched dependency relations among the network states; (4) the constructed attack routes are combined into a network attack graph. The invention has the advantages that: the depth-first generation algorithm decreases the scale of the attack graph, and can ensure that no non-target leaf node exists in the attack graph.

Description

(1) Technical field [0001] The invention relates to a network security protection method, in particular to an identification technology for network attack sequences. (2) Background technology [0002] At present, in the field of network vulnerability analysis, the existing vulnerability scanners have a good effect on the vulnerability scanning of single or multiple hosts in the target network. However, these tools only check security vulnerabilities from an isolated perspective, lacking correlation analysis between vulnerabilities. In reality, network attacks often need to exploit multiple vulnerabilities and cross the boundaries of multiple hosts. In order to analyze and evaluate network vulnerabilities more objectively, analysis tools are required to automatically establish systematic attack scenarios based on information such as vulnerabilities, network services, physical links, and access rights in the target network. In recent years, many research institutions have pr...

AI Technical Summary

Problems solved by technology

For example, there are 100 hosts in the target network, and there is a privilege escalation vulnerability on each host. If the number of attack steps is not limited when generating the attack graph, in the worst case, the generated attack graph will contain an attack of length 100 path, which is obviously unrealistic

2) Attack path with low probability of success

[0006] It can be seen that the existing attack graph generation method has the problem of network state explosion, resulting in the generated attack graph containing a large number of attack paths with too many attack steps and low success probability

The existence of these attack paths increases the scale of the attack graph, which brings great difficulties to the analysis of the attack graph.

Images