Method and device for constructing network security domain knowledge map for dynamic threat analysis

Abstract

The invention belongs to the technical field of network security, and in particular relates to a method and device for constructing a knowledge graph in the network security field for dynamic threat analysis. Dynamic threat analysis knowledge map model; combined with general vulnerability evaluation criteria and Bayesian calculation of threat transition probability; using association rules between threats, vulnerabilities, and services to generate network threat knowledge maps, and resolve loops. Based on the mutual influence relationship between network attacks, system vulnerabilities and business applications, combined with the general vulnerability scoring standard and Bayesian formula to analyze the transfer probability of network threats, the invention corrects the construction of knowledge graphs and eliminates the threat transmission loop between multiple nodes. It can completely display the whole picture of the attack, improve the efficiency of network forensics, and provide a basis for threat clue discovery and traceability and evidence collection.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a method and device for constructing a knowledge graph in the network security field for dynamic threat analysis. Background technique [0002] The inherent vulnerability of the network information system makes it inevitable to face the impact of external threats. To carry out effective analysis of external dynamic and changing threats, how to quantitatively analyze the threat transfer probability according to the time, importance, environment and other factors of network node vulnerabilities , which plays an important supporting role in the implementation of targeted defense decisions. [0003] At present, there are mainly the following methods for network dynamic threat analysis: (1) The network security analysis method based on the growth of the attacker's ability, by deducing the threat path and combining the threat transition probability to quantify netw...

AI Technical Summary

Problems solved by technology

[0003] At present, there are mainly the following methods for network dynamic threat analysis: (1) The network security analysis method based on the growth of the attacker's ability, by deducing the threat path and combining the threat transition probability to quantify network security, however, the existing attribute attack graph only describes The threat changes caused by system vulnerabilities are not described, and the threat transfer caused by the access relationship between network business applications is not described, which leads to deviations in the quantification of threat transfer probability; (2) the state attack graph method, which represents the vertex as the host, and Edges represent transitions between states. Due to the state space explosion problem in the state attack graph, it is difficult to apply to the threat risk analysis in a large-scale network environment; (3) the attribute attack graph method, which takes the security elements in the network as Independent attribute vertices. The same vulnerability on the same host only corresponds to one attribute vertex in the graph. Directed edges represent the relationship between nodes. Relative state attack graphs can overcome the problem of state space explosion. However, currently generated attack graphs generally have threats Delivery loop issues, affecting the accuracy of threat paths and probability metrics

Knowledge Graph has received widespread attention due to its superior visualization effects. In the field of natural language processing, the construction technology and application of knowledge graphs are very mature, but in the field of network security, there is no high-quality large-scale open knowledge graph.

How to use the knowledge map to analyze threat dynamics has not yet emerged a mature application method. Combined with the real network environment to generate a threat pattern library, describe the threat transfer caused by the access relationship between network business applications, and accurately measure the threat transfer probability between nodes, it has become Technical problems to be solved urgently in the construction of network threat knowledge graph

Images