Dynamic honey point deployment method and system based on attack graph and Shapley value

Abstract

The invention provides a dynamic honey point deployment method and system based on an attack graph and a Shapley value. The method comprises the following steps: scanning and exploring a protected network every first preset time; an attack graph corresponding to the current network environment of the protected network is constructed according to the scanning and probing result, the probability that each vulnerability in each edge in the attack graph is utilized is calculated based on CSVV evaluation, and the attack difficulty of each edge is defined; according to the attack difficulty of each edge, the implementation probability of an attack path is calculated and obtained, and the expected loss of each attack path in the attack graph is obtained; and constructing a game model, solving a Shapley value of each edge based on a Monte Carlo method, and carrying out edge sorting on all the edges in the attack graph according to the Shapley value of each edge so as to generate an optimal honey point deployment strategy according to an edge sorting result. According to the invention, the honey point deployment strategy can be dynamically adjusted according to the real-time network security situation in the attack and defense process.

Description

Technical Field

[0001] The present invention relates to the field of network security protection technology, and in particular to a dynamic honey spot deployment method and system based on attack graphs and Shapley values. Background Art

[0002] In a network security system with "self-defense mode" as its core, attackers and defenders engage in an information asymmetry game. Attackers obtain information about the target network through reconnaissance, analyze the information, find corresponding strategies, and infiltrate the target network. In the self-defense mode, defenders appear to be very passive, especially when dealing with advanced persistent threat attacks (APT), it is difficult to detect attackers in advance.

[0003] In the "Guardian Mode" network security system represented by the Four Honey System, the active defense concept is adopted, with "deception, trapping, and detection" as the ideological guidance. The defense focus of the existing network security system is changed from focusing on the security of the protected object itself to discovering and blocking attackers, which improves the perception and deterrence capabilities of highly concealed attack behaviors.

[0004] In the four honey systems, honey spots are an important way to perceive threats. By deploying a large number of honey spots and other traps / tripwires around the protected system, the security threats faced by the system can be actively perceived in an all-round and multi-level manner. The strategy of honey spot deployment is the key to improving threat perception capabilities. If the honey spots are deployed on the normal access path, it is easy for normal users to step in, which will cause network operation and maintenance personnel to misjudge the network situation and affect normal users' access to normal systems. If there are too many or too dense honey spots, not only will it occupy too many resources, but it will also easily cause the log information to be too large and redundant. Operation and maintenance personnel need to spend a lot of energy to identify useful information, which reduces the effectiveness of honey spots; and too many honey spots will also increase the complexity of honey spot management. Too few honey spots or no honey spots are deployed on important paths will lead to low threat perception capabilities, weak system defense capabilities, and inability to detect APT attacks in a timely manner. If the deployment of honey spots is static, attackers will try to bypass the honey spots once they identify them to avoid being discovered. When the target network changes and the honey spots remain unchanged, the honey spots cannot accurately simulate the real system and are easily identified by attackers. Summary of the invention

[0005] The purpose of the present invention is to provide a dynamic honey spot deployment method and system based on attack graphs and Shapley values, aiming to solve the problem that the static deployment of honey spots can be easily identified by attackers, resulting in poor protection effect of the protected network.

[0006] In a first aspect, the present invention provides a dynamic honey spot deployment method based on an attack graph and a Shapley value, the method comprising:

[0007] Scanning and probing the protected network at a first preset time interval to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information;

[0008] Constructing an attack graph corresponding to the current network environment of the protected network according to the scanning and probing results, obtaining the probability of each vulnerability in each edge in the attack graph being exploited based on CSVV evaluation calculation, and defining the difficulty of attacking each edge according to the probability of each vulnerability being exploited;

[0009] The realization probability of the attack path is calculated according to the difficulty of each edge being attacked, and the expected loss of each attack path in the attack graph is obtained based on the realization probability of the attack path;

[0010] A game model is constructed, and each edge in the attack graph is defined as a player in the game model. The Shapley value of each edge is solved based on the Monte Carlo method, and all edges in the attack graph are sorted according to the Shapley value of each edge, so as to generate an optimal honey spot deployment strategy according to the edge sorting result.

[0011] Furthermore, the step of scanning and probing the protected network at first preset intervals to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information, comprises:

[0012] Perform vulnerability scans on the structure of the protected network to obtain open port information, services, operating system type and architecture, asset information, configuration error information, and vulnerability information in the protected network;

[0013] The scanned information is stored in a JSON file, and the JSON file is converted into an input.in file.

[0014] Furthermore, the steps of constructing an attack graph corresponding to the current network environment of the protected network according to the scanning and detection results, obtaining the probability of each vulnerability in each edge in the attack graph being exploited based on CSVV evaluation calculation, and defining the difficulty of attacking each edge according to the probability of each vulnerability being exploited include:

[0015] The probability of each vulnerability being exploited is calculated using the following formula:

[0016] P = 2*AV*AC*AU, 0 <P<1

[0017] Among them, P represents the probability of vulnerability being exploited, AV represents the attack path evaluation index, AC represents the attack complexity evaluation index, and AU represents the authentication evaluation index;

[0018] The probability of each vulnerability in each edge being exploited is ranked by difficulty, and the maximum probability corresponding to the difficulty of each edge is obtained according to the difficulty ranking result, and the maximum probability is used as the difficulty of each edge being attacked.

[0019] Furthermore, the step of calculating the realization probability of the attack path according to the difficulty of each edge being attacked, and obtaining the expected loss of each attack path in the attack graph based on the realization probability of the attack path includes:

[0020] The probability of achieving the attack path is calculated according to the following formula:

[0021]

[0022] in, represents the realization probability of the jth attack path, p i represents the difficulty of attacking the i-th edge in attack path j, and n represents the total number of edges contained in the j-th attack path;

[0023] The expected loss of each attack path is calculated according to the following formula:

[0024]

[0025] in, represents the expected loss of the jth attack path, x represents the total number of hosts on a path, represents the expected loss of the ith host;

[0026] The expected loss of each host is calculated according to the following formula:

[0027]

[0028] in, represents the expected loss of the ith host, V(h i ) represents the value of the i-th host, P(h i ) represents the probability that the i-th host is compromised;

[0029] The probability of each host being compromised is calculated using the following formula:

[0030]

[0031] Among them, P(h i 、 ) represents the probability that the i-th host will not be compromised.

[0032] Furthermore, the steps of obtaining the value of each host include:

[0033] Obtaining asset importance attributes of each host, wherein the asset importance attributes include confidentiality, integrity, and availability;

[0034] Each asset importance attribute is divided into several levels, and an importance value is defined for each level under each asset importance attribute, and the importance value is bound to the level to construct an asset importance attribute value evaluation table;

[0035] Obtain the level identification of the target host in each asset importance attribute, and query the asset importance attribute value evaluation table according to the level identification to obtain the importance assignment of each asset importance attribute in the target host, and calculate the value of the host according to the following formula:

[0036] V(h i )=C i +I i +A i

[0037] Among them, C i represents the importance of the i-th host under confidentiality, I i represents the importance of the ith host under integrity, A i Represents the importance of the i-th host under availability.

[0038] Furthermore, the step of constructing a game model, defining each edge in the attack graph as a player in the game model, and solving the Shapley value of each edge based on the Monte Carlo method includes:

[0039] Set the total number of sampling times. Each time a random function is used to generate a random arrangement of 1 to m to represent the order in which the edges are added. Then, these edges are added to the attack graph in sequence. During the addition process, the marginal contribution of each edge in the sequence is calculated.

[0040] For each participant, its marginal contribution in all samples is accumulated and finally the average is taken as the Shapley value.

[0041] Furthermore, the step of sorting all the edges in the attack graph according to the Shapley value of each edge to generate an optimal honey spot deployment strategy according to the edge sorting result includes:

[0042] Sort the Shapley value of each edge from large to small to get the edge ranking from high to low;

[0043] Deploy honeypot resources in order from highest to lowest edge hazard level.

[0044] In a second aspect, the present invention provides a dynamic honey spot deployment system based on an attack graph and a Shapley value, the system comprising:

[0045] A scanning and probing module, configured to scan and probe the protected network at a first preset time interval to obtain a scanning and probing result, wherein the scanning and probing result includes asset information, configuration error information, and vulnerability information;

[0046] A CSVV evaluation module, configured to construct an attack graph corresponding to the current network environment of the protected network according to the scanning and detection results, obtain the probability of each vulnerability in each edge in the attack graph being exploited based on the CSVV evaluation calculation, and define the difficulty of attacking each edge according to the probability of each vulnerability being exploited;

[0047] An expected loss calculation module, used to calculate the realization probability of the attack path according to the difficulty of each edge being attacked, and obtain the expected loss of each attack path in the attack graph based on the realization probability of the attack path;

[0048] A decision module is used to construct a game model, define each edge in the attack graph as a player in the game model, solve the Shapley value of each edge based on the Monte Carlo method, and sort all the edges in the attack graph according to the Shapley value of each edge, so as to generate an optimal honey spot deployment strategy according to the edge sorting result.

[0049] In a third aspect, the present invention provides a readable storage medium, wherein the readable storage medium stores one or more programs, which, when executed by a processor, implement the above-mentioned dynamic honey spot deployment method based on attack graph and Shapley value.

[0050] In a fourth aspect, the present invention provides a computer device, the computer device comprising a memory and a processor, wherein:

[0051] The memory is used to store computer programs;

[0052] When the processor is used to execute the computer program stored in the memory, the above-mentioned dynamic honey spot deployment method based on the attack graph and the Shapley value is implemented.

[0053] Compared with the prior art, the present invention has the following advantages:

[0054] 1. The present invention uses an attack graph to model the protected network. Starting from the global perspective of the protected network, the difficulty of exploiting the vulnerabilities on the edges in the attack graph, the key assets that can be reached by the edges, and the topological position in the network are comprehensively considered to analyze the global destructiveness of the edges in the attack graph. The protected network is modeled using cooperative games, and honey spot deployment decisions are made based on the degree of damage to the overall system by the edges. Based on the attacker's perspective, the expected benefits of the attacker are quantified in combination with the asset distribution and the host probability attack graph. In the cooperative game, the edges in the attack graph are regarded as players in the game, and they cooperate to achieve the attacker's expected benefits. The Shapley value is used to calculate the contribution of each edge to the expected benefits. This value is the degree of harm of the edge to the system as a whole.

[0055] 2. Since the Shapley value is the only method of calculating profit distribution that has the four properties of symmetry, effectiveness, redundancy, and linearity, this method can unbiasedly calculate the degree of damage of each edge to the overall system by using the Shapley value in the cooperative game to calculate the profit of each edge in the attack graph to the attacker.

[0056] 3. The present invention calculates the degree of damage of each edge to the entire system in an unbiased manner. In a scenario with limited resources, the most harmful edge vulnerabilities can be patched according to the limited resources and honey spots can be deployed on the most harmful edges to maximize the utility of existing resources.

[0057] 4. The present invention can dynamically adjust the host summary attack graph based on the discovered attacker traces, and dynamically adjust the honey spots according to the degree of harm of the edges in the real-time attack graph to the entire system according to the changes in the network situation, thereby realizing adaptive strategy optimization. Specifically, there may be vulnerabilities in the network that are not discovered during active vulnerability scanning, such as zero-day vulnerabilities. When an attacker infiltrates the system through these vulnerabilities, the relative position of the attacker on each edge in the attack graph will also change, and the degree of damage to the system by each edge may also change. Therefore, when the attacker's traces are found in the system, the present invention can determine the host infiltrated by the attacker based on the status of the alarm information, adjust the attacker graph based on this information, recalculate the degree of damage to the system by the edges, optimize the deployment of honey spots, and realize adaptive adjustment of the deployment of honey spots according to the real-time network security situation. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A flow chart of a dynamic honey spot deployment method based on attack graph and Shapley value proposed in one embodiment of the present invention;

[0059] Figure 2 is a detailed diagram of step S104 in one embodiment of the present invention;

[0060] Figure 3It is a structural schematic diagram of a dynamic honey spot deployment system based on attack graph and Shapley value proposed in one embodiment of the present invention.

[0061] The following specific embodiments will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0063] About the technical term "deception defense" refers to an active defense strategy that lures attackers into a false environment or induces attackers to take specific actions in order to detect and respond to potential network threats in a timely manner. Compared with traditional defense methods, it is not just passive monitoring and blocking attacks, but actively induces attackers to expose their intentions and techniques by creating false network resources, bait systems or bait documents, etc.

[0064] About technical terms "Attack graph" is a graphical tool commonly used in the field of network security to describe potential attack paths and vulnerabilities in computer networks. It starts from the perspective of an intruder, analyzes the network environment and vulnerability information, enumerates all intrusion paths in the graph, and intuitively displays the cause-and-effect relationship between different attack steps, as well as the potential threats caused by vulnerability exploitation. An attack graph is usually composed of nodes and edges. Nodes represent various entities in the network, such as hosts, servers, routers, etc., while edges represent the connections or dependencies between them. It can help security professionals identify weaknesses and vulnerabilities in the network, understand potential attack paths that attackers may exploit, and evaluate the impact of different attack strategies. Probabilistic attack graphs add probability values ​​to the nodes and edges of traditional attack graphs to quantify the possibility of a successful attack, thereby calculating the probability of an attack path occurring and the probability of a node being compromised.

[0065] In addition, G = {N, E, P, V} can be used to represent the attack graph, where N represents the set of nodes in the graph, including the initial attack node Nattack and the host Nhost in the network. E = {E1, E2, …, Em} represents the edge set, which represents the possible attack path, and m represents the number of edges. If there is at least one vulnerability that allows the attacker to penetrate from host1 to host2, there will be an edge from host1 to host2. P = {p1, p2, …, pm} is the probability set of edges, which represents the possibility of penetrating from one host to another. The larger the value, the easier it is. V = {v1, v2, …, vn} represents the host value set, which represents the quantitative result of the asset value of the host. The larger the value, the more important the host is. n represents the number of hosts. In particular, v1 = 0, because the attacker's host has no asset value for the protected network.

[0066] About the technical term "cooperative game" is also called positive-sum game, which means that under certain rules or constraints, the parties to the game reach a consensus through consultation and negotiation, thereby forming a solution that is beneficial to all parties. The characteristic of this game is that the participants can realize that cooperation can create greater overall benefits and are willing to give up some personal interests for this. In cooperative games, participants usually form some form of alliance or group to maximize common interests through collective action. Shapley value is a concept in cooperative game theory. It was proposed by Lloyd Shapley in 1951 and won the Nobel Prize in Economics in 2012. It is a method to measure the contribution of each participant to the overall victory in a cooperative game. The core idea of ​​Shapley value is to distribute rewards or benefits according to the contribution of each participant to the entire cooperation process. The advantage of Shapley value is that it can accurately measure the contribution of each participant to the entire cooperation process, so as to achieve the purpose of fair distribution of rewards or benefits. Weber proved that the Shapley value is the only attribution method with the following properties: 1) Symmetry: The distribution of cooperative profits does not change with the sign or order of each person in the cooperation. 2) Effectiveness: The sum of the profits of the cooperating parties is equal to the cooperative profit. 3) Redundancy: If a member does not contribute to any cooperative alliance he participates in, he should not benefit from the overall cooperation. 4) Linearity: If the reward of a game u satisfies u(S) = v(S) + w(S), where v and w are two other games, then the Shapley value of each player i in game u is the sum of the Shapley values ​​of player i in games v and w. The Shapley value calculation formula is as follows:

[0067]

[0068] Where V(i) represents the Shapley value of participant i, N represents the set of participants, |N| represents the number of elements in the set of participants, S is a subset of N, |S| is the number of subsets of N, and v(S) represents the value of the cooperative combination S. The calculation steps of the Shapley value are: 1) Consider all possible alliances: Alliances refer to different combinations of cooperative members, including subsets containing different members. 2) Calculation of marginal contribution: For each member i, Shapley Value calculates the marginal contribution of member i in the alliance. The marginal contribution represents the incremental contribution of member i to the overall alliance. 3) Weighted summation: Use the weight factor to perform weighted summation of the marginal contribution of each member.

[0069] Regarding the technical term "honey spot", as a deception defense technology, it is fundamentally different from the traditional honeypot. Honeypots have some obvious known vulnerabilities to lure attackers to attack them, and the templates they generate are relatively simple, which cannot meet the scenarios with higher threat levels and environments with higher security requirements. Honey spots can perform high-simulation simulations based on the target system's heavy network environment and surrounding service configurations. They do not have vulnerabilities themselves, and are not intended to attract attackers, but to set traps for attackers. For those more hidden attackers, once they touch the honey spot, it is a behavior that requires high warning, and at the same time improves the ability to perceive risks in advance, making timely preparations for the next step of defense.

[0070] The applicant found that in the existing research on the deployment of deception defense resources, a large number of honeypots, honeynet probes, etc. are often deployed in the protected network to increase the possibility of discovering traces of attackers. However, blindly pursuing the number of deception defense resources deployed will not only cause excessive resource consumption and cost increase for the defender, but also a large number of repeated and redundant alarm information will add pressure to network operation and maintenance and increase the complexity of management. Network operation and maintenance personnel need to spend extra time to identify useful information. And it is not allowed to deploy a large number of deception defense resources in all cases. When resources are limited, the defender can only maximize the effectiveness of deploying deception defense with limited resources.

[0071] In addition, existing deception defense products can only simulate limited services, and they are easily identified by attackers after long-term deployment in the network. Advanced APT organizations can even use honeypots to feint attacks and use the traces left in the honeypots to confuse defense personnel. Therefore, when deploying a deception defense system in the system to discover hidden attackers, it is necessary to continuously adjust the network security situation during the network attack and defense process and adjust the strategy adaptively.

[0072] Based on this, the present invention proposes a dynamic honey spot deployment method based on attack graph and Shapley value, which can not only calculate the overall system damage degree of each edge in the attack graph from a global perspective and optimize the honey spot deployment, but also dynamically adjust the honey spot deployment strategy according to the network security situation.

[0073] See also Figure 1 , which is a flow chart of a dynamic honey spot deployment method based on attack graph and Shapley value provided by an embodiment of the present invention, the method comprises steps S101 to S104, wherein:

[0074] Step S101: Scan and detect the protected network at a first preset time interval to obtain a scanning and detection result, wherein the scanning and detection result includes asset information, configuration error information, and vulnerability information;

[0075] It should be noted that the purpose of setting the first preset time is to continuously scan the protected network in real time to continuously update the honey spot deployment strategy, thereby realizing a dynamic cycle of the honey spot deployment strategy.

[0076] In addition, the scanning and detection results mainly include open port information, services, operating system type and architecture, asset information, configuration error information, vulnerability information and other information in the protected network.

[0077] In some embodiments, the network structure is explored through a network scanning tool, and known attacker information is obtained through defense devices in the network such as intrusion detection. The specific implementation can be implemented using mainstream network exploration tools, such as OpenVAS, Nmap, Nessus and other vulnerability scanners. Through scanning and exploration, open port information, services, operating system types and architectures, asset information, configuration error information, and vulnerability information in the protected network are obtained.

[0078] After completing the exploration of the protected network, the collected information is stored in a JSON file and converted into an input.in file through a script. The input file contains the host information of the protected network, the topological relationship between hosts, vulnerability-related information, etc., which serves as the input for the subsequent generation of the attack graph.

[0079] Step S102: constructing an attack graph corresponding to the current network environment of the protected network according to the scanning and detection results, obtaining the probability of each vulnerability in each edge in the attack graph being exploited based on CSVV evaluation calculation, and defining the difficulty of attacking each edge according to the probability of each vulnerability being exploited;

[0080] It should be pointed out that in this step, after obtaining the probability of each vulnerability in each edge being exploited, the probability of each vulnerability in each edge being exploited is sorted by difficulty, and the maximum probability corresponding to the difficulty of each edge is obtained according to the difficulty sorting result, and the maximum probability is used as the difficulty of each edge being attacked, thereby completing the definition of the difficulty of each edge being attacked.

[0081] Step S103: Calculate the realization probability of the attack path according to the difficulty of each edge being attacked, and obtain the expected loss of each attack path in the attack graph based on the realization probability of the attack path;

[0082] Step S104: construct a game model, and define each edge in the attack graph as a player in the game model, and solve the Shapley value of each edge based on the Monte Carlo method, and sort all the edges in the attack graph according to the Shapley value of each edge, so as to generate an optimal honey spot deployment strategy according to the edge sorting result.

[0083] It should be noted that the Shapley value of the edge obtained in this step is the contribution of each edge to the expected benefits brought by the attacker's penetration into the target from the attacker's perspective, and the degree of damage an edge causes to the entire system from the defender's perspective. Since the Shapley value is the only contribution calculation method with the four properties of symmetry, effectiveness, redundancy, and linearity, the use of the Shapley value can unbiasedly calculate the degree of damage of each edge to the entire system. By sorting the edges according to the Shapley value, the degree of damage of the edges can be clearly displayed from high to low. Finally, the optimal defense strategy (honey spot deployment strategy) is generated based on the existing available resources and the degree of damage to the edge.

[0084] Finally, based on the optimal honey spot deployment strategy, the honey spot policy is implemented and the honey spots are deployed in the network. In addition, since the edges are sorted and the edge damage ranking is obtained, the optimal honey spot deployment strategy will first repair the edges that are most destructive to the system. Thanks to the lightweight and flexible deployment characteristics of honey spots, the environment near the honey spots can be simulated and seamlessly embedded into the network to implement active defense.

[0085] In addition, after the deployment is completed, after the first preset time interval, it enters the next cycle, that is, continuously repeating the scanning and detection of the protected network so that the dynamically deployed deception defense devices can perceive the highly hidden threats in the system. In other words, the next stage can continue to optimize the honey spot deployment strategy based on the detection results, thereby realizing the dynamic deployment of honey spots.

[0086] In addition, in some optional embodiments, after obtaining the input.in file, the attack graph generation tool MulVAL can be used in combination with the CVE / NVD vulnerability information library to generate an attack graph in the current network environment.

[0087] In some optional embodiments, the specific process of evaluating the probability of each vulnerability being exploited based on CSAA is as follows:

[0088] First, through the CSVV scoring framework, using the three indicators of attack vector (AV), attack complexity (AC), and authentication (AU), the probability of success of the atomic attack is calculated by the atomic attack difficulty formula. In the host probability attack graph, the directed edges between attribute nodes represent the process of atomic attack being exploited. The greater the difficulty of the atomic attack, the lower the probability of being exploited, and the two are inversely proportional. Therefore, the difficulty of the atomic attack can be represented by the calculation formula between attribute nodes (vulnerabilities) as follows:

[0089] P = 2*AV*AC*AU, 0 <P<1

[0090] Among them, P represents the probability of vulnerability being exploited, AV represents the attack path evaluation index, AC represents the attack complexity evaluation index, and AU represents the authentication evaluation index;

[0091] In addition, since the structure of the attack graph is constructed through vulnerability information, topology, and communication rules between hosts collected in the target network, in a real network, there may be more than one atomic attack that can attack from one host to another. According to the short board effect, the vulnerability with the lowest attack difficulty among all the vulnerabilities that can be used to attack from one host to another is the shortest plank among all the planks, and is also the most likely attack intention of the attacker. Therefore, the atomic attack with the lowest attack difficulty is used as the difficulty of attacking from one host to another.

[0092] Specifically, the probability of exploitation of each vulnerability in each edge is sorted by difficulty, and the maximum probability corresponding to the difficulty of each edge is obtained according to the difficulty sorting result, and the maximum probability is used as the difficulty of attacking each edge. It should be noted that the greater the probability of being exploited, the lower the difficulty of being attacked. Based on this, the maximum probability among the probabilities of exploitation of each vulnerability corresponds to the minimum difficulty of being attacked, and then the maximum probability selected from each edge is used as the difficulty of attacking each edge, so as to achieve the difficulty of using the atomic attack with the lowest attack difficulty as the difficulty of attacking from one host to another.

[0093] In some optional embodiments, the specific process of obtaining the expected loss of each attack path in the attack graph is as follows:

[0094] (1) Since the host attack graph intuitively displays all possible attack paths for an attacker to reach each host, the realization of a complete attack path requires the attacker to complete all host-to-host penetrations in the path. Therefore, the probability of achieving the attack path is calculated according to the following formula:

[0095]

[0096] in, represents the realization probability of the jth attack path, p i represents the difficulty of attacking the i-th edge in attack path j, and n represents the total number of edges contained in the j-th attack path;

[0097] (2) For a single host, an attacker only needs to implement one attack path to penetrate the host. Therefore, the probability of each host being compromised is calculated according to the following formula:

[0098]

[0099] Among them, P(h i 、 ) represents the probability that the i-th host will not be compromised.

[0100] (3) The ultimate goal of the attacker is to cause losses to the protected system. The expected loss is the possible loss caused by the assessed risk. The expected loss of a single host is related to its probability of being attacked and its own value. Therefore, the expected loss of each host is calculated according to the following formula:

[0101]

[0102] in, represents the expected loss of the ith host, V(h i ) represents the value of the i-th host, P(h i ) represents the probability that the i-th host is compromised;

[0103] (4) For an attack path on the host attack graph, the expected loss is the sum of the expected losses of all hosts on the path. Therefore, the expected loss of each attack path is calculated according to the following formula:

[0104]

[0105] in, represents the expected loss of the jth attack path, x represents the total number of hosts on a path, represents the expected loss of the ith host;

[0106] Furthermore, in some embodiments, the steps of obtaining the value of each host are as follows:

[0107] (1) In order to obtain the value of each host, it is also necessary to obtain the asset importance attributes of each host, wherein the asset importance attributes include confidentiality, integrity, and availability;

[0108] (2) Divide each asset importance attribute into several levels, define an importance value for each level under each asset importance attribute, and bind the importance value to the level to construct an asset importance attribute value evaluation table;

[0109] (3) Obtain the level identification of the target host in each asset importance attribute, and query the asset importance attribute value evaluation table according to the level identification to obtain the importance assignment of each asset importance attribute in the target host, and calculate the value of the host according to the following formula:

[0110] V(h i )=C i +I i +A i

[0111] Among them, C i represents the importance of the i-th host under confidentiality, I i represents the importance of the ith host under integrity, A i Represents the importance of the i-th host under availability.

[0112] For example, but not limitation, based on the security requirements of different hosts, according to the national standard "Information Security Risk Assessment Specification", the asset importance attributes of each host are divided into five levels: L1, L2, L3, L4, and L5. The asset importance attribute value evaluation table is shown in Table 1 below.

[0113] Table 1 Evaluation table of asset importance attributes

[0114]

[0115]

[0116] In addition, it should be noted that in the network risk analysis method based on attack graph and Shapley value involved in this embodiment, although the attack graph can show the possible attack path of the attacker, the attack graph can only be constructed based on the known vulnerabilities in the system. When the attacker uses zero-day vulnerabilities and other methods to penetrate the system, adjustments are made based on the clues found in the protected system to dynamically evaluate the threats in the system. Specifically, when the attacker's traces are found in a host in the system through defense devices such as H IDS and it is determined that the host has been invaded by the attacker, it is believed that the attacker can directly use this point as the starting point to penetrate other nodes in the subsequent attack, and the host found to be invaded by the attacker is marked as an evidence host and added to the starting point set. The nodes in the starting point set are the same as node 1, and can be directly used as the starting point of the attack path in the subsequent risk analysis. In addition, the value of these hosts in the attack graph also becomes 0.

[0117] In some optional embodiments, see Figure 2 , step S104 specifically includes:

[0118] Step S1041: Set the total number of sampling times. Each time a random function is used to generate a random arrangement of 1 to m to represent the order of adding edges. Then, these edges are added to the attack graph in sequence. During the adding process, the boundary contribution of each edge in the sequence is calculated.

[0119] Step S1042: For each participant, accumulate its marginal contribution in all samples, and finally take the average value as the Shapley value.

[0120] It should be noted that the solution of the Shapley value of each edge requires finding its boundary contribution in all sequences, which has an exponential time complexity and is an NP-Complete problem. Therefore, in the actual solution, the Monte Carlo method is used to estimate the Shapley value.

[0121] Specifically, the game model is modeled through the attack graph, and the Shapley value of each edge to the attacker's benefit is calculated to generate the optimal honey spot deployment strategy. The main implementation details are as follows: First, a cooperative game model is constructed for the entire system. Each edge is a player in the game. They work together to achieve the attacker's penetration into the target node to obtain the expected benefit. The contribution of each player in the cooperation is calculated through the Shapley value in the cooperative game. The algorithm time complexity of solving the Shapley value is O(N*2N), which cannot be solved within the polynomial time complexity. Therefore, it can only be solved when the network scale is small. In order to make this method applicable to networks of any size, this method uses the Monte Carlo method to approximate the Shapley value of each edge. The specific estimation method is: for each edge, random sampling is performed X times. Each sampling randomly generates a permutation, and the boundary utility of the current edge in the permutation is calculated. For example, for a set of 5 elements, the arrangement generated by a certain sampling is {1,5,4,3,2}, then the marginal utility of element 3 in the current arrangement is v({1,5,4,3})-v({1,5,4}). The final Shapley value of a node is the average of the marginal benefits obtained by each random sampling. From the attacker's perspective, the Shapley value of an edge is the contribution of each edge to the expected benefits brought by the attacker's penetration into the target, and from the defender's perspective, it is the degree of harm a vulnerability causes to the entire system. Since the Shapley value is the only contribution calculation method with the four properties of symmetry, effectiveness, redundancy, and linearity, the Shapley value can be used to unbiasedly calculate the degree of damage of each edge to the entire system. By sorting the edges according to the Shapley value, the degree of damage of the edges can be clearly displayed from high to low. Finally, the optimal defense strategy is generated based on the existing available resources and the degree of damage to the edges.

[0122] In summary, the above-mentioned dynamic honey spot deployment method based on attack graph and Shapley value has the following advantages:

[0123] 1. The present invention uses an attack graph to model the protected network. Starting from the global perspective of the protected network, the difficulty of exploiting the vulnerabilities on the edges in the attack graph, the key assets that can be reached by the edges, and the topological position in the network are comprehensively considered to analyze the global destructiveness of the edges in the attack graph. The protected network is modeled using cooperative games, and honey spot deployment decisions are made based on the degree of damage to the overall system by the edges. Based on the attacker's perspective, the expected benefits of the attacker are quantified in combination with the asset distribution and the host probability attack graph. In the cooperative game, the edges in the attack graph are regarded as players in the game, and they cooperate to achieve the attacker's expected benefits. The Shapley value is used to calculate the contribution of each edge to the expected benefits. This value is the degree of harm of the edge to the system as a whole.

[0124] 2. Since the Shapley value is the only method of calculating profit distribution that has the four properties of symmetry, effectiveness, redundancy, and linearity, this method can unbiasedly calculate the degree of damage of each edge to the overall system by using the Shapley value in the cooperative game to calculate the profit of each edge in the attack graph to the attacker.

[0125] 3. The present invention calculates the degree of damage of each edge to the entire system in an unbiased manner. In a scenario with limited resources, the most harmful edge vulnerabilities can be patched according to the limited resources and honey spots can be deployed on the most harmful edges to maximize the utility of existing resources.

[0126] 4. The present invention can dynamically adjust the host summary attack graph based on the discovered attacker traces, and dynamically adjust the honey spots according to the degree of harm of the edges in the real-time attack graph to the entire system according to the changes in the network situation, thereby realizing adaptive strategy optimization. Specifically, there may be vulnerabilities in the network that are not discovered during active vulnerability scanning, such as zero-day vulnerabilities. When an attacker infiltrates the system through these vulnerabilities, the relative position of the attacker on each edge in the attack graph will also change, and the degree of damage to the system by each edge may also change. Therefore, when the attacker's traces are found in the system, the present invention can determine the host infiltrated by the attacker based on the status of the alarm information, adjust the attacker graph based on this information, recalculate the degree of damage to the system by the edges, optimize the deployment of honey spots, and realize adaptive adjustment of the deployment of honey spots according to the real-time network security situation.

[0127] See also Figure 3 , which is a schematic diagram of the structure of a dynamic honey spot deployment system based on attack graph and Shapley value in one embodiment of the present invention, wherein the system comprises:

[0128] A scanning and probing module, configured to scan and probe the protected network at a first preset time interval to obtain a scanning and probing result, wherein the scanning and probing result includes asset information, configuration error information, and vulnerability information;

[0129] A CSVV evaluation module, configured to construct an attack graph corresponding to the current network environment of the protected network according to the scanning and detection results, obtain the probability of each vulnerability in each edge in the attack graph being exploited based on the CSVV evaluation calculation, and define the difficulty of attacking each edge according to the probability of each vulnerability being exploited;

[0130] An expected loss calculation module, used to calculate the realization probability of the attack path according to the difficulty of each edge being attacked, and obtain the expected loss of each attack path in the attack graph based on the realization probability of the attack path;

[0131] A decision module is used to construct a game model, define each edge in the attack graph as a player in the game model, solve the Shapley value of each edge based on the Monte Carlo method, and sort all the edges in the attack graph according to the Shapley value of each edge, so as to generate an optimal honey spot deployment strategy according to the edge sorting result.

[0132] On the other hand, the present invention further proposes a readable storage medium on which one or more programs are stored, and when the programs are executed by a processor, the above-mentioned dynamic honey spot deployment method based on attack graph and Shapley value is implemented.

[0133] On the other hand, the present invention also proposes a computer device, including a memory and a processor, wherein the memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the above-mentioned dynamic honey spot deployment method based on attack graphs and Shapley values.

[0134] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0135] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0136] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0137] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A dynamic honey spot deployment method based on attack graph and Shapley value, characterized in that: The method comprises: Scanning and probing the protected network at a first preset time interval to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information; Constructing an attack graph corresponding to the current network environment of the protected network according to the scanning and probing results, obtaining the probability of each vulnerability in each edge in the attack graph being exploited based on CSVV evaluation calculation, and defining the difficulty of attacking each edge according to the probability of each vulnerability being exploited; The realization probability of the attack path is calculated according to the difficulty of each edge being attacked, and the expected loss of each attack path in the attack graph is obtained based on the realization probability of the attack path; A game model is constructed, and each edge in the attack graph is defined as a player in the game model. The Shapley value of each edge is solved based on the Monte Carlo method, and all edges in the attack graph are sorted according to the Shapley value of each edge, so as to generate an optimal honey spot deployment strategy according to the edge sorting result.

2. The dynamic honey spot deployment method based on attack graph and Shapley value according to claim 1 is characterized in that: The step of scanning and probing the protected network at first preset intervals to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information comprises: Perform vulnerability scans on the structure of the protected network to obtain open port information, services, operating system type and architecture, asset information, configuration error information, and vulnerability information in the protected network; The scanned information is stored in a JSON file, and the JSON file is converted into an input.in file.

3. The dynamic honey spot deployment method based on attack graph and Shapley value according to claim 1 is characterized in that: The steps of constructing an attack graph corresponding to the current network environment of the protected network according to the scanning and detection results, obtaining the probability of each vulnerability in each edge in the attack graph being exploited based on CSVV evaluation calculation, and defining the difficulty of attacking each edge according to the probability of each vulnerability being exploited include: The probability of each vulnerability being exploited is calculated using the following formula: P = 2*AV*AC*AU, 0 <P<1 Among them, P represents the probability of vulnerability being exploited, AV represents the attack path evaluation index, AC represents the attack complexity evaluation index, and AU represents the authentication evaluation index; The probability of each vulnerability in each edge being exploited is ranked by difficulty, and the maximum probability corresponding to the difficulty of each edge is obtained according to the difficulty ranking result, and the maximum probability is used as the difficulty of each edge being attacked.

4. The dynamic honey spot deployment method based on attack graph and Shapley value according to claim 1 is characterized in that: The step of calculating the realization probability of the attack path according to the difficulty of each edge being attacked, and obtaining the expected loss of each attack path in the attack graph based on the realization probability of the attack path includes: The probability of achieving the attack path is calculated according to the following formula: in, represents the realization probability of the jth attack path, p i represents the difficulty of attacking the i-th edge in attack path j, and n represents the total number of edges contained in the j-th attack path; The expected loss of each attack path is calculated according to the following formula: in, represents the expected loss of the jth attack path, x represents the total number of hosts on a path, represents the expected loss of the ith host; The expected loss of each host is calculated according to the following formula: in, represents the expected loss of the ith host, V(h i ) represents the value of the i-th host, P(h i ) represents the probability of the i-th host being compromised; The probability of each host being compromised is calculated using the following formula: Among them, P(h i 、 ) represents the probability that the i-th host will not be compromised.

5. The dynamic honey spot deployment method based on attack graph and Shapley value according to claim 4 is characterized in that: The steps to obtain the value of each host include: Obtaining asset importance attributes of each host, wherein the asset importance attributes include confidentiality, integrity, and availability; Each asset importance attribute is divided into several levels, and an importance value is defined for each level under each asset importance attribute, and the importance value is bound to the level to construct an asset importance attribute value evaluation table; Obtain the level identification of the target host in each asset importance attribute, and query the asset importance attribute value evaluation table according to the level identification to obtain the importance assignment of each asset importance attribute in the target host, and calculate the value of the host according to the following formula: V(h i )=C i +I i +A i Among them, C i represents the importance of the i-th host under confidentiality, I i represents the importance of the ith host under integrity, A i Represents the importance of the i-th host under availability.

6. The dynamic honey spot deployment method based on attack graph and Shapley value according to claim 5 is characterized in that: The steps of constructing a game model, defining each edge in the attack graph as a player in the game model, and solving the Shapley value of each edge based on the Monte Carlo method include: Set the total number of sampling times. Each time a random function is used to generate a random arrangement of 1 to m to represent the order in which the edges are added. Then, these edges are added to the attack graph in sequence. During the addition process, the marginal contribution of each edge in the sequence is calculated. For each participant, its marginal contribution in all samples is accumulated and finally the average is taken as the Shapley value.

7. The dynamic honey spot deployment method based on attack graph and Shapley value according to claim 6 is characterized in that: The step of sorting all the edges in the attack graph according to the Shapley value of each edge to generate an optimal honey spot deployment strategy according to the edge sorting result includes: Sort the Shapley value of each edge from large to small to get the edge ranking from high to low; Deploy honeypot resources in order from highest to lowest edge hazard level.

8. A dynamic honey spot deployment system based on attack graph and Shapley value, characterized in that: The system comprises: A scanning and probing module, configured to scan and probe the protected network at a first preset time interval to obtain a scanning and probing result, wherein the scanning and probing result includes asset information, configuration error information, and vulnerability information; A CSVV evaluation module, configured to construct an attack graph corresponding to the current network environment of the protected network according to the scanning and detection results, obtain the probability of each vulnerability in each edge in the attack graph being exploited based on the CSVV evaluation calculation, and define the difficulty of attacking each edge according to the probability of each vulnerability being exploited; An expected loss calculation module, used to calculate the realization probability of the attack path according to the difficulty of each edge being attacked, and obtain the expected loss of each attack path in the attack graph based on the realization probability of the attack path; A decision module is used to construct a game model, define each edge in the attack graph as a player in the game model, solve the Shapley value of each edge based on the Monte Carlo method, and sort all the edges in the attack graph according to the Shapley value of each edge, so as to generate an optimal honey spot deployment strategy according to the edge sorting result.

9. A readable storage medium, characterized in that: The readable storage medium stores one or more programs, which, when executed by a processor, implement the dynamic honey spot deployment method based on attack graph and Shapley value as described in any one of claims 1-7.

10. A computer device, characterized in that: The computer device comprises a memory and a processor, wherein: The memory is used to store computer programs; When the processor is used to execute the computer program stored in the memory, the dynamic honey spot deployment method based on the attack graph and the Shapley value described in any one of claims 1-7 is implemented.

Images