Attack chain construction method, network target range construction method, device and server

Abstract

The invention provides an attack chain construction method and device, a network target range construction method and device and a server. The attack chain construction method comprises the steps of obtaining a utilization result of a first vulnerability; judging whether the utilization result of the first vulnerability is related to a utilization condition of a second vulnerability or not; and under the condition that the utilization result of the first vulnerability is related to the utilization condition of the second vulnerability, constructing an attack chain about the first vulnerability and the second vulnerability, and constructing a network target range according to the obtained attack chain. The attack chain determined by the method can more comprehensively and stereoscopically display the vulnerability utilization relationship in the network target range, the vulnerability of the network target range is intuitively reflected, and the network target range constructed by the attack chain determined by the method has relatively high integrity, so that the operation experience of a user is improved.

Description

Technical Field

[0001] The present application relates to the field of network technology, and more specifically, to an attack chain construction method, a network target range construction method, a device and a server in the field of network technology. Background Art

[0002] With the rapid development of network technology, the Internet technology system is becoming more and more mature, and cyber target ranges have become an indispensable core infrastructure for cyberspace security in competitions, teaching, and attack and defense drills.

[0003] There are single vulnerabilities in the network range of competitions and teaching, such as network vulnerabilities, binary overflow vulnerabilities, reverse engineering vulnerabilities, and cryptographic vulnerabilities. After attacking a single vulnerability, students or contestants cannot deeply understand the impact of the vulnerability on the entire topology network. They only conduct simple attacks on a single vulnerability and do not think about the relationship between vulnerabilities.

[0004] Although the cyber range for attack and defense drills can build a simulated industrial network range, it can only simply reproduce the vulnerabilities existing in related technologies in series, and cannot clearly present the relationship between vulnerabilities, so it is impossible to build a complete cyber range.

[0005] Therefore, the relevant technology urgently needs a solution that can reflect the correlation between vulnerabilities. Summary of the invention

[0006] The present application provides a method for constructing an attack chain, a method for constructing a network target range, a device and a server. The solution provided by the present application can reflect the relationship between vulnerabilities.

[0007] In a first aspect, a method for constructing an attack chain is provided, the method comprising: obtaining the result of exploiting a first vulnerability; determining whether the result of exploiting the first vulnerability is related to the condition for exploiting a second vulnerability; and constructing an attack chain regarding the first vulnerability and the second vulnerability when the result of exploiting the first vulnerability is related to the condition for exploiting the second vulnerability.

[0008] In the above technical solution, by establishing an attack chain between the first vulnerability and the second vulnerability, the vulnerability exploitation relationship in the network target range can be displayed more comprehensively and three-dimensionally, and the vulnerability of the network target range can be intuitively displayed.

[0009] In combination with the first aspect, in certain implementations of the first aspect, determining whether the result of exploiting the first vulnerability is related to the condition for exploiting the second vulnerability includes: when the result of exploiting the first vulnerability is information leakage or permission acquisition, determining whether the result of exploiting the first vulnerability is related to the condition for exploiting the second vulnerability.

[0010] In combination with the first aspect and the above-mentioned implementation methods, in some implementation methods of the first aspect, determining whether the result of exploiting the above-mentioned first vulnerability is related to the condition for exploiting the second vulnerability includes: in the case where the result of exploiting the above-mentioned first vulnerability is information leakage, determining the target information leaked by the above-mentioned first vulnerability; determining whether the condition for exploiting the above-mentioned second vulnerability can be obtained based on the above-mentioned target information; wherein, in the case where the condition for exploiting the above-mentioned second vulnerability can be obtained based on the above-mentioned target information, determining that the result of exploiting the above-mentioned first vulnerability is related to the condition for exploiting the above-mentioned second vulnerability.

[0011] It should be understood that the target information for leakage may be basic information, device information, account information, privacy information, social relationship information, network behavior information, etc., and the embodiments of the present application do not limit this.

[0012] In combination with the first aspect and the above-mentioned implementation methods, in some implementation methods of the first aspect, determining whether the result of exploiting the above-mentioned first vulnerability is related to the condition for exploiting the second vulnerability includes: in the case where the result of exploiting the above-mentioned first vulnerability is permission acquisition, determining the permission type acquired by the above-mentioned first vulnerability; determining whether the condition for exploiting the above-mentioned second vulnerability can be obtained according to the above-mentioned permission type; wherein, in the case where the condition for exploiting the above-mentioned second vulnerability can be obtained according to the above-mentioned permission type, determining that the result of exploiting the above-mentioned first vulnerability is related to the condition for exploiting the above-mentioned second vulnerability is related to the condition for exploiting the above-mentioned second vulnerability.

[0013] Optionally, when the result of exploiting the first vulnerability is a denial of service or other situations, the process of constructing the attack chain of the first vulnerability and the second vulnerability is terminated.

[0014] In combination with the first aspect and the above-mentioned implementation methods, in some implementation methods of the first aspect, constructing an attack chain regarding the above-mentioned first vulnerability and the above-mentioned second vulnerability, including: constructing an attack chain regarding the above-mentioned first vulnerability and the above-mentioned second vulnerability according to the results of exploiting the above-mentioned first vulnerability, the conditions for exploiting the above-mentioned first vulnerability, the method for exploiting the above-mentioned first vulnerability, the results of exploiting the above-mentioned second vulnerability, the conditions for exploiting the above-mentioned second vulnerability and the method for exploiting the above-mentioned second vulnerability.

[0015] It should be understood that in the process of constructing an attack chain regarding the first vulnerability and the second vulnerability, it does not mean that the attack chain must include the results of exploiting the first vulnerability, the conditions for exploiting the first vulnerability, the way of exploiting the first vulnerability, the results of exploiting the second vulnerability, the conditions for exploiting the second vulnerability, and the way of exploiting the second vulnerability. As long as the construction process can be completed, it can include one or more of them. It can be set according to actual conditions, and the embodiments of the present application do not limit this.

[0016] In the above technical solutions, the solution provided by the embodiment of the present application can more comprehensively and three-dimensionally display the vulnerability exploitation relationship in the network target range during the construction of the attack chain, and intuitively show the vulnerability of the network target range.

[0017] In a second aspect, a method for constructing a network target range is provided, the method comprising: obtaining an attack chain, wherein the attack chain is constructed by the method in the first aspect or any possible implementation of the first aspect; and constructing the network target range according to the attack chain.

[0018] In the above technical solution, a network target range is constructed according to the obtained attack chain, so that the constructed network target range has a higher integrity, which is conducive to improving the user's operating experience.

[0019] In combination with the second aspect, in certain implementations of the second aspect, constructing the network target range according to the attack chain includes: determining each attack chain as a target of the network target range to construct the network target range.

[0020] In summary, by constructing an attack chain about the first vulnerability and the second vulnerability, we can more comprehensively and three-dimensionally display the vulnerability exploitation relationship in the network target range, intuitively show the vulnerability of the network target range, and construct a network target range based on the obtained attack chain, so that the constructed network target range has a higher integrity, which is conducive to improving the user's operating experience.

[0021] According to a third aspect, an attack chain construction device is provided, which includes: a first acquisition module, used to obtain the exploitation result of a first vulnerability; a judgment module, used to judge whether the exploitation result of the first vulnerability is related to the exploitation condition of the second vulnerability; and a first construction module, when the exploitation result of the first vulnerability is related to the exploitation condition of the second vulnerability, for constructing an attack chain regarding the first vulnerability and the second vulnerability.

[0022] In combination with the third aspect, in certain implementations of the third aspect, the judgment module is specifically used to: when the result of exploiting the above-mentioned first vulnerability is information leakage or permission acquisition, determine whether the result of exploiting the above-mentioned first vulnerability is related to the exploitation condition of the above-mentioned second vulnerability.

[0023] In combination with the third aspect and the above-mentioned implementation methods, in some implementation methods of the third aspect, the judgment module is also used to: when the result of exploiting the above-mentioned first vulnerability is information leakage, determine the target information leaked by the above-mentioned first vulnerability; judge whether the exploitation conditions of the above-mentioned second vulnerability can be obtained based on the above-mentioned target information; wherein, when the exploitation conditions of the above-mentioned second vulnerability can be obtained based on the above-mentioned target information, determine that the exploitation result of the above-mentioned first vulnerability is related to the exploitation conditions of the above-mentioned second vulnerability.

[0024] In combination with the third aspect and the above-mentioned implementation methods, in some implementation methods of the third aspect, the judgment module is also used to: when the result of exploiting the above-mentioned first vulnerability is permission acquisition, determine the permission type acquired by the above-mentioned first vulnerability; judge whether the exploitation conditions of the above-mentioned second vulnerability can be obtained according to the above-mentioned permission type; wherein, when the exploitation conditions of the above-mentioned second vulnerability can be obtained according to the above-mentioned permission type, determine that the exploitation result of the above-mentioned first vulnerability is related to the exploitation conditions of the above-mentioned second vulnerability.

[0025] In combination with the third aspect and the above-mentioned implementation methods, in some implementation methods of the third aspect, the first construction module is specifically used to: construct an attack chain regarding the first vulnerability and the second vulnerability according to the exploitation results of the first vulnerability, the exploitation conditions of the first vulnerability, the exploitation method of the first vulnerability, the exploitation results of the second vulnerability, the exploitation conditions of the second vulnerability and the exploitation method of the second vulnerability.

[0026] In a fourth aspect, a device for constructing a network target range is provided, the device comprising: a second acquisition module, used to obtain an attack chain, wherein the attack chain is constructed by the method in the first aspect or any possible implementation of the first aspect; a second construction module, used to construct the network target range according to the attack chain.

[0027] In combination with the fourth aspect, in certain implementations of the fourth aspect, the second construction module is specifically used to: determine each attack chain as a target of the above-mentioned network target range to construct the above-mentioned network target range.

[0028] In a fifth aspect, a server is provided, comprising a memory and a processor. The memory is used to store an executable program code, and the processor is used to call and run the executable program code from the memory, so that the server executes the method in the above-mentioned first aspect or any one of the first aspects, or the above-mentioned second aspect or any one of the possible implementations of the second aspect.

[0029] In a sixth aspect, a computer program product is provided, which includes: a computer program code, which, when executed on a computer, enables the computer to execute the method in the first aspect or any one of the first aspects, or the second aspect or any one of the possible implementations of the second aspect.

[0030] In the seventh aspect, a computer-readable storage medium is provided, which stores a computer program code. When the computer program code runs on a computer, the computer executes the method in the above-mentioned first aspect or any one of the first aspects, or the above-mentioned second aspect or any one of the possible implementations of the second aspect.

[0031] In the technical solution provided by the present application, the result of the exploitation of the first vulnerability is obtained, and it is determined whether the result of the exploitation of the first vulnerability is related to the exploitation condition of the second vulnerability; when the result of the exploitation of the first vulnerability is related to the exploitation condition of the second vulnerability, an attack chain of the first vulnerability and the second vulnerability is constructed. It can be seen that the attack chain construction method provided by the embodiment of the present application can realize the construction of the attack chain of the first vulnerability and the second vulnerability, and can more comprehensively and three-dimensionally display the vulnerability exploitation relationship in the network target range, and intuitively reflect the vulnerability of the network target range.

[0032] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a scene schematic diagram of a network range provided in an embodiment of the present application;

[0034] Figure 2 This is a flow chart of a method for constructing an attack chain provided in an embodiment of the present application;

[0035] Figure 3 It is a flowchart of a method for constructing an attack chain between vulnerabilities provided in an embodiment of the present application;

[0036] Figure 4 It is a flowchart of a method for constructing a network target range provided in an embodiment of the present application;

[0037] Figure 5 It is a structural diagram of an attack chain construction device provided in an embodiment of the present application;

[0038] Figure 6 It is a structural schematic diagram of a device for constructing a network target range provided in an embodiment of the present application;

[0039] Figure 7 It is a structural diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] The technical solution in the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0041] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0042] Figure 1 It is a scene schematic diagram of a network target range provided in an embodiment of the present application.

[0043] For example, Figure 1 As shown, the network target range 100 is a technology or product based on virtualization technology that simulates and reproduces the operating status and operating environment of the network architecture, system equipment, and business processes in the real cyberspace, and can more effectively realize learning, research, testing, competition, exercises and other behaviors related to network security, thereby improving the user's network security confrontation level.

[0044] Vulnerability exploitation in Cyber ​​Range 100 means that users find vulnerabilities that are easy to attack in the target system, and then use the vulnerability to obtain permissions, thereby achieving control over the target system. In traditional vulnerability exploitation, vulnerabilities are simply linked and reproduced, and the relationship between vulnerabilities cannot be shown, so the constructed cyber range is not comprehensive enough.

[0045] Optionally, there are vulnerabilities 1 and 2 in the network target range 100. In the traditional vulnerability exploitation relationship, vulnerability 1 and vulnerability 2 are simply connected in series, so that vulnerability 1 can reach vulnerability 2, but the process from vulnerability 1 to vulnerability 2 is not shown. This makes the correlation between vulnerability 1 and vulnerability 2 poor, and thus a complete network target range cannot be constructed.

[0046] The present application will provide a method for constructing an attack chain, which can more comprehensively and three-dimensionally display the vulnerability exploitation relationship in a network target range, intuitively show the vulnerability of the network target range, and also provide a method for constructing a network target range. By constructing a network target range according to the obtained attack chain, the integrity of the constructed network target range can be improved.

[0047] Figure 2 It is a flowchart of a method for constructing an attack chain provided in an embodiment of the present application.

[0048] For example, Figure 2 As shown, the method 200 includes the following implementation process:

[0049] S201, obtaining the exploitation result of the first vulnerability.

[0050] Among them, a vulnerability is a defect in the specific implementation of hardware, software, or protocol or system security policy, which can enable an attacker to access or damage the system without authorization. The above-mentioned first vulnerability refers to any vulnerability, which is recorded as the "first vulnerability" in order to distinguish it from the "second vulnerability" below.

[0051] The result of vulnerability exploitation is the impact caused by the vulnerability. In the embodiment of the present application, the result of the exploitation of the first vulnerability includes: any one or more of: permission acquisition, denial of service, and information leakage.

[0052] The above-mentioned permission acquisition refers to analyzing whether the user can obtain ordinary permissions or administrator permissions during the process of attacking the vulnerability based on the obtained vulnerability exploitation results. If the user can obtain ordinary permissions or administrator permissions, it means that the user can successfully obtain the permissions during the process of attacking the vulnerability; if the user cannot obtain ordinary permissions or administrator permissions, it means that the user failed to obtain the permissions during the process of attacking the vulnerability.

[0053] Attacks that cause Denial of Service (DoS) are called DoS attacks. The purpose of a DoS attack is to prevent a computer or network from providing normal services. The most common DoS attacks are computer network broadband attacks and connectivity attacks.

[0054] Information leakage refers to the unintentional disclosure of some sensitive information to the user, which enables the user to obtain the conditions for exploiting other vulnerabilities from the leaked target information. The leaked target information can be basic information, device information, account information, privacy information, social relationship information, network behavior information, etc., which is not limited in the embodiments of this application.

[0055] It is understandable that the results of exploiting the vulnerabilities provided in the embodiments of the present application are not limited to the above-mentioned ones, for example, they also include vulnerabilities that cause other impacts, such as data tampering.

[0056] S202: Determine whether the result of exploiting the first vulnerability is related to the condition for exploiting the second vulnerability.

[0057] Specifically, when the result of the exploitation of the first vulnerability is information leakage or permission acquisition, it is necessary to further determine whether the result of the exploitation of the first vulnerability is related to the exploitation condition of the second vulnerability.

[0058] Among them, the conditions for exploiting a vulnerability refer to the permissions required for exploiting the vulnerability, which can generally be divided into ordinary permissions, administrator permissions, and no permissions required.

[0059] Exploitation of vulnerabilities with normal permissions means that users can perform operations on vulnerabilities even if they do not have system administrator permissions or normal administrator permissions. For example, if a user has login permissions, he or she can perform operations on the vulnerability.

[0060] Administrator privilege vulnerability exploitation means that the user must obtain system administrator privileges or ordinary administrator privileges to perform operations on the vulnerability.

[0061] Permissionless vulnerability exploitation means that users do not need to obtain system administrator privileges or general administrator privileges, and can directly launch network attacks on vulnerabilities. In other words, permissionless vulnerability exploitation does not require obtaining privileges, and can directly launch network attacks on vulnerabilities.

[0062] In a possible implementation, when the result of exploiting the first vulnerability is information leakage, the target information leaked by the first vulnerability is determined, and it is judged whether the exploitation condition of the second vulnerability can be obtained according to the target information. Wherein, when the exploitation condition of the second vulnerability can be obtained according to the target information, it is determined that the result of exploiting the first vulnerability is related to the exploitation condition of the second vulnerability.

[0063] Optionally, the target information leaked by the first vulnerability is set to device information and / or network behavior information. When the user determines that the target information leaked by the first vulnerability is device information and / or network behavior information, the device information and / or network behavior information can be used as a condition for obtaining the exploitation of the second vulnerability, so that it can be determined that the exploitation result of the first vulnerability is related to the exploitation condition of the second vulnerability.

[0064] In another possible implementation, when the result of exploiting the first vulnerability is permission acquisition, the permission type acquired by the first vulnerability is determined, and it is judged whether the conditions for exploiting the second vulnerability can be obtained according to the permission type. Wherein, when the conditions for exploiting the second vulnerability can be obtained according to the permission type, it is determined that the result of exploiting the first vulnerability is related to the conditions for exploiting the second vulnerability.

[0065] Optionally, the permission type of the first vulnerability is set to common permission or administrator permission. When the permission type of the first vulnerability obtained by the user is common permission or administrator permission, the common permission or administrator permission can be used as a condition for obtaining the second vulnerability, so that it can be determined that the result of the first vulnerability is related to the condition for the second vulnerability.

[0066] S203: When the result of exploiting the first vulnerability is related to the condition of exploiting the second vulnerability, construct an attack chain for the first vulnerability and the second vulnerability.

[0067] Specifically, an attack chain regarding the first vulnerability and the second vulnerability is constructed according to the exploitation result of the first vulnerability, the exploitation condition of the first vulnerability, the exploitation method of the first vulnerability, the exploitation result of the second vulnerability, the exploitation condition of the second vulnerability, and the exploitation method of the second vulnerability.

[0068] Among them, the exploitation methods of vulnerabilities can be divided into remote attacks and non-remote attacks. Among them, remote attacks refer to attacks on vulnerabilities that can be completed by network attacks without touching the device or system. Non-remote attacks refer to attacks on vulnerabilities that require physical contact with the device or system. For example, inserting a solid-state drive into a device through the data communication method of the Universal Serial Bus (USB) to attack the device or system through physical interference.

[0069] It should be understood that in the process of constructing an attack chain regarding the first vulnerability and the second vulnerability, it does not mean that the attack chain must include the results of exploiting the first vulnerability, the conditions for exploiting the first vulnerability, the way of exploiting the first vulnerability, the results of exploiting the second vulnerability, the conditions for exploiting the second vulnerability, and the way of exploiting the second vulnerability. As long as the construction process can be completed, it can include one or more of them. It can be set according to actual conditions, and the embodiments of the present application do not limit this.

[0070] Figure 3 It is a flowchart of a method for constructing an attack chain between vulnerabilities provided in an embodiment of the present application.

[0071] For example, Figure 3 As shown, the method 300 includes the following implementation process:

[0072] When starting to build an attack chain between N (a positive integer) vulnerabilities, S301 is executed to obtain the exploitation result of vulnerability 1.

[0073] In a possible implementation, when the exploitation result of vulnerability 1 is a denial of service or other, the process of building the attack chain for vulnerability 1 is terminated. "Other" refers to situations other than the above three exploitation results, such as data tampering.

[0074] In a possible implementation, when the result of exploiting vulnerability 1 is information leakage or permission acquisition, S302 is executed to determine whether the information leakage or permission acquisition is related to the exploitation condition of vulnerability 2.

[0075] Optionally, the information leakage can be set to device information and / or network behavior information, which is not limited in the embodiments of the present application.

[0076] Optionally, permission acquisition can be set to ordinary permission or administrator permission, which is not limited in the embodiments of the present application.

[0077] In one possible scenario, the information leakage or permission acquisition of vulnerability 1 is not related to the exploitation conditions of vulnerability 2. Specifically, the information leakage is social relationship information, or the permission acquired is not required, which can indicate that the information leakage or permission acquisition is not related to the exploitation conditions of vulnerability 2, and the process of building the attack chain for vulnerability 1 and vulnerability 2 ends.

[0078] In another possible scenario, the information leakage or permission acquisition of vulnerability 1 is related to the exploitation condition of vulnerability 2. Specifically, the information leakage is device information and / or network behavior information, or the permission acquired is ordinary permission or administrator permission, which can indicate that the information leakage or permission acquisition is related to the exploitation condition of vulnerability 2. Then, S303 is executed to obtain the exploitation method of vulnerability 2, and an attack chain for vulnerability 1 and vulnerability 2 is constructed.

[0079] Furthermore, S304 is continued to be executed to obtain the exploitation result of vulnerability 2.

[0080] In a possible implementation, when the exploitation result of vulnerability 2 is a denial of service or other situations, the process of building the attack chain between the vulnerabilities is terminated.

[0081] In a possible implementation, when the result of exploiting vulnerability 2 is information leakage or permission acquisition, S305 is executed to determine whether the information leakage or permission acquisition is related to the exploitation condition of vulnerability 3.

[0082] Optionally, information leakage can be set to device information and / or network behavior information, which is not limited in the embodiments of the present application. Optionally, permission acquisition can be set to ordinary permission or administrator permission, which is not limited in the embodiments of the present application.

[0083] In one possible scenario, the information leakage or permission acquisition of vulnerability 2 is not related to the exploitation conditions of vulnerability 3. Specifically, the information leakage is social relationship information, or the permission acquired is not required, which can indicate that the information leakage or permission acquisition is not related to the exploitation conditions of vulnerability 3, and the process of building the attack chain for vulnerability 2 and vulnerability 3 ends.

[0084] In another possible scenario, the information leakage or permission acquisition of vulnerability 2 is related to the exploitation condition of vulnerability 3. Specifically, the information leakage is device information and / or network behavior information, or the permission acquired is ordinary permission or administrator permission, which can indicate that the information leakage or permission acquisition is related to the exploitation condition of vulnerability 3. Then, S306 is executed to obtain the exploitation method of vulnerability 3 and construct an attack chain for vulnerability 2 and vulnerability 3. Thus, the attack chain with the association relationship represented as "vulnerability 1-vulnerability 2-vulnerability 3" is obtained.

[0085] In an exemplary embodiment, it is also possible to determine whether the result of exploiting vulnerability 1 is related to the exploitation condition of vulnerability 3. If so, an attack chain whose association relationship can be expressed as "vulnerability 1-vulnerability 3" can be constructed.

[0086] By analogy, an attack chain between the above N vulnerabilities can be constructed in the above manner. The constructed attack chain can more comprehensively and three-dimensionally display the vulnerability exploitation relationship in the network target range and intuitively show the vulnerability of the network target range.

[0087] Figure 4 It is a flowchart of a method for constructing a network target range provided in an embodiment of the present application.

[0088] For example, Figure 4 As shown, the method 400 includes the following implementation process:

[0089] S401, obtain the attack chain.

[0090] Specifically, the above method successfully constructs an attack chain between vulnerabilities, and the attack chain needs to be obtained in the method of constructing the network target range. Exemplarily, the obtained attack chain can be expressed as: vulnerability 1-vulnerability 2, vulnerability 3-vulnerability 4-vulnerability 6, etc.

[0091] S402: construct the network target range according to the above attack chain.

[0092] Specifically, in the process of constructing a network target range, each acquired attack chain can be used as a target of the network target range. For example, vulnerability 1-vulnerability 2 is used as a target of the network target range, and vulnerability 3-vulnerability 4-vulnerability 6 is used as another target of the target range, thereby constructing the obtained network target range.

[0093] Optionally, after obtaining the constructed attack chain, the attack chain is used as the target of the network target range, and the cloud computing management platform (Openstack) technology is combined with the use of containers (Docker) and / or virtual machines to realize the construction of a virtual-real network target range, thereby obtaining a virtual-real network target range based on the above-mentioned attack chain idea.

[0094] For example, a developer needs to establish a vulnerability for file transfer protocol (FTP) upload. According to the above method, an attack chain between the first vulnerability and the second vulnerability in the FTP upload process is obtained, and the attack chain is reproduced in the network target range that needs to be built until the FTP upload process is completed. In this process, the obtained attack chain is used as the target of the network target range. The network target range can be reproduced using Docker and / or virtual machines and combined with Openstack technology to achieve the purpose of vulnerability exploitation.

[0095] It should be understood that in the constructed network range, there may be a first attack chain and a second attack chain, and there is no association between the first attack chain and the second attack chain. In other words, there may be multiple attack chains in a network range, and the multiple attack chains do not affect each other.

[0096] In summary, this application proposes a method for constructing an attack chain. By constructing an attack chain about a first vulnerability and a second vulnerability, the vulnerability exploitation relationship in the network range can be more comprehensively and three-dimensionally displayed, and the vulnerability of the network range can be intuitively displayed. A method for constructing a network range is also provided. By constructing a network range according to the obtained attack chain, the constructed network range can have a higher integrity, which is conducive to improving the user's operating experience.

[0097] Figure 5 It is a structural diagram of an attack chain construction device provided in an embodiment of the present application.

[0098] For example, Figure 5 As shown, the device 500 includes:

[0099] The first acquisition module 501 is used to obtain the exploitation result of the first vulnerability;

[0100] Determination module 502: used to determine whether the result of the exploitation of the first vulnerability is related to the exploitation condition of the second vulnerability;

[0101] The first construction module 503 is used to construct an attack chain regarding the first vulnerability and the second vulnerability when the result of the exploitation of the first vulnerability is related to the exploitation condition of the second vulnerability.

[0102] In a possible implementation, the judgment module 502 is specifically used to: when the result of the exploitation of the first vulnerability is information leakage or permission acquisition, judge whether the result of the exploitation of the first vulnerability is related to the exploitation condition of the second vulnerability.

[0103] In a possible implementation, the judgment module 502 is further used for: when the exploitation result of the first vulnerability is information leakage, determining the target information leaked by the first vulnerability; judging whether the exploitation condition of the second vulnerability can be obtained based on the target information; wherein, when the exploitation condition of the second vulnerability can be obtained based on the target information, determining that the exploitation result of the first vulnerability is related to the exploitation condition of the second vulnerability.

[0104] In a possible implementation, the judgment module 502 is further used for: when the result of exploiting the first vulnerability is permission acquisition, determining the permission type acquired by the first vulnerability; judging whether the conditions for exploiting the second vulnerability can be obtained according to the permission type; wherein, when the conditions for exploiting the second vulnerability can be obtained according to the permission type, determining that the result of exploiting the first vulnerability is related to the conditions for exploiting the second vulnerability.

[0105] In a possible implementation, the first construction module 503 is specifically used to construct an attack chain regarding the first vulnerability and the second vulnerability according to the exploitation result of the first vulnerability, the exploitation condition of the first vulnerability, the exploitation method of the first vulnerability, the exploitation result of the second vulnerability, the exploitation condition of the second vulnerability and the exploitation method of the second vulnerability.

[0106] Figure 6 This is a schematic diagram of the structure of a network range construction device provided in an embodiment of the present application.

[0107] For example, Figure 6 As shown, the device 600 includes:

[0108] The second acquisition module 601 is used to acquire an attack chain, wherein the attack chain is constructed according to the above method;

[0109] The second construction module 602 is used to construct the above-mentioned network target range according to the above-mentioned attack chain.

[0110] In a possible implementation, the second construction module 603 is specifically used to: determine each attack chain as a target of the above-mentioned network target range to construct the above-mentioned network target range.

[0111] Figure 7 It is a structural diagram of a server provided in an embodiment of the present application.

[0112] For example, Figure 7 As shown, the server 700 includes: a memory 710 and a processor 720, wherein the memory 710 stores an executable program code 740, and the processor 720 is used to call and execute the executable program code 740 to execute a method for constructing an attack chain or a method for constructing a network target range.

[0113] In this embodiment, the server can be divided into functional modules according to the above method example. For example, each functional module can be corresponded, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0114] In the case of dividing each functional module according to each function, the server may include: a first acquisition module, a judgment module, a first construction module, a second acquisition module, and a second construction module, etc. It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0115] The server provided in this embodiment is used to execute the above-mentioned attack chain construction method or network target range construction method, so it can achieve the same effect as the above-mentioned implementation method.

[0116] In the case of an integrated unit, the server may include a processing module and a storage module. The processing module may be used to control and manage the actions of the server. The storage module may be used to support the server in executing mutual program codes and data.

[0117] The processing module may be a processor or a controller, which may implement or execute various exemplary logic blocks, modules and circuits disclosed in the present application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module may be a memory.

[0118] This embodiment also provides a computer-readable storage medium, which stores a computer program code. When the computer program code runs on a computer, the computer executes the above-mentioned related method steps to implement a method for constructing an attack chain or a method for constructing a network target range in the above-mentioned embodiment.

[0119] This embodiment also provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the above-mentioned related steps to implement a method for constructing an attack chain or a method for constructing a network target range in the above-mentioned embodiment.

[0120] In addition, the server provided in the embodiments of the present application may specifically be a chip, a component or a module, and the server may include a connected processor and a memory; wherein the memory is used to store instructions, and when the server is running, the processor may call and execute instructions so that the chip executes a method for constructing an attack chain or a method for constructing a network target range in the above-mentioned embodiments.

[0121] Among them, the server, computer-readable storage medium, computer program product or chip provided in this embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0122] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0123] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0124] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for constructing an attack chain, characterized in that: The method comprises: Obtaining the exploitation result of the first vulnerability; Determining whether the result of exploiting the first vulnerability is related to the condition for exploiting the second vulnerability; When the result of exploiting the first vulnerability is related to the condition of exploiting the second vulnerability, an attack chain regarding the first vulnerability and the second vulnerability is constructed.

2. The method according to claim 1, characterized in that The determining whether the result of exploiting the first vulnerability is related to the condition of exploiting the second vulnerability includes: When the result of the exploitation of the first vulnerability is information leakage or permission acquisition, it is determined whether the result of the exploitation of the first vulnerability is related to the exploitation condition of the second vulnerability.

3. The method according to claim 2, characterized in that The determining whether the result of exploiting the first vulnerability is related to the condition of exploiting the second vulnerability includes: In a case where the result of exploiting the first vulnerability is information leakage, determining target information leaked by the first vulnerability; Determining whether an exploitation condition of the second vulnerability can be obtained according to the target information; Wherein, when the exploitation condition of the second vulnerability can be obtained according to the target information, it is determined that the exploitation result of the first vulnerability is related to the exploitation condition of the second vulnerability.

4. The method according to claim 2, characterized in that: The determining whether the result of exploiting the first vulnerability is related to the condition of exploiting the second vulnerability includes: When the result of exploiting the first vulnerability is permission acquisition, determining the type of permission acquired by the first vulnerability; Determining whether a condition for exploiting the second vulnerability can be obtained according to the permission type; Wherein, in a case where the exploitation condition of the second vulnerability can be obtained according to the permission type, it is determined that the exploitation result of the first vulnerability is related to the exploitation condition of the second vulnerability.

5. The method according to any one of claims 1 to 4, characterized in that: The constructing of the attack chain regarding the first vulnerability and the second vulnerability includes: An attack chain regarding the first vulnerability and the second vulnerability is constructed according to the exploitation result of the first vulnerability, the exploitation condition of the first vulnerability, the exploitation method of the first vulnerability, the exploitation result of the second vulnerability, the exploitation condition of the second vulnerability and the exploitation method of the second vulnerability.

6. A method for constructing a network range, characterized in that: The method comprises: Obtaining an attack chain, wherein the attack chain is constructed according to the method according to any one of claims 1 to 5; The network target range is constructed according to the attack chain.

7. The method according to claim 6, characterized in that The step of constructing the network target range according to the attack chain includes: Each attack chain is determined as a target of the network target range to construct the network target range.

8. An attack chain construction device, characterized in that: The device comprises: A first acquisition module, used to obtain the exploitation result of the first vulnerability; A determination module, used to determine whether the result of exploiting the first vulnerability is related to the condition for exploiting the second vulnerability; The first construction module is used to construct an attack chain about the first vulnerability and the second vulnerability when the exploitation result of the first vulnerability is related to the exploitation condition of the second vulnerability.

9. A device for constructing a network range, characterized in that: The device comprises: A second acquisition module, configured to acquire an attack chain, wherein the attack chain is constructed according to the method according to any one of claims 1 to 5; The second building module is used to build a network target range according to the attack chain.

10. A server, characterized in that: The server comprises: A memory for storing executable program codes; A processor, configured to call and run the executable program code from the memory, so that the server executes the attack chain construction method as described in any one of claims 1 to 5, or implements the network target range construction method as described in claim 6 or 7.

Images