Improved MulVAL-based attack path intelligent recommendation system

Abstract

The invention discloses an attack path intelligent recommendation system based on improved MulVAL. The system comprises a network environment information acquisition module, an interaction rule module, a security configuration information acquisition module, a reasoning module and an ATTamp; according to the attack path recommendation system of the CK mapping module and the evaluation module, network description information is perfected by incorporating network routing information, security configuration information such as a firewall and host configuration information into a reasoning strategy, the accuracy of attack path planning can be effectively improved, and in addition, through a high-level attack graph model and a middle-level ATTamp, a high-level ATTamp model and a high-level ATTamp model, a high-level ATTamp model and a high-level ATTamp model are integrated. The CK framework and a low-layer vulnerability analysis knowledge base are combined to construct a multi-level threat analysis mode, attack path analysis under a global view angle and a microscopic view angle is provided for a user, and the availability of the system is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of information security, and in particular relates to an attack path intelligent recommendation system based on improved MulVAL. Background Art

[0002] Attack path reasoning refers to the process of analyzing information such as vulnerabilities, system configuration, network environment, and network topology that an attacker may exploit, to deduce the potential attack path of an attacker from the initial intrusion to the final target. Its core goal is to identify the multi-step attack process that an attacker may take. At present, the mainstream attack path reasoning technology is divided into two major directions: the first category is rule-based path reasoning technology represented by MuLVAL. The reasoning system performs chain reasoning based on facts based on reasoning rules written by humans or machines, and gradually chain reasoning out all possible attack paths from the starting node to the target node; the second category is a technology derived from the fusion of artificial intelligence and security reasoning represented by the security big model. Attack path reasoning is essentially a reasoning problem, and neural networks have powerful reasoning capabilities. They can train security big models dedicated to the field of path reasoning based on a large amount of APT data, various security knowledge bases, and other data.

[0003] MulVAL (Multistep Vulnerability Analysis Logic) is an attack path analysis tool based on vulnerability reasoning rules. It can simulate the process of attackers exploiting vulnerabilities and identify potential security risks in network systems. The multi-step reasoning model used by MulVAL can perform attack path reasoning based on given network topology and vulnerability information. The traditional MulVAL system still has certain limitations when dealing with complex and dynamic network environments, including a relatively simplified reasoning process and the inability to reflect changes in network topology and configuration in a timely manner.

[0004] The path recommendation system based on a large model can learn the potential correlation between the attacker's behavior pattern and the attack path from historical attack data by training a large-scale deep learning model. The large model can identify the attacker's potential action trajectory and strategy in a complex network environment and generate more accurate attack path predictions. This not only improves the accuracy of attack path reasoning, but also enhances the ability to predict unknown attack methods.

[0005] In CN118278013A, a method for generating MulVAL interaction rules using machine learning is disclosed. The method focuses on combining artificial intelligence technology to efficiently and accurately generate interaction rules. However, most of the rules generated by this method are vulnerability reasoning rules, and do not include routing reasoning rules. When applied, the connectivity problem between network nodes is ignored, resulting in limited accuracy of the prediction results. In CN118631581A, a risk assessment method based on a hidden Markov model is disclosed. On the basis of the original attack graph generated by the MulVAL framework, a vulnerability scoring system is established, and the Bayesian method is used to evaluate the value of each node on the attack path, and a hidden Markov model is established to calculate the most likely attack path. This method is based on the attack path that has been generated to further deduce the best attack path, and does not focus on the generation process of the original attack graph. In CN117459246A, a Bayesian-based risk assessment method is disclosed. This method also makes further recommendations for the best attack path based on the original attack graph generated by MulVAL, and does not focus on the generation process of the original attack graph.

[0006] By analyzing the existing attack path analysis methods, we can find that the existing technologies mainly have the following three problems: First, the authenticity is insufficient. Network environment information faces the problem of insufficient "information width", that is, the coverage of network information included in the reasoning system is too narrow. At present, only vulnerability information and network topology information are included in the reasoning system, ignoring the connectivity problem between network nodes. It is often assumed that nodes are reachable. However, in actual scenarios, due to the existence of firewalls and routers, the reachability between nodes needs to be inferred based on the configuration of routers and firewalls, and does not include network routing information, firewall configuration information, host configuration information, etc., making the results inferred based on limited information often difficult to withstand the test of accuracy.

[0007] The second is insufficient effectiveness. The supported attack types also face the problem of insufficient coverage, that is, the current vulnerability inference rules can only infer some types of attack methods, making it impossible to effectively deal with other types of attack methods.

[0008] The third is the lack of comprehensibility. The visualization of the inference results is difficult to fully understand. The current attack path inference technology often uses vulnerability attack graphs for visualization. Since the attack graph is an advanced threat modeling technology, it cannot focus on more detailed and underlying technical means. The attack path provided is often limited to a rough macro level, that is, the granularity is large, and the understanding of it often remains on the surface and fails to reflect the technical details. Summary of the invention

[0009] In view of this, the present invention provides an attack path intelligent recommendation system based on improved MulVAL, which realizes accurate attack path planning based on multi-source data.

[0010] The invention provides an attack path intelligent recommendation system based on improved MulVAL, comprising: a network environment information collection module, an interaction rule module, a security configuration information collection module, a reasoning module, an ATT&CK mapping module and an evaluation module; The network environment information collection module is used to extract host information, service information and vulnerability information from the target network and input this information into the inference module. The host information includes the host open ports, host IP and MAC address. The service information refers to the services deployed on the target host. The vulnerability information is used to describe the vulnerability information existing on the target host. The interactive rule module is used to store vulnerability reasoning rules and node reachability reasoning rules, wherein the node reachability reasoning rules are used to reason about the real connectivity between network nodes, and the vulnerability reasoning rules are used to perform intelligent reasoning on various types of attacks, and send the vulnerability reasoning rules and node reachability reasoning rules to the reasoning module; The security configuration information collection module is used to extract the firewall configuration information and routing table information in the target network environment and send the collected information to the inference module; The reasoning module includes the MulVAL reasoning engine and the vulnerability attack graph submodule. The MulVAL reasoning engine performs path reasoning on the attack target based on the output data of the network environment information collection module, the interaction rule module and the security configuration information collection module. The vulnerability attack graph submodule is used to generate an attack graph based on the results of path reasoning. The ATT&CK mapping module is used to provide perspective conversion. The attack graph generated by the reasoning module is processed by the ATT&CK mapping module to establish a mapping between the low-dimensional vulnerability attack graph perspective and the high-dimensional attack chain perspective; the evaluation module is used to provide vulnerability-based CVSS evaluation function, and determine the optimal attack path through evaluation and make recommendations.

[0011] Furthermore, the vulnerability information includes CVE number, vulnerability exploitation method and vulnerability impact.

[0012] Furthermore, the network environment information acquisition module realizes the fusion and analysis of security configuration information and host configuration information by constructing a multi-source data fusion unit. The multi-source data fusion unit includes a real-time data extraction submodule, an information screening submodule based on expert knowledge, and a data formatting submodule. The information screening submodule based on expert knowledge is used to determine highly relevant and highly timely data based on expert knowledge, and regards non-highly relevant and highly timely data as secondary data that can be ignored. A data acquisition table is constructed based on the determined highly relevant and highly timely data, and the data acquisition table is used to determine the range of information that needs to be extracted from the shooting range environment; the real-time data extraction submodule is used to provide an interface for real-time data collection to extract the required information from the network environment at a fixed frequency and based on the data collection table; the data formatting submodule is used to convert the data extracted by the real-time data extraction submodule into information described in the form of Prolog predicates using a formatting algorithm.

[0013] Furthermore, a static rule extension system based on the ATT&CK framework is used to extend the vulnerability reasoning rules and node reachability reasoning rules. The specific method is as follows: first, the attack chain is split based on the ATT&CK framework, and the attack process is divided into different attack stages; then, condition analysis and result analysis are performed on each attack stage. The attack conditions of each attack stage are obtained through condition analysis to ensure that the attacker can enter the attack stage and perform attack actions. The possible attack results of the attack operations in the current attack stage are analyzed through result analysis; finally, based on the obtained attack conditions and attack results of each attack stage, the extended MulVAL vulnerability reasoning rules and route reachability reasoning rules are constructed.

[0014] Furthermore, the attack phases include reconnaissance, initial access, execution, persistence, privilege escalation, credential access, lateral movement, collection, command and control, and attack phases.

[0015] Furthermore, the attack conditions include network environment, system configuration, initial permissions and known vulnerabilities.

[0016] Furthermore, the attack results include: data leakage and theft, system control and privilege escalation, and service interruption and destruction.

[0017] Furthermore, a multi-level threat modeling approach is used to achieve the mapping between the low-dimensional vulnerability attack graph perspective and the high-dimensional attack chain perspective, including data extraction and classification, mapping rule design and mapping algorithm design, wherein data extraction and classification are used to provide an interface for collecting CVE data and ATT&CK framework data, and classify them according to the impact of the vulnerabilities; mapping rule design is used to establish a mapping relationship between CVE vulnerability entries and attack methods provided by the ATT&CK framework based on expert knowledge, to form a vulnerability and attack method mapping table; mapping algorithm design is used to establish a mapping algorithm based on the vulnerability and attack method mapping table to achieve automated batch mapping. Beneficial Effects

[0018] The present invention constructs an attack path recommendation system including a network environment information collection module, an interaction rule module, a security configuration information collection module, a reasoning module, an ATT&CK mapping module and an evaluation module. By incorporating network routing information, firewall and other security configuration information and host configuration information into the reasoning strategy, the network description information is improved, which can effectively improve the accuracy of attack path planning. In addition, by combining the high-level attack graph model, the middle-level ATT&CK framework and the low-level vulnerability analysis knowledge base to construct a multi-level threat analysis method, users are provided with attack path analysis from a global perspective and a micro perspective, thereby improving the availability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of the system architecture of an attack path intelligent recommendation system based on improved MulVAL provided by the present invention.

[0020] Figure 2 A schematic diagram of a multi-source data fusion unit in an attack path intelligent recommendation system based on improved MulVAL provided by the present invention.

[0021] Figure 3 A schematic diagram of the rule expansion process in an attack path intelligent recommendation system based on improved MulVAL provided by the present invention.

[0022] Figure 4 A schematic diagram of a multi-level threat modeling process in an attack path intelligent recommendation system based on improved MulVAL provided by the present invention. DETAILED DESCRIPTION

[0023] The present invention is described in detail below with reference to the accompanying drawings and with reference to the embodiments.

[0024] The present invention provides an attack path intelligent recommendation system based on improved MulVAL, the system architecture is as follows: Figure 1As shown, it includes: network environment information collection module, interaction rule module, security configuration information collection module, reasoning module, ATT&CK mapping module and evaluation module.

[0025] Among them, the network environment information collection module is used to extract host information, service information and vulnerability information from the target network and input this information into the MulVAL inference engine of the inference module. The host information includes but is not limited to the host open ports, host IP and MAC address information, etc. Service information refers to the services deployed on the target host, such as web services, etc. Vulnerability information is used to describe the vulnerability information existing on the target host, such as CVE number, vulnerability exploitation method, vulnerability impact and other information.

[0026] In order to further improve the completeness and accuracy of risk assessment, the present invention realizes the fusion and analysis of network routing information, firewall and other security configuration information, and host configuration information by constructing a multi-source data fusion unit in the network environment information collection module, so as to provide more comprehensive input for attack reasoning, such as Figure 2 As shown, the multi-source data fusion unit includes a real-time data extraction submodule, an information screening submodule based on expert knowledge, and a data formatting submodule, wherein the information screening submodule based on expert knowledge is used to determine highly relevant and time-sensitive data based on expert knowledge, and treats non-highly relevant and time-sensitive data as secondary data that can be ignored, and constructs a data collection table based on the determined highly relevant and time-sensitive data, and the data collection table is used to determine the range of information that needs to be extracted from the shooting range environment; the real-time data extraction submodule is used to provide an interface for real-time data collection to extract the required information from the network environment at a fixed frequency and based on the data collection table; the data formatting submodule is used to convert the data extracted by the real-time data extraction submodule into a description in the form of a Prolog predicate using a formatting algorithm. Specifically, the data extracted by the real-time data extraction submodule is usually described in XML or other formats, and the present invention converts it into a representation of a Prolog predicate, which is a general format used to represent data in Mulval.

[0027] The interactive rule module is used to store vulnerability reasoning rules and node reachability reasoning rules. Node reachability reasoning rules are used to reason about the real connectivity between network nodes, and vulnerability reasoning rules are used to reason about various types of attacks. The vulnerability reasoning rules and node reachability reasoning rules are sent to the MulVAL reasoning engine of the reasoning module. The static rule extension system based on the ATT&CK framework is used to implement the extension of vulnerability reasoning rules and node reachability reasoning rules.

[0028] Among them, the static rule extension system based on the ATT&CK framework is used to implement the expansion of vulnerability reasoning rules and node reachability reasoning rules. The process is as follows: Figure 3 As shown in the figure, the specific method is as follows: first, the attack chain is split based on the ATT&CK framework, and a complete attack process is split into different attack stages, including initial access, execution, persistence, privilege escalation and lateral movement; then, condition analysis and result analysis are performed on each attack stage, and the attack conditions of each attack stage are obtained through condition analysis to ensure that the attacker can enter the attack stage and perform attack actions, where the attack conditions include network environment, system configuration, initial permissions and known vulnerabilities. The attack results that may be generated by the attack operation of the current attack stage are analyzed through result analysis, where the attack results include but are not limited to: data leakage and theft, system control and privilege escalation, and service interruption and destruction; finally, based on the attack conditions and attack results of each attack stage obtained by analysis, the extended MulVAL vulnerability inference rules and route reachability inference rules are constructed.

[0029] The security configuration information collection module is used to extract the firewall configuration information and routing table information in the target network environment, and send the collected information to the MulVAL reasoning engine of the reasoning module, using multi-source data fusion technology to implement the information collection module.

[0030] The reasoning module includes the MulVAL reasoning engine and the vulnerability attack graph submodule. The MulVAL reasoning engine performs path reasoning on the attack target based on the output data of the network environment information collection module, the interaction rule module and the security configuration information collection module. The connectivity between any two nodes in the target network environment can be inferred based on the firewall configuration information and routing table information combined with the node reachability reasoning rules in the interaction rule module. The vulnerability attack graph submodule is used to generate an attack graph based on the results of path reasoning.

[0031] The ATT&CK mapping module is used to provide perspective conversion. The attack graph generated by the reasoning module is processed by the ATT&CK mapping module to establish a mapping between the low-dimensional vulnerability attack graph perspective and the high-dimensional attack chain perspective. The ATT&CK mapping module understands the entire attack process from the perspective of vulnerability exploitation, and uses a multi-level threat modeling method to achieve the mapping between the low-dimensional vulnerability attack graph perspective and the high-dimensional attack chain perspective.

[0032] Among them, a multi-level threat modeling method is used to achieve the mapping between the low-dimensional vulnerability attack graph perspective and the high-dimensional attack chain perspective. The processing method is as follows Figure 4As shown, it includes data extraction and classification, mapping rule design and mapping algorithm design. Data extraction and classification are used to provide an interface for collecting CVE data and ATT&CK framework data, and classify them according to the impact of the vulnerability; mapping rule design is used to establish a mapping relationship between CVE vulnerability entries and attack methods provided by the ATT&CK framework based on expert knowledge, forming a vulnerability and attack method mapping table; mapping algorithm design is used to establish a mapping algorithm based on the vulnerability and attack method mapping table to achieve automated batch mapping to improve mapping efficiency. By using this algorithm, an attack chain model from a macro perspective can be generated.

[0033] The assessment module is used to provide vulnerability-based CVSS assessment functions and make recommendations by determining the optimal attack path through assessment.

[0034] Finally, it should be noted that it is obvious that those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

[0035] The above is only an example of implementation of the present invention, but it cannot be used to limit the scope of the present invention. Any structural changes made according to the present invention, as long as they do not lose the essence of the present invention, should be regarded as falling within the scope of protection of the present invention and being restricted. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process and related instructions of the method described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0036] The term "comprise" or any other similar term is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus / method that comprises a list of elements includes not only those elements but also other elements not expressly listed or inherent to such process, method, article, or apparatus / method.

[0037] So far, the technical solutions of the present invention have been described in conjunction with the further embodiments shown in the accompanying drawings, but it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0038] In summary, the above are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An attack path intelligent recommendation system based on improved MulVAL, characterized in that: include: Network environment information collection module, interaction rule module, security configuration information collection module, reasoning module, ATT&CK mapping module and evaluation module; The network environment information collection module is used to extract host information, service information and vulnerability information from the target network and input this information into the inference module. The host information includes the host open ports, host IP and MAC address. The service information refers to the services deployed on the target host. The vulnerability information is used to describe the vulnerability information existing on the target host. The interactive rule module is used to store vulnerability reasoning rules and node reachability reasoning rules, wherein the node reachability reasoning rules are used to reason about the real connectivity between network nodes, and the vulnerability reasoning rules are used to reason about various types of attacks, and the vulnerability reasoning rules and node reachability reasoning rules are sent to the reasoning module; The security configuration information collection module is used to extract the firewall configuration information and routing table information in the target network environment and send the collected information to the inference module; The reasoning module includes the MulVAL reasoning engine and the vulnerability attack graph submodule. The MulVAL reasoning engine performs path reasoning on the attack target based on the output data of the network environment information collection module, the interaction rule module and the security configuration information collection module. The vulnerability attack graph submodule is used to generate an attack graph based on the results of path reasoning. The ATT&CK mapping module is used to provide perspective conversion. The attack graph generated by the reasoning module is processed by the ATT&CK mapping module to establish a mapping between the low-dimensional vulnerability attack graph perspective and the high-dimensional attack chain perspective; the evaluation module is used to provide vulnerability-based CVSS evaluation function, and determine the optimal attack path through evaluation and make recommendations.

2. The attack path intelligent recommendation system according to claim 1, characterized in that: The vulnerability information includes CVE number, vulnerability exploitation method and vulnerability impact.

3. The attack path intelligent recommendation system according to claim 1, characterized in that: The network environment information acquisition module realizes the fusion and analysis of security configuration information and host configuration information by constructing a multi-source data fusion unit. The multi-source data fusion unit includes a real-time data extraction submodule, an information screening submodule based on expert knowledge, and a data formatting submodule. The information screening submodule based on expert knowledge is used to determine highly relevant and highly timely data based on expert knowledge, and regards non-highly relevant and highly timely data as secondary data that can be ignored. A data collection table is constructed based on the determined highly relevant and highly timely data, and the data collection table is used to determine the range of information that needs to be extracted from the shooting range environment; the real-time data extraction submodule is used to provide an interface for real-time data collection to extract the required information from the network environment at a fixed frequency and based on the data collection table; the data formatting submodule is used to convert the data extracted by the real-time data extraction submodule into information described in the form of Prolog predicates using a formatting algorithm.

4. The attack path intelligent recommendation system according to claim 1, characterized in that: A static rule extension system based on the ATT&CK framework is used to extend the vulnerability inference rules and node reachability inference rules. The specific method is as follows: first, the attack chain is split based on the ATT&CK framework, and the attack process is divided into different attack stages; then, condition analysis and result analysis are performed on each attack stage. The attack conditions of each attack stage are obtained through condition analysis to ensure that the attacker can enter the attack stage and perform attack actions; the possible attack results of the attack operation in the current attack stage are analyzed through result analysis; finally, based on the obtained attack conditions and attack results of each attack stage, the extended MulVAL vulnerability inference rules and route reachability inference rules are constructed.

5. The attack path intelligent recommendation system according to claim 4, characterized in that: The attack phases include reconnaissance, initial access, execution, persistence, privilege escalation, credential access, lateral movement, collection, command and control, and exploitation.

6. The attack path intelligent recommendation system according to claim 4, characterized in that: The attack conditions include network environment, system configuration, initial permissions and known vulnerabilities.

7. The attack path intelligent recommendation system according to claim 4, characterized in that: The attack results include: data leakage and theft, system control and privilege escalation, and service interruption and destruction.

8. The attack path intelligent recommendation system according to claim 1, characterized in that: A multi-level threat modeling approach is used to achieve the mapping between the low-dimensional vulnerability attack graph perspective and the high-dimensional attack chain perspective, including data extraction and classification, mapping rule design and mapping algorithm design. Among them, data extraction and classification are used to provide an interface for collecting CVE data and ATT&CK framework data, and classify them according to the impact of the vulnerability; mapping rule design is used to establish a mapping relationship between CVE vulnerability entries and attack methods provided by the ATT&CK framework based on expert knowledge, forming a vulnerability and attack method mapping table; mapping algorithm design is used to establish a mapping algorithm based on the vulnerability and attack method mapping table to achieve automated batch mapping.

Images