CAPEC vulnerability association identification system based on ATTCK framework

Abstract

The invention discloses a method based on ATTamp; the invention discloses a CAPEC vulnerability association identification system of a CK framework, and relates to the technical field of network security. Comprising a data integration module, an attack path analysis engine module, a vulnerability association analysis engine module, a dynamic update and intelligence integration module and a visual display module which are connected in sequence. In combination with a CAPEC framework, deeper threat intelligence and defense suggestions are provided from a behavior mode and an attack path of an attacker. Meanwhile, latest vulnerability information is obtained in real time through a dynamic updating and intelligence integration module, the vulnerability management efficiency and the threat detection accuracy are improved by automatically analyzing the incidence relation between the attack path and the vulnerability, the incidence relation between the attack path and the vulnerability is displayed through a graphical interface, a user is helped to visually understand the full view of the threat, and the threatening effect is improved. And a vulnerability influence range and restoration suggestion information are provided.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more particularly to a CAPEC vulnerability correlation identification system based on the ATT&CK framework. Background Art

[0002] With the rapid development of the Internet, network security issues are becoming increasingly prominent. Existing vulnerability management and threat detection methods mostly rely on traditional vulnerability databases (such as CVE, CPE, CWE, etc.), but these methods have the following problems:

[0003] 1) Data dispersion: Vulnerability information is stored in different forms in different databases, making it difficult to conduct global cross-references and analysis. This dispersion makes it difficult for security teams to analyze vulnerabilities and attack paths, and it is impossible to form a unified security view; 2) Lack of in-depth understanding of attack behavior: Traditional methods mainly focus on the vulnerabilities themselves, while ignoring the attacker's behavior patterns and attack paths. This makes it difficult for security teams to identify potential risks from the attacker's perspective, and thus unable to effectively formulate defense strategies; 3) Inefficiency: Vulnerability correlation and analysis usually require a lot of manual operations or complex verification processes, which are resource-intensive and slow. This inefficiency is particularly evident when faced with a large number of vulnerabilities and complex attacks; 4) Lack of real-time performance: Existing methods make it difficult to update vulnerability information in real time, resulting in limitations such as insufficient timeliness and accuracy of data.

[0004] To address these challenges, improvements to existing methods are needed, including:

[0005] 1) A method is needed to integrate vulnerability information from various sources to form a unified knowledge base for global cross-reference and analysis; 2) A method is needed to provide more in-depth threat intelligence and defense recommendations based on attacker behavior patterns and attack paths; a method is needed to update vulnerability information in real time to ensure data timeliness and accuracy; and 3) A method is needed to automatically analyze the correlation between attack paths and vulnerabilities to improve the efficiency of vulnerability management and the accuracy of threat detection. These improvement requirements aim to overcome the limitations of existing vulnerability management and threat detection methods and enhance network security protection capabilities.

[0006] Therefore, it is an urgent problem for those skilled in the art to propose a CAPEC vulnerability correlation identification system based on the ATT&CK framework to solve the difficulties existing in the existing technology. Summary of the Invention

[0007] In view of this, the present invention provides a CAPEC vulnerability association identification system based on the ATT&CK framework to solve the technical problems existing in the prior art.

[0008] In order to achieve the above object, the present invention provides the following technical solutions:

[0009] A CAPEC vulnerability correlation identification system based on the ATT&CK framework includes a data integration module, an attack path analysis engine module, a vulnerability correlation analysis engine module, a dynamic update and intelligence integration module, and a visualization display module connected in sequence; wherein,

[0010] Data integration module: This module integrates the ATT&CK framework, CAPEC framework, and the standards of the CVE database, CPE database, and CWE database to form a unified knowledge base.

[0011] Attack Path Analysis Engine Module: Based on the tactical and method layers of the ATT&CK framework, it identifies attackers' goals and methods. In conjunction with the CAPEC framework, it analyzes the principles of attack techniques and identifies weaknesses. It also constructs an attack graph to display the nodes and path relationships of the attack path.

[0012] Vulnerability Correlation Analysis Engine Module: This module uses the CVE, CPE, and CWE databases to correlate attack techniques with vulnerabilities, identify the causes of vulnerabilities, and identify their impact. This platform maps vulnerabilities to attack techniques through structured data and relationship building.

[0013] Dynamic update and intelligence integration module: obtain the latest vulnerability information from the vulnerability database and update the knowledge base;

[0014] Visual display module: displays the relationship between attack paths and vulnerabilities through a graphical interface.

[0015] Optionally, the data integration module integrates the ATT&CK framework, CAPEC framework, and the standards of the CVE database, CPE database, and CWE database to form a unified knowledge base with the following specific contents:

[0016] It includes: initialization submodule, adaptation submodule, verification submodule, persistence submodule and monitoring submodule. Among them, the data integration module obtains data from different sources through the initialization submodule, including obtaining data from the CVE database, CPE database and CWE database through API and crawler.

[0017] Convert data in different formats into a unified standard format through the adapter module;

[0018] Verify the integrity and correctness of data through the verification submodule and filter out data that does not meet the requirements;

[0019] The persistence submodule stores the verified data in the graph database to support subsequent query and analysis operations.

[0020] The entire data integration process is monitored in real time through the monitoring sub-module.

[0021] The attack path analysis engine module, based on the tactics and methods layers of the ATT&CK framework, identifies the attacker's goals and methods. It also analyzes the principles of attack techniques and identifies weaknesses in conjunction with the CAPEC framework. By constructing an attack graph, it displays the nodes and path relationships of the attack path. The specific contents are as follows:

[0022] The tactical layer includes the various tactics employed by attackers, while the methodological layer includes the techniques and methods used to implement these tactics. The attack path analysis engine compares network behavior with the tactics and techniques in the ATT&CK framework to determine the attacker's goals and the means used to achieve them. After identifying the attacker's goals and methods, the CAPEC framework is further used to analyze the principles of the attack techniques and identify vulnerabilities.

[0023] Finally, the attack path analysis engine constructs an attack graph to intuitively display the nodes and path relationships of the attack path. The nodes in the attack graph represent the key elements of the attack target, attack method, and weaknesses in the system, while the path represents the attacker's attack route and logical relationship from one node to another.

[0024] Optionally, the vulnerability correlation analysis engine module uses the CVE database, CPE database, and CWE database to correlate attack techniques with vulnerabilities, identify the causes of vulnerabilities, and identify the impact of vulnerabilities. The specific content of mapping vulnerabilities and attack techniques is achieved through structured data and relationship construction.

[0025] The CVE database provides standardized vulnerability lists and detailed information, and is a key resource for identifying, documenting, and fixing vulnerabilities;

[0026] The CPE database maintains a standardized list of unique identifiers for hardware, operating systems, and applications, helping to identify software and hardware platforms affected by vulnerabilities.

[0027] The CWE database focuses on software weaknesses, classifies and describes various types of exploited software defects, and provides detailed information on weaknesses, providing an important basis for root cause analysis of vulnerabilities;

[0028] Automated technology is used to extract data from these databases. By building structured data and relationships, a mapping between vulnerabilities and attack techniques is constructed, generating a vulnerability association map that intuitively displays the complex relationship between vulnerabilities and attack techniques.

[0029] Optionally, the dynamic update and intelligence integration module obtains the latest vulnerability information from the vulnerability database. The specific content of the updated knowledge base is:

[0030] Use crawler technology to automatically capture the latest vulnerability data from NVD, CNVD vulnerability databases, GitHub, and OSV open source platforms at preset time intervals;

[0031] During the data capture process, data cleaning and formatting techniques are used to remove duplicate and invalid information, convert unstructured data into structured data, and compare and integrate it with the data in the internal knowledge base; at the same time, the dynamic update and intelligence integration module also has an intelligent update mechanism, which dynamically adjusts the crawler strategy according to the update frequency and importance of the data source, prioritizes obtaining high-risk vulnerability information, and updates the knowledge base in a timely manner.

[0032] Optionally, the visualization module displays the relationship between attack paths and vulnerabilities through a graphical interface, and the specific content is:

[0033] It includes attack path nodes, path relationships, and vulnerability information, while providing vulnerability impact range and repair suggestions. The graphical interface supports interactive operations, allowing users to easily query and filter specific attack paths and vulnerability information, thereby analyzing complex attack scenarios.

[0034] Optionally, a prediction module is also included. The specific contents of the prediction module are:

[0035] Based on the analysis results of historical attack events, a historical event feature library of attack targets, attack intentions, and techniques and tactics used is formed;

[0036] Utilize the historical event feature library and the used feature sequences of attack events that have not yet completed the implementation phase to perform similarity calculations and obtain attack events with similar feature sequences;

[0037] By combining the supply characteristics of similar historical attack events, we can predict the next attack behavior, thereby predicting the attack intent and scope of the attack event.

[0038] It can be seen from the above technical solution that, compared with the prior art, the present invention discloses a CAPEC vulnerability correlation identification system based on the ATT&CK framework, which has the following beneficial effects:

[0039] 1) The ATT&CK framework provides a comprehensive perspective on attack behavior, breaking down attack behaviors into easy-to-understand tactics and techniques, helping security teams analyze and respond to cyber threats more systematically.

[0040] 2) Using standardized language to describe attack behaviors facilitates rapid identification of attacker tactics and techniques, leading to more effective defense strategies. By integrating the CAPEC framework and vulnerability databases (such as CVE, CPE, and CWE), the system can correlate attack techniques with specific vulnerabilities, identify the root causes and impact of vulnerabilities, and provide deeper insights for vulnerability management.

[0041] 3) Supports real-time updates to ensure the timeliness and accuracy of data, helping security teams respond to emerging threats in a timely manner; in addition, the system identifies advanced threats through threat modeling and detection methods, assesses vulnerabilities in existing defense systems, optimizes security policies, and supports the integration of automation and intelligent platforms to improve the efficiency and accuracy of threat detection. These advantages work together to enable the system to more efficiently identify and respond to network threats and enhance overall network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0043] Figure 1 A structural diagram of a CAPEC vulnerability correlation identification system based on the ATT&CK framework provided by the present invention;

[0044] Figure 2 A correlation diagram of the attack path analysis engine and the vulnerability correlation analysis engine provided by the present invention;

[0045] Figure 3 This is an architectural diagram of the attack path analysis engine and vulnerability association analysis engine provided by the present invention. DETAILED DESCRIPTION

[0046] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0047] See also Figure 1 As shown, the present invention discloses a CAPEC vulnerability correlation identification system based on the ATT&CK framework, including a data integration module, an attack path analysis engine module, a vulnerability correlation analysis engine module, a dynamic update and intelligence integration module and a visualization display module connected in sequence; wherein,

[0048] Data integration module: This module integrates the ATT&CK framework, CAPEC framework, and the standards of the CVE database, CPE database, and CWE database to form a unified knowledge base.

[0049] Attack Path Analysis Engine Module: Based on the tactical and method layers of the ATT&CK framework, it identifies attackers' goals and methods. In conjunction with the CAPEC framework, it analyzes the principles of attack techniques and identifies weaknesses. It also constructs an attack graph to display the nodes and path relationships of the attack path.

[0050] Vulnerability Correlation Analysis Engine Module: This module uses the CVE, CPE, and CWE databases to correlate attack techniques with vulnerabilities, identify the causes of vulnerabilities, and identify their impact. This platform maps vulnerabilities to attack techniques through structured data and relationship building.

[0051] Dynamic update and intelligence integration module: obtain the latest vulnerability information from the vulnerability database and update the knowledge base;

[0052] Visual display module: displays the relationship between attack paths and vulnerabilities through a graphical interface.

[0053] Furthermore, the data integration module integrates the ATT&CK framework, CAPEC framework, and the standards of the CVE database, CPE database, and CWE database to form a unified knowledge base. The specific contents are as follows:

[0054] It includes: initialization submodule, adaptation submodule, verification submodule, persistence submodule and monitoring submodule. Among them, the data integration module obtains data from different sources through the initialization submodule, including obtaining data from the CVE database, CPE database and CWE database through API and crawler.

[0055] Convert data in different formats into a unified standard format through the adapter module;

[0056] For example, processing the data through an XML parser or a JSON parser.

[0057] Verify the integrity and correctness of data through the verification submodule and filter out data that does not meet the requirements;

[0058] The persistence submodule stores the verified data in the graph database to support subsequent query and analysis operations.

[0059] The entire data integration process is monitored in real time through the monitoring sub-module.

[0060] Specifically, it also includes knowledge graph construction, including entity recognition, relationship construction and RDF triple generation. Entity recognition is to identify entities such as CVE, CPE, CWE, etc. from text data through a preset entity recognition model. Relationship construction is to build relationships between entities based on predefined network security knowledge ontology. For example, "has_CVE_CPE" represents the relationship between CVE and CPE. RDF triple generation is to convert entities and relationships into RDF triples for building knowledge graphs. When building a knowledge graph, it is necessary to calculate the similarity between entities to determine the strength of the relationship between entities. The similarity calculation formula is expressed as:

[0061]

[0062] Among them, A and B are the feature vectors of two entities, and n is the dimension of the feature.

[0063] The knowledge graph consists of entities and relationships, represented as:

[0064] KG={(h,r,t)|h∈Entities,r∈Relations,t∈Entities} (2)

[0065] Among them, h is the head entity, r is the relation, and t is the tail entity.

[0066] When processing unstructured data, in order to select effective entity pairs, a sliding window mechanism can be used to select entity pairs within a certain distance range. The formula is:

[0067] SelectedPairs = {(e i ,e j )|distance(e i ,e j )≤Threshold} (3)

[0068] Among them, distance(e i ,e j ) is the number of characters between two entities, and Threshold is the preset threshold.

[0069] Specifically, through the above content, the data integration module can efficiently integrate the ATT&CK framework, CAPEC framework and CVE database, CPE database, and CWE database to form a unified knowledge base, support real-time updates, and ensure the timeliness and accuracy of the data.

[0070] Specifically, the data integration module includes data collection, cleaning, format conversion, processing and analysis, storage, ETL tools, data integration platforms, data warehouse technology, data lake technology, data fusion technology, and real-time monitoring. Data collection involves acquiring data through various channels, including internal enterprise systems or external databases. Data cleaning addresses issues in raw data, such as duplications, errors, or missing data, to ensure data accuracy and completeness. Data format conversion unifies data in different formats for subsequent processing and analysis. Data processing and analysis utilizes specialized tools to further process and analyze data and extract valuable information. Data storage stores processed data in a database or other system. ETL tools automate the extraction, cleaning, conversion, and loading of data. The data integration platform provides a comprehensive data integration solution, including data quality management and other functions. Data warehouse technology organizes and stores data by topic, making it suitable for analysis and decision support. Data lake technology stores various types of raw data, providing a flexible foundation for data integration. Data fusion technology integrates heterogeneous data to improve analytical accuracy and precision. Real-time monitoring ensures the correctness and timeliness of data flow, improving system stability and efficiency. These technologies work together to efficiently integrate data from different sources, forming a unified, high-quality data set to support subsequent query, analysis, and decision-making.

[0071] Furthermore, the attack path analysis engine module identifies the attacker's goals and methods based on the tactical layer and method layer of the ATT&CK framework. In combination with the CAPEC framework, it analyzes the principles of attack techniques and identifies weaknesses. By constructing an attack graph, the specific content of the nodes and path relationships of the attack path is displayed as follows:

[0072] The tactical layer includes the various tactics employed by attackers, while the methodological layer includes the techniques and methods used to implement these tactics. The attack path analysis engine compares network behavior with the tactics and techniques in the ATT&CK framework to determine the attacker's goals and the means used to achieve them. After identifying the attacker's goals and methods, the CAPEC framework is further used to analyze the principles of the attack techniques and identify vulnerabilities.

[0073] Finally, the attack path analysis engine constructs an attack graph to intuitively display the nodes and path relationships of the attack path. The nodes in the attack graph represent the key elements of the attack target, attack method, and weaknesses in the system, while the path represents the attacker's attack route and logical relationship from one node to another.

[0074] Specifically, the attack path analysis engine module builds an attack graph by combining tactical and technical analysis based on the ATT&CK framework with attack technology principle analysis based on the CAPEC framework, thereby achieving automated data pipeline and real-time updates.

[0075] When constructing an attack graph, it is necessary to calculate the similarity between entities to determine the strength of the relationship between them. The similarity calculation formula is shown in Formula (1), and the attack graph construction is shown in Formula (2). Based on the above, the attack path analysis engine module can efficiently identify and analyze attack paths.

[0076] Specifically, through the attack map, security analysts can clearly understand the attack paths that attackers may take, including the starting point, intermediate steps and final goal of the attack, and then formulate corresponding defense strategies in advance to effectively prevent potential attack risks.

[0077] Specifically, the ATT&CK framework is a knowledge base of adversarial tactics, techniques, and common sense based on real-world observational data. It converts known attacker behaviors into a structured list of tactics and techniques, and presents them in a matrix or other format. The tactical layer covers various tactics an attacker might employ, such as reconnaissance, resource exploitation, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, and influence.

[0078] Furthermore, the vulnerability correlation analysis engine module uses the CVE database, CPE database, and CWE database to correlate attack techniques with vulnerabilities, identify the causes of vulnerabilities, and the impact of vulnerabilities. The specific content of mapping vulnerabilities and attack techniques is achieved through structured data and relationship construction:

[0079] The CVE database provides standardized vulnerability lists and detailed information, and is a key resource for identifying, documenting, and fixing vulnerabilities;

[0080] The CPE database maintains a standardized list of unique identifiers for hardware, operating systems, and applications, helping to identify software and hardware platforms affected by vulnerabilities.

[0081] The CWE database focuses on software weaknesses, classifies and describes various types of exploited software defects, and provides detailed information on weaknesses, providing an important basis for root cause analysis of vulnerabilities;

[0082] Automated technology is used to extract data from these databases. By building structured data and relationships, a mapping between vulnerabilities and attack techniques is constructed, generating a vulnerability association map that intuitively displays the complex relationship between vulnerabilities and attack techniques.

[0083] For details, see Figure 2 The figure shows the relationship between the attack path analysis engine and the vulnerability correlation analysis engine.

[0084] See also Figure 3 The following is an architecture diagram of the attack path analysis engine and the vulnerability correlation analysis engine.

[0085] Specifically, the vulnerability association analysis engine module analyzes the root causes and impact range of the vulnerability based on the integration of multi-source data, converts the vulnerability information into structured data, and constructs the relationship between the vulnerability and the attack technology, thereby generating a vulnerability relationship map. First, when constructing the vulnerability association map, it is necessary to calculate the similarity between entities to determine the relationship strength between entities. The similarity calculation formula is shown in formula (1). Secondly, the vulnerability association map consists of entities and relationships as shown in formula (2). Thirdly, when processing unstructured data, in order to select valid entity pairs, a sliding window mechanism can be used to select entity pairs within a certain distance range, as shown in formula (3). Then, through the CPE database, the platform range affected by the vulnerability is determined, which is expressed as:

[0086] ImpactRange(v)={p|p∈CPE∧(v,p)∈VulnerabilityImpact}(4).

[0087] Specifically, we use automated technology to extract data from these databases, build a mapping between vulnerabilities and attack techniques through structured data and relationship construction, generate a vulnerability association map, and intuitively display the complex relationship between vulnerabilities and attack techniques, providing security teams with comprehensive vulnerability analysis and management tools to improve vulnerability management efficiency and accuracy.

[0088] Furthermore, the dynamic update and intelligence integration module obtains the latest vulnerability information from the vulnerability database and updates the knowledge base with the following specific contents:

[0089] Use crawler technology to automatically capture the latest vulnerability data from NVD, CNVD vulnerability databases, GitHub, and OSV open source platforms at preset time intervals;

[0090] During the data capture process, data cleaning and formatting techniques are used to remove duplicate and invalid information, convert unstructured data into structured data, and compare and integrate it with the data in the internal knowledge base; at the same time, the dynamic update and intelligence integration module also has an intelligent update mechanism, which dynamically adjusts the crawler strategy according to the update frequency and importance of the data source, prioritizes obtaining high-risk vulnerability information, and updates the knowledge base in a timely manner.

[0091] Specifically, crawler technology can automatically obtain data from specified URLs and parse content in HTML or JSON format. At the same time, it can obtain vulnerability data from open source platforms such as GitHub and OSV through API interfaces to ensure data diversity and comprehensiveness. It converts data obtained from different sources into a unified standard format, verifies the integrity and correctness of the data, and filters out data that does not meet the requirements to ensure data quality and reliability. Through scheduled tasks or event triggering mechanisms, it regularly updates the data in the knowledge base and integrates data from different sources to form a unified knowledge base. It can resolve data conflicts and duplications, monitor the data update process, ensure the correctness and timeliness of data flow, and thus improve the stability and efficiency of the system.

[0092] The data update frequency is expressed as:

[0093]

[0094] Among them, Update Interval is the interval between two updates.

[0095] The timeliness of data can be expressed by the update delay:

[0096] Timeliness = Current Time - Last Update Time (6)

[0097] The accuracy of the data can be expressed by the verification pass rate:

[0098]

[0099] Among them, NumberofValidDataPoints is the number of valid data points that have passed the verification, and TotalNumberofDataPoints is the total number of data points.

[0100] Specifically, through the above content, the dynamic update and intelligence integration module can efficiently obtain and update vulnerability information, ensure the timeliness and accuracy of the data, and provide the security team with the latest threat intelligence and vulnerability management support.

[0101] Furthermore, the visualization module displays the relationship between attack paths and vulnerabilities through a graphical interface.

[0102] It includes attack path nodes, path relationships, and vulnerability information, while providing vulnerability impact range and repair suggestions. The graphical interface supports interactive operations, allowing users to easily query and filter specific attack paths and vulnerability information, thereby analyzing complex attack scenarios.

[0103] For example, users can filter the displayed content by entering keywords and selecting specific attack targets or methods. Users are allowed to drill down to view detailed information on specific attack paths or vulnerabilities, while supporting aggregate analysis to grasp the attack trends and vulnerability distribution as a whole. Layout algorithms (such as force-directed layout, hierarchical layout, etc.) are used to optimize the display of graphics, making the display of attack paths and vulnerability information more intuitive and clear. Color and icon coding are used to distinguish different types of entities and relationships, such as using different colors to represent vulnerabilities of different severity, and using different icons to represent different attack methods. Dynamic data binding technology is used to ensure that the graphical interface can reflect the latest data in the knowledge base in real time. When the data in the knowledge base is updated, the interface can automatically refresh the displayed content. And through incremental updates, only the changed parts are updated, reducing resource consumption and improving update efficiency.

[0104] In the graphical display of the attack path, key nodes can be highlighted by calculating the centrality of the nodes. Node centrality can be measured using metrics such as degree centrality, closeness centrality, or betweenness centrality. The degree centrality calculation formula is:

[0105]

[0106] Here, deg(v) is the degree of node v (i.e., the number of edges directly connected to the node), and n is the total number of nodes in the graph.

[0107] In the attack path display, the path length can represent the number of steps required for the attack to go from the starting point to the end point. The formula for calculating the path length is:

[0108]

[0109] Among them, v i and v j are the starting and ending points of the path, e k is the kth edge in the path, weight(e k ) is the edge e k The weight of (indicates the difficulty of attack), m is the number of edges in the path.

[0110] When displaying attack paths and vulnerability information, we can help users discover potential associations by calculating the similarity between different attack paths or vulnerabilities. The similarity calculation is shown in formula (1). When assessing the impact range of a vulnerability, we can use information entropy to measure the uncertainty of vulnerability information. The information entropy calculation formula is:

[0111]

[0112] Among them, X is a random variable, which represents the impact range of the vulnerability, P(x i) is the vulnerability impact range and its value is x i probability.

[0113] Specifically, by using advanced data visualization technology, the complex relationship between attack paths and vulnerabilities can be displayed in a clear and intuitive graphical form, greatly improving users' understanding and analysis of network security threats and providing strong support for security decision-making.

[0114] Furthermore, it also includes a prediction module, the specific contents of the prediction module are:

[0115] Based on the analysis results of historical attack events, a historical event feature library of attack targets, attack intentions, and techniques and tactics used is formed;

[0116] Utilize the historical event feature library and the used feature sequences of attack events that have not yet completed the implementation phase to perform similarity calculations and obtain attack events with similar feature sequences;

[0117] By combining the supply characteristics of similar historical attack events, we can predict the next attack behavior, thereby predicting the attack intent and scope of the attack event.

[0118] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0119] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A CAPEC vulnerability correlation identification system based on the ATT&CK framework, characterized by: It includes a data integration module, an attack path analysis engine module, a vulnerability correlation analysis engine module, a dynamic update and intelligence integration module, and a visualization display module connected in sequence; among them, Data integration module: This module integrates the ATT&CK framework, CAPEC framework, and the standards of the CVE database, CPE database, and CWE database to form a unified knowledge base. Attack Path Analysis Engine Module: Based on the tactical and method layers of the ATT&CK framework, it identifies attackers' goals and methods. In conjunction with the CAPEC framework, it analyzes the principles of attack techniques and identifies weaknesses. It also constructs an attack graph to display the nodes and path relationships of the attack path. Vulnerability Correlation Analysis Engine Module: This module uses the CVE, CPE, and CWE databases to correlate attack techniques with vulnerabilities, identify the causes of vulnerabilities, and identify their impact. This platform maps vulnerabilities to attack techniques through structured data and relationship building. Dynamic update and intelligence integration module: obtain the latest vulnerability information from the vulnerability database and update the knowledge base; Visual display module: displays the relationship between attack paths and vulnerabilities through a graphical interface.

2. A CAPEC vulnerability correlation identification system based on the ATT&CK framework according to claim 1, characterized in that: The data integration module integrates the ATT&CK framework, CAPEC framework, and the standards of the CVE database, CPE database, and CWE database to form a unified knowledge base with the following specific contents: It includes: initialization submodule, adaptation submodule, verification submodule, persistence submodule and monitoring submodule. Among them, the data integration module obtains data from different sources through the initialization submodule, including obtaining data from the CVE database, CPE database and CWE database through API and crawler. Convert data in different formats into a unified standard format through the adapter module; Verify the integrity and correctness of data through the verification submodule and filter out data that does not meet the requirements; The persistence submodule stores the verified data in the graph database to support subsequent query and analysis operations. The entire data integration process is monitored in real time through the monitoring sub-module.

3. A CAPEC vulnerability correlation identification system based on the ATT&CK framework according to claim 1, characterized in that: The attack path analysis engine module uses the tactical and method layers of the ATT&CK framework to identify attackers' goals and methods. It also uses the CAPEC framework to analyze the principles of attack techniques and identify weaknesses. By constructing an attack graph, it displays the nodes and path relationships of the attack path. The specific contents are as follows: The tactical layer includes the various tactics employed by attackers, while the methodological layer includes the techniques and methods used to implement these tactics. The attack path analysis engine compares network behavior with the tactics and techniques in the ATT&CK framework to determine the attacker's goals and the means used to achieve them. After identifying the attacker's goals and methods, the CAPEC framework is further used to analyze the principles of the attack techniques and identify vulnerabilities. Finally, the attack path analysis engine constructs an attack graph to intuitively display the nodes and path relationships of the attack path. The nodes in the attack graph represent the key elements of the attack target, attack method, and weaknesses in the system, while the path represents the attacker's attack route and logical relationship from one node to another.

4. A CAPEC vulnerability correlation identification system based on the ATT&CK framework according to claim 1, characterized in that: The vulnerability correlation analysis engine module uses the CVE database, CPE database, and CWE database to correlate attack techniques with vulnerabilities, identify the causes of vulnerabilities, and identify the impact of vulnerabilities. The specific contents of mapping vulnerabilities and attack techniques are achieved through structured data and relationship construction: The CVE database provides standardized vulnerability lists and detailed information, and is a key resource for identifying, documenting, and fixing vulnerabilities; The CPE database maintains a standardized list of unique identifiers for hardware, operating systems, and applications, helping to identify software and hardware platforms affected by vulnerabilities. The CWE database focuses on software weaknesses, classifies and describes various types of exploited software defects, and provides detailed information on weaknesses, providing an important basis for root cause analysis of vulnerabilities; Automated technology is used to extract data from these databases. By building structured data and relationships, a mapping between vulnerabilities and attack techniques is constructed, generating a vulnerability association map that intuitively displays the complex relationship between vulnerabilities and attack techniques.

5. A CAPEC vulnerability correlation identification system based on the ATT&CK framework according to claim 1, characterized in that: The dynamic update and intelligence integration module obtains the latest vulnerability information from the vulnerability database. The specific content of the updated knowledge base is as follows: Use crawler technology to automatically capture the latest vulnerability data from NVD, CNVD vulnerability databases, GitHub, and OSV open source platforms at preset time intervals; During the data capture process, data cleaning and formatting techniques are used to remove duplicate and invalid information, convert unstructured data into structured data, and compare and integrate it with the data in the internal knowledge base; at the same time, the dynamic update and intelligence integration module also has an intelligent update mechanism, which dynamically adjusts the crawler strategy according to the update frequency and importance of the data source, prioritizes obtaining high-risk vulnerability information, and updates the knowledge base in a timely manner.

6. A CAPEC vulnerability correlation identification system based on the ATT&CK framework according to claim 1, characterized in that: The visualization module uses a graphical interface to display the relationship between attack paths and vulnerabilities. It includes attack path nodes, path relationships, and vulnerability information, while providing vulnerability impact range and repair suggestions. The graphical interface supports interactive operations, allowing users to easily query and filter specific attack paths and vulnerability information, thereby analyzing complex attack scenarios.

7. A CAPEC vulnerability correlation identification system based on the ATT&CK framework according to claim 1, characterized in that: It also includes a prediction module, the specific contents of the prediction module are: Based on the analysis results of historical attack events, a historical event feature library of attack targets, attack intentions, and techniques and tactics used is formed; Utilize the historical event feature library and the used feature sequences of attack events that have not yet completed the implementation phase to perform similarity calculations and obtain attack events with similar feature sequences; By combining the supply characteristics of similar historical attack events, we can predict the next attack behavior, thereby predicting the attack intent and scope of the attack event.

Images