Method, device, computing device and storage medium for constructing attack and defense knowledge graph

Abstract

The present invention provides a method, device, computing device and storage medium for constructing an attack and defense knowledge graph, wherein the method includes: determining the common features of multiple security frameworks to be processed; the multiple security frameworks at least include an attack behavior framework and a prevention and control measures framework; performing structured processing on the original data of each security framework according to the common features to obtain structured data of multiple security frameworks; establishing associations between the structured data of the multiple security frameworks according to the common features; fusing the data of the multiple security frameworks according to the associations to obtain fused attack and defense data; and constructing an attack and defense knowledge graph according to the attack and defense data. This solution can reduce analysis costs.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to a method, device, computing device and storage medium for constructing an attack and defense knowledge graph. Background Art

[0002] With the rapid development of network technology and the continuous increase in network scale, there are more and more network-related security incidents such as attacks and intrusions, so some security frameworks have emerged one after another. Since different security frameworks have different focuses, when conducting security analysis on network systems, it is necessary to select the required security framework for analysis. For example, when focusing on attack behavior analysis of network systems, you can choose the attack behavior framework, and when focusing on defense measures analysis of network systems, you can choose the control measures framework. If you need to conduct a comprehensive analysis of the network system, you need to select multiple security frameworks to analyze the network system separately. Since different frameworks have different language architectures, logic, etc., the analysis cost is high when selecting multiple security frameworks for comprehensive analysis. Summary of the invention

[0003] Based on the problem of high analysis cost in the prior art, the embodiments of the present invention provide a method, apparatus, computing device and storage medium for constructing an attack and defense knowledge graph, which can reduce the analysis cost.

[0004] In a first aspect, an embodiment of the present invention provides a method for constructing an attack and defense knowledge graph, including:

[0005] Determining common features of multiple security frameworks to be processed; the multiple security frameworks include at least an attack behavior framework and a prevention and control measures framework;

[0006] Performing structured processing on the original data of each security frame according to the common features to obtain structured data of multiple security frames;

[0007] According to the common features, establishing an association relationship among the structured data of the multiple security frameworks;

[0008] fusing the data of the multiple security frameworks according to the association relationship to obtain fused attack and defense data;

[0009] Construct an attack and defense knowledge graph based on the attack and defense data.

[0010] Preferably, the structuring of the original data of each security frame according to the common features to obtain structured data of multiple security frames includes:

[0011] Determine a structured type corresponding to each security framework according to the common features, so that each structured type contains a structure item of the common features;

[0012] The original data of the security framework is extracted according to the structural items in the corresponding structured type, and the extracted data is combined according to the corresponding structured type to obtain the structured data of each security framework.

[0013] Preferably, the determining of the common features of the plurality of security frameworks to be processed comprises:

[0014] When the multiple security frameworks are the attack behavior framework and the prevention and control measure framework, determining a common feature of the attack behavior framework and the prevention and control measure framework as an attack point feature;

[0015] The structural type corresponding to each security framework is determined according to the common characteristics, including:

[0016] The structured types of the attack behavior framework include: the hierarchical relationship from low to high is attack tactics layer, attack technology layer and attack feature layer, and the attack feature layer includes attack point feature items;

[0017] The structured types of the prevention and control measures framework include: a prevention and control measures layer, which includes prevention and control tool items, attack point feature items, prevention and control measures step items and prevention and control category items in a parallel relationship.

[0018] Preferably, the attack behavior framework is the Adversarial Tactics, Techniques, and Common Sense (ATT&CK) framework; and the prevention and control measures framework is the Center for Internet Security (CIS) Controls framework.

[0019] Preferably, establishing an association relationship between the structured data of the multiple security frameworks includes:

[0020] Performing similarity matching on the structured data of the attack point feature items in the attack behavior framework and the structured data of the attack point feature items in the prevention and control measures framework one by one; establishing an association relationship between the two attack point feature items that have successfully been similarly matched;

[0021] The multiple security frameworks are data-fused according to the association relationship, including: for a first attack point feature item belonging to the attack behavior framework and a second attack point feature item belonging to the prevention and control measures framework in each association relationship, the prevention and control measures layer corresponding to the second attack point feature item is fused into the attack technology layer corresponding to the first attack point feature item.

[0022] Preferably, before the prevention and control measure layer corresponding to the second attack point feature item is integrated into the attack technology layer corresponding to the first attack point feature item, the method further includes:

[0023] According to the association relationship, multiple first attack point feature items that match the same second attack point feature item are aggregated and classified according to the attack technologies they belong to, so as to execute the fusion of the prevention and control measures layer corresponding to the second attack point feature item into the attack technology layer corresponding to the first attack point feature item according to the aggregate classification result.

[0024] Preferably, constructing an attack and defense knowledge graph according to the attack and defense data includes:

[0025] The attack and defense data are converted into an ontology file in an ontology language according to the mapping rules of classes, attributes, objects and relationships, and the attack and defense knowledge graph is generated according to the ontology file.

[0026] In a second aspect, an embodiment of the present invention further provides an attack and defense knowledge graph construction device, comprising:

[0027] A common feature determination unit, used to determine common features of multiple security frameworks to be processed; the multiple security frameworks include at least an attack behavior framework and a prevention and control measures framework;

[0028] A structured processing unit, configured to perform structured processing on the original data of each security frame according to the common features, so as to obtain structured data of multiple security frames;

[0029] A relationship establishing unit, configured to establish an association relationship between the structured data of the plurality of security frameworks according to the common features;

[0030] A data fusion unit, configured to fuse the data of the multiple security frameworks according to the association relationship to obtain fused attack and defense data;

[0031] A graph construction unit is used to construct an attack and defense knowledge graph based on the attack and defense data.

[0032] In a third aspect, an embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0033] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method described in any embodiment of this specification.

[0034] The embodiment of the present invention provides an attack and defense knowledge graph method, apparatus, computing device and storage medium, which determines the common features of multiple security frameworks, uses the common features to structure the original data of the security framework, and uses the common features to establish associations between the structured data of multiple security frameworks. When multiple security frameworks have associations, it is convenient to use the associations to fuse data, and then use the fused attack and defense data to build an attack and defense knowledge graph. It can be seen that when analyzing a network system, this solution does not need to use multiple security frameworks to analyze them separately, and only uses the attack and defense knowledge graph to complete the comprehensive analysis of attack and defense; and the attack and defense knowledge graph uses the relationship between entities to describe the attack and defense data, which is separated from the language and structural characteristics of the original security framework, reduces the difficulty of learning and comprehensive analysis, and thus can reduce the cost of analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 It is a flow chart of a method for constructing an attack and defense knowledge graph provided by an embodiment of the present invention;

[0037] Figure 2 It is a structural type schematic diagram of an attack behavior framework provided by an embodiment of the present invention;

[0038] Figure 3 It is a structural type schematic diagram of a prevention and control measure framework provided by an embodiment of the present invention;

[0039] Figure 4 It is a schematic diagram of a structured type of attack and defense data provided by an embodiment of the present invention;

[0040] Figure 5 is a hardware architecture diagram of a computing device provided by an embodiment of the present invention;

[0041] Figure 6 It is a structural diagram of an attack and defense knowledge graph construction device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0043] As mentioned above, when conducting security analysis on network systems, we are currently faced with the problem of selecting a security framework. If a comprehensive analysis of the network system is required, multiple security frameworks need to be selected to analyze the network system separately. This requires learning the language architecture and logic of the selected multiple security frameworks, and the analysis cost is high. If the analysis cost needs to be reduced, it is possible to consider fusing data from multiple security frameworks based on common features and constructing a knowledge graph for the fused data. In this way, when using the multiple security frameworks for comprehensive analysis, the language and structure of the security framework itself can be separated, and only the knowledge graph is needed to achieve a one-time comprehensive analysis, thereby reducing the analysis cost. In addition, considering that the comprehensive analysis is mainly an attack and defense analysis, the security framework for data fusion at least includes an attack behavior framework and a prevention and control measures framework to generate an attack and defense knowledge graph.

[0044] The specific implementation of the above concept is described below.

[0045] Please refer to Figure 1 , an embodiment of the present invention provides a method for constructing an attack and defense knowledge graph, the method comprising:

[0046] Step 100, determining common features of multiple security frameworks to be processed; the multiple security frameworks include at least an attack behavior framework and a prevention and control measures framework;

[0047] Step 102, structuring the original data of each security framework according to the common features to obtain structured data of multiple security frameworks;

[0048] Step 104, establishing an association relationship between the structured data of the multiple security frameworks according to the common features;

[0049] Step 106, fusing the data of the multiple security frameworks according to the association relationship to obtain fused attack and defense data;

[0050] Step 108, constructing an attack and defense knowledge graph based on the attack and defense data.

[0051] In the embodiment of the present invention, by determining the common features of multiple security frameworks, using the common features to structure the original data of the security frameworks, and using the common features to establish associations between the structured data of multiple security frameworks, when multiple security frameworks have associations, it is convenient to use the associations to fuse data, and then use the fused attack and defense data to build an attack and defense knowledge graph. It can be seen that when analyzing a network system, this solution does not need to use multiple security frameworks to analyze them separately, and only uses the attack and defense knowledge graph to complete the comprehensive analysis of attack and defense; and the attack and defense knowledge graph uses the relationship between entities to describe the attack and defense data, which is separated from the language and structural characteristics of the original security framework, reduces the difficulty of learning and comprehensive analysis, and thus can reduce the cost of analysis.

[0052] Described below Figure 1 How the various steps are performed.

[0053] First, with respect to step 100, common features of multiple security frameworks to be processed are determined; the multiple security frameworks include at least an attack behavior framework and a prevention and control measures framework.

[0054] Security frameworks can include threat intelligence frameworks, security benchmark frameworks, attack behavior frameworks, control measures frameworks, etc. Different security frameworks have different focuses. For example, the OpenIOC (security intelligence sharing specification) framework and the CTF (cyber threat) framework are both threat intelligence frameworks, which mainly focus on providing threat intelligence sharing. For another example, the ATT&CK (Adversarial Tactics, Techniques, and Common Sense) framework belongs to the attack behavior framework, which mainly focuses on providing attack tactics and attack techniques for attack behaviors. The CISControls (Internet Security Center Control Measures) framework belongs to the prevention and control measures framework, which mainly focuses on providing various prevention and control tools.

[0055] Therefore, in order to build an attack and defense knowledge graph and conduct a comprehensive attack and defense analysis of the network system, the multiple security frameworks include at least an attack behavior framework and a prevention and control measures framework, and the attack behavior framework and the prevention and control measures framework included can be one or more, so as to ensure that the attack and defense knowledge graph can cover a wide range of attack behaviors and prevention and control measures, and improve the attack and defense knowledge. In addition, the determined security framework can also include other types of security frameworks, such as threat intelligence frameworks, security benchmark frameworks, etc.

[0056] Among them, the common features refer to the feature data contained in multiple security frameworks. In one embodiment of the present invention, when multiple security frameworks are the attack behavior framework and the prevention and control measures framework, the common features of the attack behavior framework and the prevention and control measures framework are determined to be attack point features. It can be understood that the attack behavior framework includes attack point features, and the prevention and control measures framework will indicate which attack points the prevention and control measures respond to when listing various prevention and control measures. It can be seen that the prevention and control measures framework also includes attack point features. Therefore, the attack point features can be determined as the common features of the attack behavior framework and the prevention and control measures framework.

[0057] Then, for step 102, the original data of each security frame is structured according to the common features to obtain structured data of multiple security frames.

[0058] The original data of the security framework includes structured data, semi-structured data and unstructured data. In order to achieve data fusion and then build an attack and defense knowledge graph, the original data of the security framework needs to be structured.

[0059] In addition, in order to ensure that the structured data of each security frame obtained after the structured processing can be integrated, it is necessary to ensure that the structured data after the structured processing includes data with common characteristics. Specifically, in one embodiment of the present invention, step 102 may include: determining the structured type corresponding to each security frame according to the common characteristics, so that each structured type contains the structural items of the common characteristics; extracting data from the original data of the security frame according to the structural items in the corresponding structured type, and combining the extracted data according to the corresponding structured type to obtain the structured data of each security frame.

[0060] Continuing to take the multiple security frameworks as the attack behavior framework and the prevention and control measures framework as an example, preferably, the attack behavior framework is the ATT&CK framework, and the prevention and control measures framework is the CIS Controls framework. According to step 100, the common feature of the attack behavior framework and the prevention and control measures framework is the attack point feature, so the following structured types are set for the attack behavior framework and the prevention and control measures framework respectively:

[0061] The structured types of the attack behavior framework include: the hierarchical relationship from the lowest to the lowest is an attack tactic layer, an attack technology layer and an attack feature layer, and the attack feature layer includes attack point feature items.

[0062] The structured types of the prevention and control measures framework include: a prevention and control measures layer, which includes prevention and control tool items, attack point feature items, prevention and control measures step items and prevention and control category items in a parallel relationship.

[0063] Please refer to Figure 2, which is a structural type diagram of the attack behavior framework, in which the attack tactic layer is the parent node in the hierarchical relationship, the attack technology layer is the child node of the attack tactic layer in the hierarchical relationship, and the attack feature layer is the child node of the attack technology layer in the hierarchical relationship.

[0064] In order to make the structured data more complete, the attack tactics layer may include not only the attack techniques, but also the names of the attack tactics and descriptions of the attack tactics; the attack technology layer may include not only the attack features, but also the names of the attack techniques, descriptions of the attack techniques, threat examples, etc. The attack feature layer may include descriptions of the attack point features and the response and prevention tools for the attack point.

[0065] Taking the attack behavior framework as the ATT&CK framework as an example, in the ATT&CK framework, the attack features in the attack technology layer are mitigation (attack features before the attack) and detection (attack features after the attack). The attack feature layers corresponding to mitigation and detection respectively include description information of the attack point feature items and the response and prevention tools for the attack point.

[0066] Please refer to Figure 3 , which is a structural type diagram of the prevention and control measures framework, in which the prevention and control tool items, attack point feature items, prevention and control measure step items and prevention and control category items are all in parallel relationship.

[0067] After extracting the original data of the security framework using the above structured type, the structured data of each security framework is obtained.

[0068] Next, step 104 "establishing association relationships among structured data of the multiple security frameworks based on common features" and step 106 "fusing data of the multiple security frameworks based on the association relationships to obtain fused attack and defense data" are explained.

[0069] When the common feature is an attack point feature, if multiple security frameworks are to be associated, the attack point feature needs to be used to achieve this. Specifically, in one embodiment of the present invention, this step 104 may include: performing similarity matching on the structured data of the attack point feature item in the attack behavior framework and the structured data of the attack point feature item in the prevention and control measures framework one by one; establishing an association relationship between the two attack point feature items that have successfully matched similarity.

[0070] For example, the attack behavior framework includes attack point A, attack point B and attack point C, and the three attack points belong to the same attack technology. The prevention and control measures framework includes prevention and control measures M1 and M2, wherein both prevention and control measures M1 and M2 include attack point feature items, which are information used to describe the attack point features by natural language processing. Then the groups that can be similarly matched are: attack point A-prevention and control measures M1, attack point A-prevention and control measures M2, attack point B-prevention and control measures M1, attack point B-prevention and control measures M2, attack point C-prevention and control measures M1, attack point C-prevention and control measures M2.

[0071] Taking the group for similarity matching as attack point A-control measure M1 as an example, when similarity matching is performed, the description information of attack point A is matched with the description information of the attack point features included in control measure M1. If the similarity is greater than the set threshold, the match is successful, otherwise the match is unsuccessful. Assuming that attack point A and attack point B are successfully matched with control measure M1, and attack point C is successfully matched with control measure M2, then attack point A is associated with control measure M1, attack point B is associated with control measure M1, and attack point C is associated with control measure M2.

[0072] After establishing the association relationship, this step 106 may include: for the first attack point feature item belonging to the attack behavior framework and the second attack point feature item belonging to the prevention and control measures framework in each association relationship, the prevention and control measures layer corresponding to the second attack point feature item is integrated into the attack technology layer corresponding to the first attack point feature item.

[0073] Continuing with the above example, prevention and control measure M1 can be integrated into the attack technology layer of attack point A and the attack technology layer of attack point B, and prevention and control measure M2 can be integrated into the attack technology layer of attack point C.

[0074] Taking into account that there may be multiple attack points that match the same prevention and control measures item, and these multiple attack points belong to the same attack technology layer, in order to ensure that the fusion of the attack and defense data after fusion is smoother, it can be performed before fusion: based on the association relationship, multiple first attack point feature items that match the same second attack point feature item are aggregated and classified according to the attack technology to which they belong.

[0075] The above attack points A and B are aggregated into one category, and attack point C is aggregated into one category. Therefore, during fusion, the prevention and control measure M1 is merged into the attack technology layer to which the attack points A and B belong, and the attack feature layer corresponding to the attack points A and B is used as a child node of the prevention and control measure M1.

[0076] Please refer to Figure 4, is a structured type of the attack and defense data after fusion, and the structured type of the attack and defense data can be set according to the structured type of the security framework. In the fusion process, fusion is achieved according to the structured type of the attack and defense data.

[0077] After fusion, control measures M1 may include prevention and control tools for attack point A and prevention and control tools for attack point B. It can be seen that in the original security framework, there is only one prevention and control tool for attack point A and attack point B. For the fused attack and defense data, since the prevention and control tools for attack point A and attack point B belong to the same prevention and control measures, the prevention and control tools for attack point B can also be used for prevention and control of attack point A. In addition, according to the fused attack and defense data, the connection between attack points can also be known, for example, attack point A is connected to attack point B. This can facilitate the comprehensive analysis of security prevention and control.

[0078] After step 106, in order to ensure the accuracy of the fused attack and defense data, manual verification, modification and confirmation may be performed to reduce the error in the fusion.

[0079] Step 108, constructing an attack and defense knowledge graph based on the attack and defense data.

[0080] In this step 108, the attack and defense data can be converted into an ontology file in an ontology language according to the mapping rules of classes, attributes, objects and relationships, and an attack and defense knowledge graph can be generated based on the ontology file.

[0081] The ontology language is owl. Importing the ontology file into the knowledge graph project can realize the visualization of the attack and defense knowledge graph.

[0082] like Figure 5 , Figure 6 As shown, an embodiment of the present invention provides an attack and defense knowledge graph construction device. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 5 As shown, it is a hardware architecture diagram of a computing device where an attack and defense knowledge graph construction device provided by an embodiment of the present invention is located, except Figure 5 In addition to the processor, memory, network interface, and non-volatile memory shown in the figure, the computing device in which the device is located in the embodiment may also generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 6 As shown, as a device in a logical sense, the CPU of the computing device in which it is located reads the corresponding computer program in the non-volatile memory into the memory and runs it. This embodiment provides an attack and defense knowledge graph construction device, including:

[0083] A common feature determination unit 601 is used to determine common features of multiple security frameworks to be processed; the multiple security frameworks include at least an attack behavior framework and a prevention and control measure framework;

[0084] A structured processing unit 602 is used to perform structured processing on the original data of each security frame according to the common features to obtain structured data of multiple security frames;

[0085] A relationship establishing unit 603, configured to establish an association relationship between the structured data of the plurality of security frameworks according to the common features;

[0086] A data fusion unit 604 is used to fuse the data of the multiple security frameworks according to the association relationship to obtain fused attack and defense data;

[0087] The graph construction unit 605 is used to construct an attack and defense knowledge graph based on the attack and defense data.

[0088] In one embodiment of the present invention, the structured processing unit 602 is specifically used to determine the structured type corresponding to each security framework based on the common characteristics, so that each structured type contains the structural items of the common characteristics; extract the original data of the security framework according to the structural items in the corresponding structured type, and combine the extracted data according to the corresponding structured type to obtain the structured data of each security framework.

[0089] In one embodiment of the present invention, the common feature determination unit 601 is specifically configured to determine, when the multiple security frameworks are the attack behavior framework and the prevention and control measure framework, the common features of the attack behavior framework and the prevention and control measure framework as attack point features;

[0090] The structured processing unit 602 is specifically used to determine the structured type corresponding to each security framework, including:

[0091] The structured types of the attack behavior framework include: the hierarchical relationship from low to high is attack tactics layer, attack technology layer and attack feature layer, and the attack feature layer includes attack point feature items;

[0092] The structured types of the prevention and control measures framework include: a prevention and control measures layer, which includes prevention and control tool items, attack point feature items, prevention and control measures step items and prevention and control category items in a parallel relationship.

[0093] In one embodiment of the present invention, the attack behavior framework is the Adversarial Tactics, Techniques, and Common Sense (ATT&CK) framework; and the prevention and control measures framework is the Center for Internet Security (CIS) Controls framework.

[0094] In one embodiment of the present invention, the relationship establishing unit 603 is specifically used to perform similarity matching on the structured data of the attack point feature items in the attack behavior framework and the structured data of the attack point feature items in the prevention and control measures framework one by one; and establish an association relationship between the two attack point feature items that have successfully matched similarity;

[0095] The data fusion unit 604 is specifically used to fuse the prevention and control measures layer corresponding to the first attack point feature item belonging to the attack behavior framework and the second attack point feature item belonging to the prevention and control measures framework in each association relationship into the attack technology layer corresponding to the first attack point feature item.

[0096] In one embodiment of the present invention, the data fusion unit 604 is also used to aggregate and classify multiple first attack point feature items that match the same second attack point feature item according to the corresponding attack technology based on the association relationship, so as to execute the fusion of the prevention and control measures layer corresponding to the second attack point feature item into the attack technology layer corresponding to the first attack point feature item based on the aggregation classification result.

[0097] In one embodiment of the present invention, the graph construction unit 605 is specifically used to convert the attack and defense data into an ontology file of an ontology language according to the mapping rules of classes, attributes, objects and relationships, and generate the attack and defense knowledge graph according to the ontology file.

[0098] It is understandable that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on an attack and defense knowledge graph construction device. In other embodiments of the present invention, an attack and defense knowledge graph construction device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0099] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For the specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0100] An embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a method for constructing an attack and defense knowledge graph in any embodiment of the present invention is implemented.

[0101] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes an attack and defense knowledge graph construction method in any embodiment of the present invention.

[0102] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0103] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0104] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0105] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0106] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0107] Each embodiment of the present invention has at least the following beneficial effects:

[0108] 1. In one embodiment of the present invention, by determining the common features of multiple security frameworks, the original data of the security frameworks is structured using the common features, and the structured data of multiple security frameworks are associated using the common features. When multiple security frameworks have an associated relationship, it is convenient to use the associated relationship to fuse data, and then use the fused attack and defense data to build an attack and defense knowledge graph. It can be seen that when analyzing a network system, this solution does not need to use multiple security frameworks to analyze them separately, and only uses the attack and defense knowledge graph to complete the comprehensive analysis of attack and defense; and the attack and defense knowledge graph uses the relationship between entities to describe the attack and defense data, which is separated from the language and structural characteristics of the original security framework, reduces the difficulty of learning and comprehensive analysis, and thus can reduce the analysis cost.

[0109] 2. In one embodiment of the present invention, after determining the common features of multiple security frameworks, the structured types corresponding to each security framework are determined based on the common features, so that each structured type contains the structural items of the common features. In this way, when the original data of the security framework is structured according to the corresponding structured type, it can be ensured that the structured data obtained after processing contains the common features, and then the common features can be used to achieve data fusion.

[0110] 3. In one embodiment of the present invention, the attack behavior framework can use the ATT&CK framework, and the prevention and control measures framework can use the CIS Controls framework. The ATT&CK framework is a knowledge base that contains a large number of attack behaviors, covering a wide range of fields such as attack and defense capabilities, APT intelligence analysis, threat hunting, and attack simulation, while the CIS Controls framework includes 20 major control measures. By using these two frameworks for data fusion, the amount of knowledge covered by the attack and defense knowledge graph constructed is more complete.

[0111] 4. In one embodiment of the present invention, before fusion, multiple first attack point feature items that match the same second attack point feature item are aggregated and classified according to the attack technology to which they belong, and the first attack point feature items under the same category are used as child nodes of the second attack point feature items during fusion. In this way, in the attack and defense knowledge graph constructed after fusion, it is possible to determine whether there are other prevention and control tools for an attack point, and it is also possible to determine the relationship between multiple attack points belonging to the child nodes of the prevention and control measures based on the prevention and control measures, which is conducive to the comprehensive analysis of security prevention and control.

[0112] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0113] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0114] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for constructing an attack and defense knowledge graph, characterized in that: include: Determine the common features of multiple security frameworks to be processed; wherein, when the multiple security frameworks are attack behavior frameworks and prevention and control measures frameworks, determine the common features of the attack behavior framework and the prevention and control measures framework as attack point features; Determine the structured type corresponding to each security framework according to the common characteristics, so that each structured type contains the structural items of the common characteristics; wherein the structured type of the attack behavior framework includes: the attack tactic layer, the attack technology layer and the attack feature layer in descending order, and the attack feature layer includes the attack point feature item; the structured type of the prevention and control measures framework includes: the prevention and control measures layer, and the prevention and control measures layer includes the prevention and control tool item, the attack point feature item, the prevention and control measures step item and the prevention and control category item in a parallel relationship; Extracting data from the original data of the security framework according to the structural items in the corresponding structured type, and combining the extracted data according to the corresponding structured type to obtain the structured data of each security framework; According to the common features, the structured data of the attack point feature items in the attack behavior framework and the structured data of the attack point feature items in the prevention and control measures framework are similarly matched one by one; and an association relationship is established between the two attack point feature items that have successfully been similarly matched; For each of the first attack point feature items belonging to the attack behavior framework and the second attack point feature items belonging to the prevention and control measures framework in each association relationship, multiple first attack point feature items that match the same second attack point feature item are aggregated and classified according to the attack technologies to which they belong, so as to fuse the prevention and control measures layer corresponding to the second attack point feature item into the attack technology layer corresponding to the first attack point feature item according to the aggregation and classification result, thereby obtaining fused attack and defense data; Construct an attack and defense knowledge graph based on the attack and defense data.

2. The method according to claim 1, characterized in that The attack behavior framework is the Adversarial Tactics, Techniques, and Common Sense (ATT&CK) framework; the prevention and control measures framework is the Center for Internet Security (CIS) Controls framework.

3. The method according to any one of claims 1-2, characterized in that: The constructing an attack and defense knowledge graph according to the attack and defense data includes: The attack and defense data are converted into an ontology file in an ontology language according to the mapping rules of classes, attributes, objects and relationships, and the attack and defense knowledge graph is generated according to the ontology file.

4. A device for constructing an attack and defense knowledge graph, characterized in that: include: A common feature determination unit, used to determine common features of multiple security frameworks to be processed; The multiple security frameworks include at least an attack behavior framework and a prevention and control measure framework; wherein, when the multiple security frameworks are an attack behavior framework and a prevention and control measure framework, determining a common feature of the attack behavior framework and the prevention and control measure framework as an attack point feature; A structured processing unit, used to determine the structured type corresponding to each security framework according to the common characteristics, so that each structured type contains the structural items of the common characteristics; wherein the structured type of the attack behavior framework includes: the attack tactic layer, the attack technology layer and the attack feature layer in descending order, and the attack feature layer includes the attack point feature item; the structured type of the prevention and control measures framework includes: the prevention and control measures layer, and the prevention and control measures layer includes the prevention and control tool item, the attack point feature item, the prevention and control measure step item and the prevention and control category item in a parallel relationship; extract the original data of the security framework according to the structural items in the corresponding structured type, and combine the extracted data according to the corresponding structured type to obtain the structured data of each security framework; A relationship establishing unit, configured to perform similarity matching on the structured data of the attack point feature items in the attack behavior framework and the structured data of the attack point feature items in the prevention and control measures framework one by one according to the common features; and to establish an association relationship between the two attack point feature items that have successfully been similarly matched; A data fusion unit is used to aggregate and classify, according to the associated relationship, a plurality of first attack point feature items that match the same second attack point feature item according to the associated relationship and the attack technology to which they belong, for a first attack point feature item belonging to the attack behavior framework and a second attack point feature item belonging to the prevention and control measure framework in each associated relationship, so as to fuse the prevention and control measure layer corresponding to the second attack point feature item into the attack technology layer corresponding to the first attack point feature item according to the aggregated classification result, to obtain fused attack and defense data; A graph construction unit is used to construct an attack and defense knowledge graph based on the attack and defense data.

5. The device according to claim 4, characterized in that The attack behavior framework is the Adversarial Tactics, Techniques, and Common Sense (ATT&CK) framework; the prevention and control measures framework is the Center for Internet Security (CIS) Controls framework.

6. The device according to any one of claims 4-5, characterized in that: The graph construction unit is specifically used to convert the attack and defense data into an ontology file in an ontology language according to the mapping rules of classes, attributes, objects and relationships, and generate the attack and defense knowledge graph according to the ontology file.

7. A computing device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 3 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 3.

Images