A method, device, equipment and storage medium for determining vulnerability exploitation relationship

Abstract

The present invention discloses a method, device, equipment and storage medium for determining vulnerability exploitation relationships. The present invention establishes a vulnerability knowledge graph, obtains first network topology information of a network topology, and supplements the first network topology information according to the vulnerability knowledge graph to obtain second network topology information; the network nodes of the network topology are divided into multiple nodes, the nodes at least include components, equipment and areas, each node corresponds to a granularity, and the second network topology information includes the exploitable vulnerabilities, exploitation conditions and attack vectors of each node; according to the network topology and the second network topology information, a multi-granularity attack graph is constructed, and the multi-granularity attack graph includes the vulnerability exploitation relationship of the nodes, and the vulnerability exploitation relationship of the exploitable vulnerabilities of multi-granular objects including components, equipment and areas is realized in combination with the vulnerability knowledge graph and the network topology information, thereby improving the analysis speed, accuracy and comprehensiveness. The present invention can be widely used in the field of the Internet.

Description

Technical Field

[0001] The present invention relates to the field of Internet, and in particular to a method, device, equipment and storage medium for determining a vulnerability exploitation relationship. Background Art

[0002] In the era of rapid development of information technology, preventing hacker behavior and network intrusion has become an important part of network security. As one of the important methods of active security protection, penetration testing conducts attack tests on information systems from the perspective of attackers to discover information security threats and improve security protection capabilities. In the process of penetration testing, multiple vulnerabilities may be exploited to achieve the purpose of penetration. When a vulnerability is successfully exploited, it can create favorable conditions for the exploitation of another vulnerability. Therefore, it is particularly important to scan and identify vulnerabilities and mine the relationship between vulnerability exploitation to obtain the attack path in network intrusion.

[0003] However, existing penetration testing methods are mostly carried out manually, and the discovery of vulnerability exploitation relationships relies on the experience of technical personnel. There are deficiencies in efficiency, accuracy, and comprehensiveness. Therefore, how to quickly and accurately discover potential vulnerability exploitation chains has become an urgent problem to be solved. Summary of the invention

[0004] In view of this, in order to solve at least one of the above technical problems, an object of the present invention is to provide a vulnerability exploitation relationship determination method, device, equipment and storage medium.

[0005] The technical solution adopted in the embodiment of the present invention is:

[0006] A vulnerability exploitation relationship determination method, comprising:

[0007] Build a vulnerability knowledge graph;

[0008] Acquire first network topology information of a network topology, and perform supplementary processing on the first network topology information according to the vulnerability knowledge graph to obtain second network topology information; the network nodes of the network topology are divided into a plurality of nodes, the nodes at least include components, devices and areas, each of the nodes corresponds to a granularity, and the second network topology information includes an exploitable vulnerability, an exploitation condition and an attack vector of each of the nodes;

[0009] A multi-granularity attack graph is constructed according to the network topology and the second network topology information; the multi-granularity attack graph includes vulnerability exploitation relationships of the nodes.

[0010] Furthermore, the establishment of the vulnerability knowledge graph includes:

[0011] Establishing an ontology model; the ontology model includes entities, relationships and attributes; the entities include vulnerabilities, and the attributes include at least the exploitation conditions, attack vectors, evaluations and hazard levels;

[0012] Crawling the vulnerability knowledge base, updating the entity, the relationship, the attack vector, the exploitation condition, the evaluation, and the hazard level according to the crawling processing result, and generating an initial knowledge graph;

[0013] The initial knowledge graph is mined and the exploitation condition-determined vulnerability knowledge graph is updated.

[0014] Further, the obtaining of first network topology information of the network topology includes:

[0015] Call the preset topology or scan the network topology through a vulnerability scanning tool to determine the first network topology information; the first network topology information includes relevant information of the nodes and the connection method of the nodes, wherein the relevant information of the components includes relevant information of hardware firmware, software, operating system and services.

[0016] Further, the exploitation condition includes a pre-permission and a post-permission, and the first network topology information is supplemented according to the vulnerability knowledge graph to obtain the second network topology information, including:

[0017] Searching for associated exploitable vulnerabilities in the vulnerability knowledge graph according to the component;

[0018] The attribute corresponding to the exploitable vulnerability is queried and added to the first network topology information to obtain the second network topology information.

[0019] Further, constructing a multi-granularity attack graph according to the network topology and the second network topology information includes:

[0020] Traversing the exploitable vulnerabilities of each of the nodes, when the pre-authority of the exploitable vulnerability of the node is less than or equal to the post-authority of the neighboring node, establishing a directed edge between the exploitable vulnerability, the node and the neighboring node; the directed edge represents an attack relationship between attacking the node with the exploitable vulnerability and attacking the neighboring node with the exploitable vulnerability on the node;

[0021] The multi-granularity attack graph is constructed according to the directed edges.

[0022] Further, each of the nodes has a corresponding hierarchical structure ID, and constructing the multi-granularity attack graph according to the directed edges includes:

[0023] Adding nodes with an out-degree of 0 to a node set, and determining whether the node set is an empty set; the node is a component or a device;

[0024] When the node set is a non-empty set, extract a node from the node set, modify the hierarchical ID of the extracted node to the hierarchical ID of the previous node of the extracted node, add the extracted node to a queue and delete it from the node set, determine whether the queue is an empty queue, and if the queue is not an empty queue, obtain all exploitable vulnerabilities of the nodes in the queue, and determine whether the preceding node of the exploitable vulnerability is empty:

[0025] If it is not empty, reverse query is performed according to the exploitable vulnerabilities and the directed edges to determine the list of preceding nodes, nodes with the same preceding node list are merged, and the preceding vulnerability set of the exploitable vulnerabilities corresponding to the incoming edges of the nodes in the queue is determined according to the preceding node list to update the preceding vulnerability set of the exploitable vulnerabilities of the extracted nodes, the merged and processed nodes are added to the queue, and the step of obtaining all the exploitable vulnerabilities of the nodes in the queue is returned until the preceding node of the exploitable vulnerability is empty;

[0026] If it is empty, return to the step of determining whether the queue is an empty queue until the queue is an empty queue, return to the step of determining whether the node set is an empty set until the node set is an empty set, and obtain the vulnerability exploitation chain of each node; the multi-granularity attack graph includes all vulnerability exploitation chains, and the vulnerability exploitation chain includes nodes, exploitable vulnerabilities, exploitation conditions, attack vectors, and preceding vulnerability sets.

[0027] Furthermore, the method further comprises:

[0028] Get the starting point and the end point to be analyzed;

[0029] A forward search is performed in the multi-granularity attack graph according to the starting point to be analyzed until the end point to be analyzed is found, thereby obtaining an actual vulnerability exploitation relationship from the starting point to be analyzed to the end point to be analyzed.

[0030] The embodiment of the present invention also provides a vulnerability exploitation relationship determination device, comprising:

[0031] Establish a module for building a vulnerability knowledge graph;

[0032] A supplementing module is used to obtain first network topology information of a network topology, and perform supplementary processing on the first network topology information according to the vulnerability knowledge graph to obtain second network topology information; the network nodes of the network topology are divided into a plurality of nodes, the nodes at least include components, devices and areas, each of the nodes corresponds to a granularity, and the second network topology information includes an exploitable vulnerability, an exploitation condition and an attack vector of each of the nodes;

[0033] A construction module is used to construct a multi-granularity attack graph according to the network topology and the second network topology information; the multi-granularity attack graph includes the vulnerability exploitation relationship of the nodes.

[0034] An embodiment of the present invention also provides an electronic device, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method.

[0035] An embodiment of the present invention also provides a computer-readable storage medium, in which at least one instruction, at least one program, a code set or an instruction set is stored, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the method.

[0036] The beneficial effects of the present invention are as follows: by establishing a vulnerability knowledge graph, first network topology information of a network topology is obtained, and the first network topology information is supplemented and processed according to the vulnerability knowledge graph to obtain second network topology information; the network nodes of the network topology are divided into multiple nodes, and the nodes at least include components, equipment and areas, each of the nodes corresponds to a granularity, and the second network topology information includes the exploitable vulnerabilities, exploitation conditions and attack vectors of each of the nodes; according to the network topology and the second network topology information, a multi-granularity attack graph is constructed, and the multi-granularity attack graph includes the vulnerability exploitation relationship of the nodes, and the vulnerability knowledge graph and the network topology information are combined to realize the vulnerability exploitation relationship of the exploitable vulnerabilities of multi-granular objects including components, equipment and areas, thereby reducing human dependence and improving the analysis speed, accuracy and comprehensiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A schematic diagram of the steps of the vulnerability exploitation relationship determination method of the present invention;

[0038] Figure 2 It is a schematic diagram of a multi-granularity attack graph structure according to a specific embodiment of the present invention;

[0039] Figure 3A schematic diagram of a process for constructing a multi-granularity attack graph according to a specific embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0041] The terms "first", "second", "third" and "fourth" etc. in the specification and claims of the present application and the drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0042] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0043] like Figure 1 As shown, an embodiment of the present invention provides a vulnerability exploitation relationship determination method, comprising steps S100-S300:

[0044] S100. Establish a vulnerability knowledge graph.

[0045] Optionally, step S100 includes steps S110-S130:

[0046] S110. Establish an ontology model.

[0047] Optionally, the ontology model includes entities, relationships, and attributes, such as establishing a <entity, relationship, entity> or <entity, relationship, attribute> triple representation model. Optionally, entities may include vulnerabilities or assets, etc. For example, the constructed triple representation model includes but is not limited to: <vulnerability, belongs to / exists, asset>, <asset, belongs to / has, manufacturer>, <vulnerability, has / belongs to, patch>, <vulnerability, write / exploit, vulnerability exploit code>, <vulnerability, related event / involved, security event>, etc.

[0048] It should be noted that the vulnerability in each entity has attributes, which include but are not limited to <vulnerability, exploitation prerequisite, vulnerability exploitation pre-authority>, <vulnerability, exploitation result, vulnerability exploitation post-authority>, <vulnerability, (harm) evaluation, vulnerability harm level>, <vulnerability, evaluation, vulnerability score>, attack vector and other information. Among them, vulnerability exploitation pre-authority (referred to as pre-authority) and vulnerability exploitation post-authority (referred to as post-authority) are part of the exploitation conditions.

[0049] S120, crawling the vulnerability knowledge base, updating entities, relationships, and at least one of attack vectors, exploitation conditions, evaluations, and hazard levels according to the crawling processing results, and generating an initial knowledge graph.

[0050] Optionally, the vulnerability knowledge base includes, but is not limited to, national vulnerability libraries NVD of certain countries, SecurityFocus, national information security vulnerability sharing platform CNVD, national information security vulnerability library CNNVD, general attack enumeration and classification library CAPE, general weakness enumeration library CWE, public resource library CPE, network security related websites (for example, Pediy BBS, Freebuf, KafanBBS, Open Web Application Security Project OWASP, Security Response Center) and other categories of knowledge bases (such as asset libraries, attack type enumeration libraries, security blogs / forums), etc.

[0051] In the embodiment of the present invention, the vulnerability information in the vulnerability knowledge base is obtained by crawling the vulnerability knowledge base, and the entities, relationships and attributes (such as exploit conditions, attack vectors, evaluations, hazard levels, etc.) are updated according to the vulnerability information to generate an initial knowledge graph, that is, the initial knowledge graph consisting of the <entity, relationship, entity> and <entity, relationship, attribute> triples is updated. It should be noted that the above-mentioned update process can be updated based on entity recognition, relationship extraction, attribute extraction and other technologies; the updated attribute in other embodiments can be at least one of the exploit conditions, attack vectors, evaluations and hazard levels, without specific limitation.

[0052] S130, mining the initial knowledge graph and updating the exploitation condition to determine the vulnerability knowledge graph.

[0053] In an embodiment of the present invention, the initial knowledge graph is mined and processed by methods such as knowledge reasoning and knowledge mining, so as to mine potential knowledge information such as vulnerability exploitation pre-permissions, post-permissions, vulnerability exploitation relationships, etc., and the exploitation conditions (which may include pre-permissions, post-permissions, vulnerability exploitation relationships, etc.) are updated to obtain a vulnerability knowledge graph.

[0054] S200: Acquire first network topology information of a network topology, and perform supplementary processing on the first network topology information according to a vulnerability knowledge graph to obtain second network topology information.

[0055] Optionally, the obtaining of first network topology information of the network topology in step S200 includes step S210:

[0056] S210: Call a preset topology or scan and detect the network topology through a vulnerability scanning tool to determine first network topology information.

[0057] Optionally, the network topology is a network structure, and the network topology has network nodes, such as hosts, servers, routers, etc., and there is a connection method between the network nodes, and each network node has corresponding network node information (such as name, region, hardware model, hardware firmware version, operating system version, software version, service version, etc.). It should be noted that the first network topology information can be obtained by calling a preset topology or scanning and detecting the network topology through a vulnerability scanning tool.

[0058] Optionally, based on the network node information of the network node, the network node can be divided into multiple nodes, the nodes include but are not limited to components, devices and regions, each of the nodes corresponds to a granularity, that is, the granularity of the components, the granularity of the devices and the granularity of the regions, for example, a number of devices are divided into regions according to their regions, and a region may include one or more devices, and a device is a single device (such as a host, server, router, etc.); the component is the content on the device, including but not limited to hardware firmware, software, operating system and services, etc., and the relevant information of the component includes information such as hardware firmware, software, operating system and services, such as: hardware model, hardware firmware version, operating system version, software version, service version and other information. It should be noted that the first network topology information includes relevant information of the node and the connection mode of the node, the relevant information of the node such as the name, the region to which it belongs and the relevant information of the component, etc., and the connection mode of the node represents the connection relationship between the components, devices and regions and the connection mode of the network nodes.

[0059] Optionally, in step S200, supplementary processing is performed on the first network topology information according to the vulnerability knowledge graph, including steps S220-S230:

[0060] S220: Search for associated exploitable vulnerabilities in the vulnerability knowledge graph according to the component.

[0061] In an embodiment of the present invention, based on the relevant information of the components in the first network topology information, such as hardware model, hardware firmware version, operating system version, software version, service version and other information, the vulnerabilities associated with the corresponding versions of the operating system, firmware, and software are queried in the vulnerability knowledge graph to determine the associated exploitable vulnerabilities.

[0062] S230: Query corresponding attributes according to the exploitable vulnerabilities and add them to the first network topology information to obtain second network topology information.

[0063] Specifically, after obtaining the associated exploitable vulnerabilities, based on the entities, relationships, and attributes in the vulnerability knowledge graph, the attributes associated with the exploitable vulnerabilities are queried as supplementary content, such as vulnerability pre-exploitation permissions, vulnerability post-exploitation permissions, attack vectors, etc., and the supplementary content is added to the first network topology information to obtain the second network topology information. It should be noted that the second network topology information includes the first network topology information and the supplementary content, and the supplementary content may include the attributes associated with the exploitable vulnerabilities of each node.

[0064] S300: Construct a multi-granularity attack graph according to the network topology and the second network topology information.

[0065] In an embodiment of the present invention, the multi-granularity attack graph includes vulnerability exploitation relationships of nodes, and the vulnerability exploitation relationships can be represented by vulnerability exploitation chains (or called attack paths). Therefore, the multi-granularity attack graph can include multi-granularity vulnerability exploitation chains of three granularities: components, devices, and regions.

[0066] Optionally, step S300 includes steps S310-S320:

[0067] S310, traversing the exploitable vulnerabilities of each node, when the pre-permission of the exploitable vulnerability of the node is less than or equal to the post-permission of the neighboring node, establishing a directed edge between the exploitable vulnerability, the node and the neighboring node.

[0068] In the embodiment of the present invention, the regional granularity corresponds to the regional attack target, that is, a region; the device granularity corresponds to a specific device; the component granularity corresponds to the hardware firmware, software, operating system, and service, etc. Optionally, the basic model of the vulnerability exploitation chain is defined in the embodiment of the present invention, and the basic model includes three elements: vulnerability exploitation target, exploitable vulnerability, and exploitation condition. Among them, the vulnerability exploitation target refers to the specific target of the vulnerability attack, that is, the region, device or component (or referred to as the regional node, device node or component node); the exploitable vulnerability refers to the specific vulnerability to be used; the vulnerability exploitation condition refers to the conditions to be met and the effect to be achieved by exploiting the vulnerability, which can be optionally represented by the vulnerability exploitation pre-permission (hereinafter referred to as the pre-permission) PrePri and the vulnerability exploitation post-permission (hereinafter referred to as the post-permission) PostPri of the exploitable vulnerability. It should be noted that the pre-permission refers to the permission required before the exploitable vulnerability is exploited, and the post-permission refers to the permission that can be obtained after the exploitable vulnerability is exploited. The permissions are divided into 5 levels from low to high: None <APP_User<APP_Admin<SYS_User<SYS_Admin。

[0069] It should be noted that according to the basic model, we can know that the vulnerability exploit chain can be represented by a five-tuple:

[0070] E=(o,v,<PrePri,PostPri> ,Cdt,V')

[0071] Among them, o is the vulnerability exploitation target, v is the exploitable vulnerability, and the exploitation condition<PrePri,PostPri> It is necessary to satisfy PrePri≤PostPri (that is, the permissions that can be obtained after the exploit is no less than the permissions required before the exploit); Cdt is the attack vector that needs to be satisfied to initiate the exploit, refer to the CVSS3.0 attack vector; Cdt∈{network, neighbor, local, physical} (defined in CVSS3.0), V' represents the set of pre-order vulnerabilities that exploit the exploitable vulnerability v. For device granularity and regional granularity representation, there is more than one pre-order vulnerability, which can be represented by a set. Therefore, the vulnerability exploitation chains of different granularities can be uniformly represented by a quintuple. Specifically, for different granularity representations, all vulnerability exploitation chains can be represented as EL=(E1,E2,E3,...,E i ,E i+1 ,...,E n ), n is the number of vulnerability exploit chains, E i Denotes the i-th vulnerability exploit chain, let E i =(o i ,v i , <PrePri i ,PostPri i >,Cdti ,V i '), then for Meet PostPri i ≥PrePri i+1 (The post-permission of the exploitable vulnerability of the i-th node is greater than or equal to the pre-permission of the exploitable vulnerability of the i+1-th node).

[0072] In the embodiment of the present invention, taking the node, i.e. the vulnerability exploitation target, as the unit, traverses each o i The node has the exploitable vulnerabilities i , obtain the pre-permission PrePri i , by comparing neighbor nodes o j Vulnerability j PostPri j (i, j represent the node number, used for distinction, for example, j is i-1 or i-2, etc.), determine whether the post-permission of the neighboring node satisfies o i The condition, that is, PostPri j ≥PrePri i If the requirements are met, a directed edge between the exploitable vulnerability, node and neighboring node is established. The specific directed edge is represented as: j ->o j ->v i ->o i , and then a multi-granularity attack graph can be constructed based on all directed edges.

[0073] like Figure 2 The figure shows a multi-granularity attack graph structure that can be constructed, including two node structures. The first node structure is equivalent to a node, represented by an ellipse, which can be divided into components, devices, and regions. The second node structure is an exploitable vulnerability, represented by a rectangle. The directed edges represent the relationship between the node structures. The directed edges represent the attack relationship between the exploitable vulnerability to attack the node and the exploitation of the exploitable vulnerability of the neighboring node on the node. Specifically: the directed edge of exploitable vulnerability->node represents the attack on the node using the exploitable vulnerability, and the node->exploitable vulnerability represents the attack on the current node using the vulnerability of the subsequent node (such as the neighboring node). Among them, in order to intuitively represent the vulnerability exploitation relationship, the vulnerability exploitation permission can be used as the attribute of the in-edge and out-edge of the vulnerability. It should be noted that for the vulnerability exploitation target o, the hierarchical structure representation method " / D / E / C" can be used, where D is the region ID, E is the device ID, and C is the component ID. The first network topology information and the second network topology information can include the region ID, E is the device ID, and C is the component ID. Figure 2As shown, vulnerability refers to an exploitable vulnerability, the nodes of the area can be represented as / D1, / D2, the nodes of the device can be represented as / D1 / E1, / D1 / E2 / , / D2 / E2, and the nodes of the component can be represented as / D1 / E1 / C1, / D1 / E2 / C1, / D2 / E2 / C1.

[0074] S320: Construct a multi-granularity attack graph based on directed edges.

[0075] In the embodiment of the present invention, a component-based multi-granularity attack graph can construct a coarse-grained multi-granularity attack graph such as a device and a region.

[0076] Optionally, step S320 includes steps S3201-S3204:

[0077] S3201. Add nodes with out-degree 0 to a node set, and determine whether the node set is an empty set.

[0078] like Figure 3 As shown, optionally, the node set O is initialized, nodes (such as components, equipment) with a degree of 0 are determined based on directed edges and added to the node set O, and then it is determined whether the node set O is an empty set.

[0079] S3202. When the node set is a non-empty set, extract a node from the node set, modify the hierarchical ID of the extracted node to the hierarchical ID of the previous node of the extracted node, add the extracted node to the queue and delete it from the node set, determine whether the queue is an empty queue, if the queue is not an empty queue, obtain all exploitable vulnerabilities of the nodes in the queue, and determine whether the predecessor node of the exploitable vulnerability is empty.

[0080] Specifically, when the node set O is an empty set, the generation process ends. When the node set O is a non-empty set O, a node in the node set is extracted, and the hierarchical ID of the extracted node is modified to the hierarchical ID of the previous node of the extracted node. For example, assuming that the ID of the extracted node has n levels, the hierarchical ID of the node is modified to the hierarchical ID of the previous node of the n-1 level. It should be noted that the hierarchical ID is the ID of the node (such as the ID of a component). Then, the extracted node (denoted as o i ) is added to the queue and deleted from the node set O, and then the queue is determined to be empty. If the queue is not empty, all the vulnerabilities of the nodes in the queue can be obtained to exploit the vulnerability (denoted as v i ), determine whether the previous node of the exploitable vulnerability is empty. It should be noted that the previous node refers to the node before the extracted node.

[0081] S3203. If it is not empty, determine the list of predecessor nodes based on the exploitable vulnerabilities and directed edges in reverse query, merge the nodes with the same predecessor node list, determine the predecessor vulnerability set of the exploitable vulnerabilities corresponding to the incoming edges of the nodes in the queue based on the predecessor node list to update the predecessor vulnerability set of the exploitable vulnerabilities of the extracted nodes, add the merged and processed nodes to the queue, and return to the step of obtaining all exploitable vulnerabilities of the nodes in the queue until the predecessor node of the exploitable vulnerability is empty.

[0082] Specifically, if the previous node is not empty, the previous node list is determined according to the exploitable vulnerability and the directed edge reverse query. For example, the previous node list may include one or more previous nodes before the extracted node, and then all the nodes with the same previous node list in the directed edges are merged, for example, the nodes with the same ID in the n-1 layers before the extracted node are merged into a new node o. j , and retain the first n-1 layers as the new ID of the new node, and then point the incoming edges of the nodes with the same ID to the new node o j , thereby realizing the exploitable vulnerability v of the extracted node i The update of the previous vulnerability set, and then merge the processed nodes (i.e. the new node o j ) is added to the queue, and the step of obtaining all the exploitable vulnerabilities of the nodes in the queue is returned until the previous node of the exploitable vulnerability is empty. It should be noted that if there is no node with the same ID, the previous node list is saved in the queue, and the step of obtaining all the exploitable vulnerabilities of the nodes in the queue is returned.

[0083] S3204, if it is empty, return to the step of determining whether the queue is an empty queue until the queue is an empty queue, return to the step of determining whether the node set is an empty set, until the node set is an empty set, and obtain the vulnerability exploitation chain of each node.

[0084] Specifically, if the previous node of the exploitable vulnerability is empty, return to the step of determining whether the queue is an empty queue until the queue is an empty queue, return to the step of determining whether the node set is an empty set, until the node set is an empty set, and obtain the vulnerability exploitation chain of each node. It should be noted that the final multi-granular attack graph includes all vulnerability exploitation chains, and the vulnerability exploitation chain includes nodes, exploitable vulnerabilities, exploitation conditions, attack vectors, and previous vulnerability sets, namely EL.

[0085] Optionally, the vulnerability exploitation relationship determination method further includes steps S410-S420:

[0086] S410, obtaining a starting point to be analyzed and an end point to be analyzed.

[0087] S420, forward search is performed in the multi-granularity attack graph according to the starting point to be analyzed until the end point to be analyzed is found, and an actual vulnerability exploitation relationship from the starting point to be analyzed to the end point to be analyzed is obtained.

[0088] Specifically, when it is necessary to analyze the attack path of two nodes, for example, determine a certain node as the starting point to be analyzed and a certain node as the end point to be analyzed, and then perform a forward search in the multi-granularity attack graph according to the starting point to be analyzed until the end point to be analyzed is found, thereby obtaining the actual vulnerability exploitation relationship from the starting point to be analyzed to the end point to be analyzed, that is, the vulnerability exploitation chain from the starting point to be analyzed to the starting point to be analyzed.

[0089] In summary, the vulnerability utilization relationship determination method of the embodiment of the present invention integrates the vulnerability knowledge graph constructed by the multi-source vulnerability knowledge base as data support, and combines the first network topology information and the second network topology information of the network topology to realize the representation and discovery of the utilization order relationship between the vulnerabilities of different granularity node formations, which is more comprehensive, efficient and diverse than the existing knowledge graph constructed from a single data source, and supports more comprehensive information collection and data analysis of devices and vulnerabilities; at the same time, the multi-granular vulnerability utilization relationship representation can more intuitively reflect the security status of the current network, effectively meet the security analysis needs of different scenarios, support more application scenarios, help guide penetration testing methods and attack paths, and also help to distinguish the most urgent vulnerabilities to be repaired and the key areas to be prevented, and timely formulate correct and efficient security defense strategies. In addition, the vulnerability knowledge graph construction and multi-granular attack graph construction processes are separated, and the vulnerability knowledge graph is combined with the network topology information to construct a topology with vulnerability information (second network topology information), and a multi-granular multi-granular attack graph is constructed based on the topology. Compared with the method of constructing a knowledge graph based on topology, it is more flexible, and the vulnerability knowledge graph is more universal.

[0090] The embodiment of the present invention also provides a vulnerability exploitation relationship determination device, comprising:

[0091] Establish a module for building a vulnerability knowledge graph;

[0092] A supplementing module is used to obtain first network topology information of the network topology, and supplement the first network topology information according to the vulnerability knowledge graph to obtain second network topology information; the network nodes of the network topology are divided into multiple nodes, and the nodes include at least components, devices and areas, and the second network topology information includes exploitable vulnerabilities, exploitation conditions and attack vectors of each node;

[0093] The construction module is used to construct a multi-granularity attack graph according to the network topology and the second network topology information; the multi-granularity attack graph includes the vulnerability exploitation relationship of the nodes.

[0094] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0095] The embodiment of the present invention also provides an electronic device, the electronic device includes a processor and a memory, the memory stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the vulnerability exploitation relationship determination method of the above embodiment. The electronic device of the embodiment of the present invention includes but is not limited to any smart terminal such as a mobile phone, a tablet computer, a computer and a car computer.

[0096] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0097] An embodiment of the present invention also provides a computer-readable storage medium, in which at least one instruction, at least one program, code set or instruction set is stored, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the vulnerability exploitation relationship determination method of the aforementioned embodiment.

[0098] The embodiment of the present invention also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the vulnerability exploitation relationship determination method of the aforementioned embodiment.

[0099] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0100] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0101] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, each functional unit in each embodiment of the present application can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0102] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0103] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A vulnerability exploitation relationship determination method, characterized in that: include: Build a vulnerability knowledge graph; Acquire first network topology information of a network topology, and perform supplementary processing on the first network topology information according to the vulnerability knowledge graph to obtain second network topology information; the network nodes of the network topology are divided into a plurality of nodes, the nodes at least include components, devices and areas, each of the nodes corresponds to a granularity, and the second network topology information includes an exploitable vulnerability, an exploitation condition and an attack vector of each of the nodes; Constructing a multi-granularity attack graph according to the network topology and the second network topology information; the multi-granularity attack graph includes vulnerability exploitation relationships of the nodes; The establishing of the vulnerability knowledge graph includes: Establishing an ontology model; the ontology model includes entities, relationships and attributes; the entities include vulnerabilities, and the attributes include at least the exploitation conditions, attack vectors, evaluations and hazard levels; Crawling the vulnerability knowledge base, updating the entity, the relationship, the attack vector, the exploitation condition, the evaluation, and the hazard level according to the crawling processing result, and generating an initial knowledge graph; The initial knowledge graph is mined to update the exploit condition determination vulnerability knowledge graph; and the multi-granularity attack graph is constructed according to the network topology and the second network topology information, including: Traversing the exploitable vulnerabilities of each of the nodes, when the pre-authority of the exploitable vulnerability of the node is less than or equal to the post-authority of the neighboring node, establishing a directed edge between the exploitable vulnerability, the node and the neighboring node; the directed edge represents an attack relationship between attacking the node with the exploitable vulnerability and attacking the neighboring node with the exploitable vulnerability on the node; Constructing the multi-granularity attack graph according to the directed edges; Each of the nodes has a corresponding hierarchical structure ID, and constructing the multi-granularity attack graph according to the directed edges includes: Adding nodes with an out-degree of 0 to a node set, and determining whether the node set is an empty set; the node is a component or a device; When the node set is a non-empty set, extract a node from the node set, modify the hierarchical ID of the extracted node to the hierarchical ID of the previous node of the extracted node, add the extracted node to a queue and delete it from the node set, determine whether the queue is an empty queue, and if the queue is not an empty queue, obtain all exploitable vulnerabilities of the nodes in the queue, and determine whether the preceding node of the exploitable vulnerability is empty: If it is not empty, reverse query is performed according to the exploitable vulnerabilities and the directed edges to determine the list of preceding nodes, nodes with the same preceding node list are merged, and the preceding vulnerability set of the exploitable vulnerabilities corresponding to the incoming edges of the nodes in the queue is determined according to the preceding node list to update the preceding vulnerability set of the exploitable vulnerabilities of the extracted nodes, the merged and processed nodes are added to the queue, and the step of obtaining all the exploitable vulnerabilities of the nodes in the queue is returned until the preceding node of the exploitable vulnerability is empty; If it is empty, return to the step of determining whether the queue is an empty queue until the queue is an empty queue, return to the step of determining whether the node set is an empty set until the node set is an empty set, and obtain the vulnerability exploitation chain of each node; the multi-granularity attack graph includes all vulnerability exploitation chains, and the vulnerability exploitation chain includes nodes, exploitable vulnerabilities, exploitation conditions, attack vectors, and preceding vulnerability sets.

2. The vulnerability exploitation relationship determination method according to claim 1, characterized in that: The obtaining of first network topology information of the network topology includes: Call the preset topology or scan the network topology through a vulnerability scanning tool to determine the first network topology information; the first network topology information includes relevant information of the nodes and the connection method of the nodes, wherein the relevant information of the components includes relevant information of hardware firmware, software, operating system and services.

3. The vulnerability exploitation relationship determination method according to claim 1, characterized in that: The utilization condition includes a pre-permission and a post-permission, and the first network topology information is supplemented according to the vulnerability knowledge graph to obtain the second network topology information, including: Searching for associated exploitable vulnerabilities in the vulnerability knowledge graph according to the component; The attribute corresponding to the exploitable vulnerability is queried and added to the first network topology information to obtain the second network topology information.

4. The vulnerability exploitation relationship determination method according to claim 1, characterized in that: The method further comprises: obtaining a starting point to be analyzed and an end point to be analyzed; A forward search is performed in the multi-granularity attack graph according to the starting point to be analyzed until the end point to be analyzed is found, thereby obtaining an actual vulnerability exploitation relationship from the starting point to be analyzed to the end point to be analyzed.

5. A device for implementing the vulnerability exploitation relationship determination method according to any one of claims 1 to 4, characterized in that: include: Establish a module for building a vulnerability knowledge graph; A supplementing module is used to obtain first network topology information of a network topology, and perform supplementary processing on the first network topology information according to the vulnerability knowledge graph to obtain second network topology information; the network nodes of the network topology are divided into a plurality of nodes, the nodes at least include components, devices and areas, each of the nodes corresponds to a granularity, and the second network topology information includes an exploitable vulnerability, an exploitation condition and an attack vector of each of the nodes; A construction module is used to construct a multi-granularity attack graph according to the network topology and the second network topology information; the multi-granularity attack graph includes the vulnerability exploitation relationship of the nodes.

6. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method as described in any one of claims 1-4.

Images