A system security quantification method and device, electronic equipment and storage medium

Abstract

The present disclosure provides a system security quantification method and device, electronic equipment and storage medium. The method comprises the following steps: obtaining vulnerability information and configuration information corresponding to a target system; constructing an attack graph corresponding to the target system by taking the vulnerability information and the configuration information as vulnerability points, wherein the attack graph comprises at least one attack path composed of the vulnerability points; for each attack path, determining an attack success probability corresponding to each vulnerability point according to a probability influence relationship between the vulnerability points and a corresponding set of preceding nodes in the attack path; and determining an attack risk value corresponding to the target system according to the attack success probability. The method can comprehensively consider the harmfulness of vulnerabilities and misconfigurations to system security, and provide an effective quantitative reference index for security evaluation of complex information systems.

Description

Technical Field

[0001] This disclosure relates to the field of information system configuration security technology, and more specifically, to a method, apparatus, electronic device, and storage medium for quantifying system security. Background Technology

[0002] With the rapid development of computer networks and the Internet of Things, as well as the emergence of new technologies such as cloud computing, big data, and blockchain, complex information systems effectively integrate technologies such as computers, information systems, the Internet of Things, mobile terminals, and big data, providing a unified and multifunctional information platform for various users. However, at the same time, due to the explosive growth in the technical components, business types, and information data covered by complex information systems, complex information systems face the challenges of a large number of components from multiple sources and heterogeneous and inconsistent configurations, resulting in extremely complex system configurations.

[0003] In recent years, misconfiguration has become one of the main causes of system failures, service interruptions, and downtime. Currently, the prevalent misconfiguration problem stems from two main reasons: firstly, information systems are becoming increasingly complex, with more functionalities and configuration items involved. As configuration items change more rapidly, misconfigurations are inevitable. Secondly, ordinary users often lack expertise in computer security, limiting their correct use of configuration options. For example, a large number of users incorrectly use default configurations, resulting in a mismatch between the configuration's security level and the actual security level. By exploiting these misconfigurations, external attackers can access default accounts, unprotected files, etc., leading to serious consequences such as data leaks, data loss, and unexpected system crashes. However, current system security assessments primarily focus on system vulnerabilities, often neglecting configuration security. Therefore, how to combine system configuration security with a quantitative assessment of the overall security of complex information systems has become an urgent problem to be solved. Summary of the Invention

[0004] This disclosure provides at least one method, apparatus, electronic device, and storage medium for quantifying system security, which can comprehensively consider the harm of vulnerabilities and misconfigurations to system security and provide effective quantitative reference indicators for the security assessment of complex information systems.

[0005] This disclosure provides a method for quantifying system security, the method comprising:

[0006] Obtain vulnerability information and configuration information corresponding to the target system;

[0007] Using the vulnerability information and the configuration information as vulnerabilities, an attack graph corresponding to the target system is constructed, wherein the attack graph includes at least one attack path composed of the vulnerabilities;

[0008] For each attack path, the probability of attack success for each vulnerability is determined based on the probabilistic relationship between the vulnerability and the corresponding set of preceding nodes in the attack path.

[0009] Based on the attack success probability, the attack risk value corresponding to the target system is determined.

[0010] In one optional implementation, for each attack path, determining the attack success probability corresponding to each vulnerability based on the probabilistic influence relationship between the vulnerability and the corresponding set of preceding nodes in the attack path specifically includes:

[0011] Determine the node type corresponding to each vulnerability in the attack graph, wherein the node type includes permission acquisition nodes and attack step nodes;

[0012] If the current vulnerability is the permission acquisition node, then determine the attack failure probability corresponding to the set of preceding nodes;

[0013] Based on the attack failure probability corresponding to the set of preceding nodes, determine the attack success probability corresponding to the current vulnerability.

[0014] If the current vulnerability is the attack step node, then determine the preset exploitability probability corresponding to the vulnerability and the attack success probability corresponding to the set of preceding nodes;

[0015] The attack success probability corresponding to the current vulnerability is determined based on the attack success probability corresponding to the set of preceding nodes and the preset exploitability probability.

[0016] In one optional implementation, determining the attack failure probability corresponding to the set of preceding nodes specifically includes:

[0017] Based on the attack graph, determine whether there are branch nodes before the vulnerability in the attack path where the vulnerability is located.

[0018] If it does not exist, the attack failure probability corresponding to the set of preceding nodes is represented by the integral operation of the attack failure probability corresponding to the vulnerability.

[0019] If it exists, then determine the attack failure probability corresponding to the branch node, and the failure condition probability corresponding to the set of preceding nodes under the condition that the attack on the branch node fails;

[0020] The attack failure probability corresponding to the set of preceding nodes is determined based on the attack failure probability corresponding to the branch node and the failure condition probability.

[0021] In one optional implementation, the attack success probability corresponding to the set of preceding nodes is determined based on the following steps:

[0022] Based on the attack graph, determine whether there are branch nodes before the vulnerability in the attack path where the vulnerability is located.

[0023] If it does not exist, the success probability of attack corresponding to the set of preceding nodes is represented by the integral operation of the success probability of attacking the vulnerability corresponding to the vulnerability.

[0024] If it exists, then determine the attack success probability corresponding to the branch node, and the success condition probability corresponding to the set of preceding nodes under the condition that the attack on the branch node is successful;

[0025] The attack success probability corresponding to the set of preceding nodes is determined based on the attack success probability corresponding to the branch node and the success condition probability.

[0026] In one alternative implementation, the branch node is determined based on the following steps:

[0027] D-separation processing is performed on the vulnerabilities in the attack graph to determine the minimum D-separation set corresponding to the attack graph;

[0028] The vulnerable points corresponding to the vertices in the minimum D separation set are identified as the branch nodes.

[0029] In one optional implementation, determining the preset exploitability probability corresponding to the vulnerability specifically includes:

[0030] When the vulnerability is the vulnerability information, determine the attack complexity index of the vulnerability information in the general vulnerability scoring system CVSS;

[0031] The preset exploit probability corresponding to the vulnerability information is determined based on the preset mapping relationship between the attack complexity index and the preset exploit probability.

[0032] When the vulnerability is the configuration information, a preset attack probability table for configuration items is accessed, wherein the attack probability table for configuration items stores the correspondence between the configuration information and the preset exploit probability.

[0033] Based on the correspondence, the preset availability probability corresponding to the configuration information is determined.

[0034] In one optional implementation, determining the attack risk value corresponding to the target system based on the attack success probability specifically includes:

[0035] Based on the attack success probability, determine the path attack probability corresponding to the attack path;

[0036] Based on the path attack probability, the attack risk value corresponding to the target system is determined.

[0037] This disclosure also provides a system security quantification device, the device comprising:

[0038] The acquisition module is used to obtain vulnerability information and configuration information corresponding to the target system.

[0039] An attack graph construction module is used to construct an attack graph corresponding to the target system based on the vulnerability information and the configuration information as vulnerabilities. The attack graph includes at least one attack path composed of the vulnerabilities.

[0040] The vulnerability attack quantification module is used to determine the attack success probability of each vulnerability point based on the probability influence relationship between the vulnerability point and the corresponding set of preceding nodes in the attack path for each attack path.

[0041] The network risk quantification module is used to determine the attack risk value corresponding to the target system based on the attack success probability.

[0042] In one optional implementation, the vulnerability attack quantification module is specifically used for:

[0043] Determine the node type corresponding to each vulnerability in the attack graph, wherein the node type includes permission acquisition nodes and attack step nodes;

[0044] If the current vulnerability is the permission acquisition node, then determine the attack failure probability corresponding to the set of preceding nodes;

[0045] Based on the attack failure probability corresponding to the set of preceding nodes, determine the attack success probability corresponding to the current vulnerability.

[0046] If the current vulnerability is the attack step node, then determine the preset exploitability probability corresponding to the vulnerability and the attack success probability corresponding to the set of preceding nodes;

[0047] The attack success probability corresponding to the current vulnerability is determined based on the attack success probability corresponding to the set of preceding nodes and the preset exploitability probability.

[0048] In one optional implementation, the vulnerability attack quantification module is further specifically used for:

[0049] Based on the attack graph, determine whether there are branch nodes before the vulnerability in the attack path where the vulnerability is located.

[0050] If it does not exist, the attack failure probability corresponding to the set of preceding nodes is represented by the integral operation of the attack failure probability corresponding to the vulnerability.

[0051] If it exists, then determine the attack failure probability corresponding to the branch node, and the failure condition probability corresponding to the set of preceding nodes under the condition that the attack on the branch node fails;

[0052] The attack failure probability corresponding to the set of preceding nodes is determined based on the attack failure probability corresponding to the branch node and the failure condition probability.

[0053] In one optional implementation, the vulnerability attack quantification module is further specifically used for:

[0054] Based on the attack graph, determine whether there are branch nodes before the vulnerability in the attack path where the vulnerability is located.

[0055] If it does not exist, the success probability of attack corresponding to the set of preceding nodes is represented by the integral operation of the success probability of attacking the vulnerability corresponding to the vulnerability.

[0056] If it exists, then determine the attack success probability corresponding to the branch node, and the success condition probability corresponding to the set of preceding nodes under the condition that the attack on the branch node is successful;

[0057] The attack success probability corresponding to the set of preceding nodes is determined based on the attack success probability corresponding to the branch node and the success condition probability.

[0058] In one optional implementation, the vulnerability attack quantification module is further specifically used for:

[0059] D-separation processing is performed on the vulnerabilities in the attack graph to determine the minimum D-separation set corresponding to the attack graph;

[0060] The vulnerable points corresponding to the vertices in the minimum D separation set are identified as the branch nodes.

[0061] In one optional implementation, the vulnerability attack quantification module is further specifically used for:

[0062] When the vulnerability is the vulnerability information, determine the attack complexity index of the vulnerability information in the general vulnerability scoring system CVSS;

[0063] The preset exploit probability corresponding to the vulnerability information is determined based on the preset mapping relationship between the attack complexity index and the preset exploit probability.

[0064] When the vulnerability is the configuration information, a preset attack probability table for configuration items is accessed, wherein the attack probability table for configuration items stores the correspondence between the configuration information and the preset exploit probability.

[0065] Based on the correspondence, the preset availability probability corresponding to the configuration information is determined.

[0066] In one optional implementation, the network risk quantification module is specifically used for:

[0067] Based on the attack success probability, determine the path attack probability corresponding to the attack path;

[0068] Based on the path attack probability, the attack risk value corresponding to the target system is determined.

[0069] This disclosure also provides an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the steps of the above-described system security quantification method, or any possible implementation of the above-described system security quantification method.

[0070] This disclosure also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the above-described system security quantification method or any possible implementation of the above-described system security quantification method.

[0071] This disclosure provides a method, apparatus, electronic device, and storage medium for quantifying system security. It involves acquiring vulnerability information and configuration information corresponding to a target system; constructing an attack graph for the target system using the vulnerability information and configuration information as vulnerabilities, wherein the attack graph includes at least one attack path composed of the vulnerabilities; determining the attack success probability for each vulnerability based on the probabilistic influence relationship between the vulnerability and the corresponding set of preceding nodes in the attack path; and determining the attack risk value for the target system based on the attack success probability. This approach comprehensively considers the harm of vulnerabilities and misconfigurations to system security, providing an effective quantitative reference indicator for the security assessment of complex information systems.

[0072] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0073] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the embodiments will be briefly described below. These drawings are incorporated in and constitute a part of this specification. They illustrate embodiments conforming to this disclosure and, together with the specification, serve to explain the technical solutions of this disclosure. It should be understood that the following drawings only show some embodiments of this disclosure and should not be considered as limiting the scope. Those skilled in the art can obtain other related drawings based on these drawings without creative effort.

[0074] Figure 1 A flowchart illustrating a method for quantifying system security provided by an embodiment of this disclosure is shown;

[0075] Figure 2 This illustration shows a vulnerability association diagram provided by an embodiment of the present disclosure;

[0076] Figure 3 A flowchart illustrating another method for quantifying system security provided by an embodiment of this disclosure is shown;

[0077] Figure 4 A schematic diagram of a system security quantification device provided in an embodiment of this disclosure is shown;

[0078] Figure 5 A schematic diagram of an electronic device provided in an embodiment of the present disclosure is shown. Detailed Implementation

[0079] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. The components of the embodiments of this disclosure described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed disclosure, but merely represents selected embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0080] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0081] In this document, the term "and / or" merely describes a relationship, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0082] Research has revealed that misconfiguration has become a major cause of system failures, service interruptions, and downtime in recent years. Currently, the prevalent misconfiguration problem stems from two main reasons: firstly, information systems are becoming increasingly complex, with more functionalities and configuration items involved. As configuration items change more rapidly, misconfigurations become inevitable. Secondly, ordinary users often lack expertise in computer security, limiting their correct use of configuration options. For example, a large number of users incorrectly use default configurations, resulting in a mismatch between the configuration's security level and the actual security level. By exploiting these misconfigurations, external attackers can access default accounts and unprotected files, leading to serious consequences such as data leaks, data loss, and unexpected system crashes. However, current system security assessments primarily focus on system vulnerabilities, often neglecting configuration security. Therefore, how to combine system configuration security with a quantitative assessment of the overall security of complex information systems has become an urgent problem to be solved.

[0083] Based on the above research, this disclosure provides a method, apparatus, electronic device, and storage medium for quantifying system security. The method involves acquiring vulnerability information and configuration information corresponding to a target system; constructing an attack graph for the target system using the vulnerability information and configuration information as vulnerabilities, wherein the attack graph includes at least one attack path composed of the vulnerabilities; for each attack path, determining the attack success probability corresponding to each vulnerability based on the probabilistic influence relationship between the vulnerability and the corresponding set of preceding nodes in the attack path; and determining the attack risk value corresponding to the target system based on the attack success probability. This method can comprehensively consider the harm of vulnerabilities and misconfigurations to system security, providing an effective quantitative reference indicator for the security assessment of complex information systems.

[0084] To facilitate understanding of this embodiment, a method for quantifying system security disclosed in this disclosure will first be described in detail. The execution entity of the method for quantifying system security provided in this disclosure is generally a computer device with certain computing capabilities. This computer device may include, for example, a terminal device, a server, or other processing devices. The terminal device may be a user equipment (UE), mobile device, user terminal, terminal, cellular phone, cordless phone, personal digital assistant (PDA), handheld device, computing device, in-vehicle device, wearable device, etc. In some possible implementations, the method for quantifying system security can be implemented by a processor calling computer-readable instructions stored in memory.

[0085] See Figure 1 The diagram shows a flowchart of a system security quantification method provided in this disclosure embodiment. The method includes steps S101 to S104, wherein:

[0086] S101. Obtain the vulnerability information and configuration information corresponding to the target system.

[0087] In practice, vulnerability scanning is performed on target systems requiring security assessments to collect information on vulnerabilities and configuration items present in the target systems. The vulnerabilities of the target systems primarily include: operating system vulnerabilities, inherent computer system vulnerabilities, electromagnetic leakage, data accessibility, weaknesses in communication systems and protocols, database system vulnerabilities, and network storage media vulnerabilities.

[0088] Vulnerability refers to inherent flaws in the software, hardware, protocol design, and security policies of a computer or network system. Its direct consequence is that unauthorized or illegal users gain access rights, thereby damaging the network system.

[0089] Here, the target system can be a network information system, which mainly includes: hosts (servers), routers, firewalls, access cards, camera devices, and a cloud platform built on the OpenStack cloud computing management platform and the Docker application container engine. Users can authenticate their identity through access cards or camera devices to use the relevant devices. Routers provide network services for the entire system, firewalls provide access control and protection for the entire system, and the cloud platform server is the core asset of the entire system.

[0090] Furthermore, vulnerability scans are performed on assets existing in the target system, such as hosts, routers, firewalls, access cards, cameras, and cloud platforms. Specifically, on the one hand, system vulnerability scanning and analysis software, such as Nessus, is used to scan for vulnerabilities in the assets, and on the other hand, scanning tools such as OpenScap are used to scan for compliance of configuration items in the assets.

[0091] It should be noted that for component configuration items not covered by the scanning tool, manual information collection was conducted. Finally, all vulnerability information and configuration information were combined to compile vulnerability information.

[0092] S102. Using the vulnerability information and the configuration information as vulnerabilities, construct an attack graph corresponding to the target system, wherein the attack graph includes at least one attack path composed of the vulnerabilities.

[0093] In practice, vulnerability information and configuration information are used as the vulnerabilities that can be attacked in the target system. By combining the attack methods that can be used for each vulnerability, the various vulnerabilities are connected to form multiple attack paths from the attacker to the target system. All attack paths are combined to form the attack graph corresponding to the target system.

[0094] Here, vulnerabilities can be categorized according to the corresponding devices or components. For example, vulnerabilities targeting the host may include: network card vulnerabilities, kernel vulnerabilities, service vulnerabilities, misconfigured user / group file permissions, and low security configuration of pluggable authentication modules (PAM).

[0095] Vulnerabilities in routers can include weak passwords and lack of configured security features; vulnerabilities in firewalls can include low security access control policies; vulnerabilities in access control cards can include low security encryption programs; vulnerabilities in cameras can include weak passwords and unencrypted data transmission and storage; vulnerabilities in the OpenStack cloud computing management platform can include low security component configurations and incorrect file permission configurations; and vulnerabilities in cloud platforms built with the Docker container engine can include low security configuration of the Docker daemon and incorrect file permission configurations.

[0096] As one possible implementation, since the host device has many vulnerabilities, there are also many possible attack paths. To illustrate this more clearly, a separate attack graph can be built for the host device.

[0097] In a host attack graph, attackers can launch attacks through the following vulnerabilities: Checking for vulnerabilities in the network card, kernel, and installed services (such as Apache, MySQL, etc.), and exploiting these vulnerabilities to gain host privileges; checking user / group files (passwd, shadow, group, gshadow, etc.), which typically store system user information, including passwords. Incorrect permission configurations in these files can lead to unauthorized access, allowing attackers to gain host privileges by illegally creating new users; checking the PAM authentication module, which allows configuring password complexity, such as minimum password length, the minimum number of numbers or uppercase and lowercase letters, and the maximum number of failed password attempts, locking the account after a certain number of attempts. Insecure configurations can allow attackers to obtain passwords through brute-force attacks; and TCP Wrappers, a transport layer security tool, can control access to stateful connections (such as vsftpd, sshd, telnet, etc.), acting as a firewall. Proper configuration can prevent attackers from exploiting vulnerabilities through these services.

[0098] Furthermore, after the host attack graph is constructed, an attack graph is constructed for the entire target system. This attack graph mainly includes vulnerability information of components such as firewalls, routers, access cards, cameras, OpenStack, and Docker. Attackers can launch attacks on the host (server) by checking the potential vulnerabilities of various devices and components.

[0099] For access control cards, the primary concern is their encryption program. If the encryption program is leaked or the stored system hardware and software are unreliable, attackers could gain host access by copying the card for authentication. For cameras, the main concerns are weak passwords and whether data transmission and storage are encrypted. If users use default passwords, they are easily cracked by attackers. If data transmission and storage are not encrypted, attackers could obtain passwords through methods such as eavesdropping.

[0100] Furthermore, router security primarily depends on whether weak passwords and security features are configured. Using weak passwords makes the router vulnerable to attackers. Router security features mainly include disabling directed broadcasts, disabling IP redirection, disabling IP source routing, and configuring the router to prevent address spoofing. Configuring these features can prevent attacks such as session hijacking, denial-of-service attacks, and information theft.

[0101] Furthermore, Docker primarily considers the security of daemon configuration and the correctness of file permissions. Daemon configuration refers to configuring security features for the daemon, such as TLS authentication and restricting containers from acquiring new permissions. If not configured correctly, attackers may exploit this to escape containers and gain host privileges. File permissions refer to the permissions of Docker configuration files and related certificate files (TLS CA certificate files, Docker server certificate files, etc.). If permissions are incorrect, attackers may have unauthorized access to related files and tamper with the configuration.

[0102] Furthermore, OpenStack primarily considers the security of component configurations and the correctness of file permissions. OpenStack has various components, such as Nova, Glance, and Neutron, each requiring different security configurations. For example, Glance should be configured with `image_size_cap`; otherwise, remote attackers could cause denial-of-service attacks by uploading large images. Nova should be configured to disable PCI passthrough for the hypervisor, thereby restricting direct access of virtual machines to host hardware. Similarly, OpenStack requires correctly assigning permissions to the configuration files of each component; otherwise, configurations can be easily tampered with.

[0103] S103. For each attack path, determine the attack success probability corresponding to each vulnerability based on the probability influence relationship between the vulnerability and the corresponding set of preceding nodes in the attack path.

[0104] In practice, for the constructed attack graph, the success probability of a path is calculated by combining the attack success probability of a single vulnerability on each attack path in the attack graph with the interrelationship between the vulnerabilities in the attack graph, thereby conducting a quantitative security assessment of the overall network.

[0105] Here, because the attack path is directional, there is a probabilistic influence relationship between vulnerabilities along the same attack path. Therefore, it is necessary to focus on the relationship between vulnerabilities.

[0106] For details, see Figure 2 The diagram shown is a schematic representation of a vulnerability association provided in an embodiment of this disclosure. Figure 2 As shown, the possible relationships between vulnerabilities can be three types: conjunction, disjunction, and mixed relationships. Different relationships require different calculation methods. Here, e1, e2, e3, e4, c1, and c2 all represent vulnerabilities.

[0107] Here, regarding conjunction, Figure 2This indicates that attack step e3 can only be executed if both conditions c1 and c2 are met. Furthermore, c1 and c2 can only be obtained through e1 and e2, respectively. In this case, the absolute probability of the attack success of node e3 is the product of the absolute probabilities of the attacks e1 and e2 and the conditional probability of the attack e3. The conditional probability indicates the probability that the attacker will successfully execute the corresponding attack when all the preconditions are met.

[0108] Furthermore, regarding conjunction, Figure 2 This indicates that condition c1 can be obtained through attack steps e1 or e2. Since the attack events that an attacker can initiate are independent of each other, the absolute probability of success of attack e2 is... in, Represents the absolute probability of an E1 attack failing; This represents the absolute probability of attack e2 failing. The absolute probability of e3 is the product of the absolute probability of c1 and the conditional probability of e3.

[0109] Furthermore, regarding mixed relationships, Figure 2 This indicates that condition c1 can only be obtained from attack step e1, while condition c2 can be obtained from attack steps e2 or e3. Calculating c2 is the process of handling disjunction, and calculating e4 is the process of handling conjunction.

[0110] As one possible implementation, step S103 can be achieved through the following steps S1031-S1035, see [link to relevant documentation]. Figure 3 The diagram shows a flowchart of another method for quantifying system security provided in this disclosure, the method including steps S1031 to S1035, wherein:

[0111] S1031. Determine the node type corresponding to each vulnerability in the attack graph, wherein the node type includes permission acquisition nodes and attack step nodes.

[0112] In practice, the vulnerabilities in the attack graph include two types of nodes: one is the permission acquisition node, which represents an "OR" relationship, meaning that there may be multiple attack paths that can acquire the permission; the other is the attack step node, which represents an "AND" relationship, meaning that all the prerequisites of the node must be met simultaneously before the attack step can be executed.

[0113] S1032. If the current vulnerability is the permission acquisition node, then determine the attack failure probability corresponding to the set of preceding nodes.

[0114] In practice, for a permission acquisition node, the attack status of the node is considered successful when at least one of the preceding nodes in the permission acquisition node's set is successfully attacked; conversely, the attack status of the node is considered failed only when all the preceding nodes in the permission acquisition node's set are attacked unsuccessfully.

[0115] As one possible implementation, the probability of attack failure corresponding to the set of preceding nodes can be determined based on the following steps for access control nodes:

[0116] Step 1: Based on the attack graph, determine whether there are branch nodes before the vulnerability in the attack path where the vulnerability is located.

[0117] In specific implementation, in order to handle the shared dependencies in the attack path, that is, the same vulnerability is used by multiple attack paths, which will affect the calculation of the success probability or failure probability of the current vulnerability, this embodiment needs to find the branch nodes on the attack path from the attack initiation node to the current vulnerability in the attack graph.

[0118] Here, at the branch node, the attack path forks, forming multiple attack paths.

[0119] As one possible implementation, branch nodes can be determined based on the following steps: performing D-separation processing on the vulnerabilities in the attack graph to determine the minimum D-separation set corresponding to the attack graph; and determining the vulnerabilities corresponding to the vertices in the minimum D-separation set as the branch nodes.

[0120] Here, to reduce computation time, it is necessary to find the minimum D-separation set corresponding to the attack graph. According to the definition of D-separation processing, the vertices in the separation set must be branch nodes. To identify the minimum D-separation set, it is only necessary to consider the branch nodes from the starting node of the attack to the current vulnerability. Once the branch nodes in the minimum D-separation set are determined, the current vulnerability becomes conditionally independent.

[0121] As one possible implementation, the set of branch nodes can be calculated using the following formula:

[0122]

[0123] Where χ(m)∩χ(n) represents all branch nodes on the attack path leading to any two vulnerabilities m and n; P represents the set of preceding nodes; and D represents the set of branch nodes.

[0124] It should be noted that this applies to nodes that require permission to acquire: Where p represents a specific preceding node in the set of preceding nodes P; for attack step nodes, Where GB represents the set of all branch nodes in the attack graph, and p represents a certain preceding node in the set of preceding nodes P.

[0125] Step 2: If it does not exist, the attack failure probability corresponding to the set of preceding nodes is represented by the integral operation of the attack failure probability corresponding to the vulnerability.

[0126] In practical implementation, for nodes that grant permissions, if there are no branch nodes before the vulnerability in the attack path where the vulnerability is located, the attack failure probability corresponding to the set of preceding nodes can be expressed by the following formula:

[0127]

[0128] in, P represents the attack failure probability corresponding to the set of preceding nodes; n represents the current vulnerability. D represents the probability of attack failure corresponding to the vulnerability; D represents the set of branch nodes.

[0129] Step 3: If it exists, determine the attack failure probability corresponding to the branch node, and the failure condition probability corresponding to the set of preceding nodes under the condition that the attack on the branch node fails.

[0130] Step 4: Determine the attack failure probability corresponding to the set of preceding nodes based on the attack failure probability corresponding to the branch node and the failure condition probability.

[0131] In practical implementation, for a node that grants access, if there are branch nodes before the vulnerability in the attack path where the vulnerability is located, the probability of attack failure corresponding to the set of preceding nodes can be expressed by the following formula:

[0132]

[0133] in, The probability of attack failure corresponding to the set of preceding nodes; P represents the set of preceding nodes; This represents the failure condition probability corresponding to the set of preceding nodes under the condition that the attack on the branch node fails; denoted by , represents the probability of attack failure corresponding to the branch node; D represents the set of branch nodes.

[0134] S1033. Determine the attack success probability corresponding to the current vulnerability point based on the attack failure probability corresponding to the set of preceding nodes.

[0135] In practical implementation, for nodes that require permission to acquire data, the probability of a successful attack on the current vulnerability can be determined using the following formula:

[0136]

[0137] Where Φ(n) represents the probability of a successful attack corresponding to the current vulnerability n; This represents the probability of attack failure corresponding to the set of preceding nodes.

[0138] S1034. If the current vulnerability is the attack step node, then determine the preset exploitability probability corresponding to the vulnerability and the attack success probability corresponding to the set of preceding nodes.

[0139] In practice, for each attack step node, it is necessary to obtain its preset exploitability probability in advance. This represents the probability that the attacker will successfully execute the corresponding attack when all preconditions are met, and it reflects the severity of a single vulnerability.

[0140] As one possible implementation, the preset exploitability probability can be determined through the following steps: when the vulnerability is the vulnerability information, determine the attack complexity index of the vulnerability information in the Common Vulnerability Scoring System (CVSS); determine the preset exploitability probability corresponding to the vulnerability information based on the preset mapping relationship between the attack complexity index and the preset exploitability probability; when the vulnerability is the configuration information, access a preset configuration item attack probability table, wherein the configuration item attack probability table pre-stores the correspondence between the configuration information and the preset exploitability probability; determine the preset exploitability probability corresponding to the configuration information based on the correspondence.

[0141] Here, for attack steps that exploit vulnerabilities, the exploitability of a single vulnerability can be evaluated using the Access Complexity metric from the Common Vulnerability Scoring System (CVSS). Specifically, the Access Complexity metric can be set to low, medium, or high, mapping them to preset exploit probabilities: {low→0.8, medium→0.5, high→0.2}, meaning that the higher the vulnerability exploitation complexity, the lower the attacker's chance of success. For attack steps that exploit insecure configuration items, since they lack an objective scoring system like vulnerabilities, it is necessary to combine historical attack events and expert experience to set their probability values.

[0142] It should be noted that the correspondence between configuration information and preset exploitable probabilities in the preset attack probability table can be set according to actual needs, and no specific restrictions are imposed here.

[0143] As one possible implementation, the probability of a successful attack on a set of preceding nodes can be determined based on the following steps:

[0144] Step 1: Based on the attack graph, determine whether there are branch nodes before the vulnerability in the attack path where the vulnerability is located.

[0145] Step 2: If it does not exist, the success probability of attack corresponding to the set of preceding nodes is represented by the integral operation of the success probability of attacking the vulnerability corresponding to the vulnerability.

[0146] In practical implementation, for attack step nodes, if there are no branch nodes before the vulnerability in the attack path where the current vulnerability is located, the attack success probability corresponding to the set of preceding nodes can be expressed by the following formula:

[0147]

[0148] Where Φ(P) represents the attack success probability corresponding to the set of preceding nodes; P represents the set of preceding nodes; n represents the current vulnerability; Φ(n) represents the attack success probability corresponding to the vulnerability; and D represents the set of branch nodes.

[0149] Step 3: If it exists, determine the attack success probability corresponding to the branch node, and the success condition probability corresponding to the set of preceding nodes under the condition that the attack on the branch node is successful.

[0150] Step 4: Determine the attack success probability corresponding to the set of preceding nodes based on the attack success probability corresponding to the branch node and the success condition probability.

[0151] In practical implementation, for attack step nodes, if there are branch nodes before the vulnerability in the attack path where the current vulnerability is located, the attack failure probability corresponding to the set of preceding nodes can be expressed by the following formula:

[0152]

[0153] Where Φ(P) represents the attack success probability corresponding to the set of preceding nodes; P represents the set of preceding nodes; Ψ(D,P) represents the success conditional probability corresponding to the set of preceding nodes under the condition that the branch node attack is successful; Φ(D) represents the attack success probability corresponding to the branch node; and D represents the set of branch nodes.

[0154] S1035. Determine the attack success probability corresponding to the current vulnerability point based on the attack success probability corresponding to the set of preceding nodes and the preset exploitability probability.

[0155] In practice, for each attack step, the probability of a successful attack on the current vulnerability can be determined using the following formula:

[0156] Φ(n) = p(n)·Φ(P)

[0157] Where Φ(n) represents the probability of a successful attack corresponding to the current vulnerability n; Φ(P) represents the probability of an unsuccessful attack corresponding to the set of preceding nodes; and p(n) represents the preset exploitability probability corresponding to the current vulnerability n.

[0158] S104. Determine the attack risk value corresponding to the target system based on the attack success probability.

[0159] In practice, for the constructed attack graph, the success probability of attacking a single vulnerability in the attack graph and the interrelationship between nodes are combined to calculate the success probability of attacking the attack path, thereby conducting a quantitative security assessment of the overall network.

[0160] Specifically, based on the attack success probability, the path attack probability corresponding to the attack path is determined; based on the path attack probability, the attack risk value corresponding to the target system is determined.

[0161] This disclosure provides a method for quantifying system security. It involves acquiring vulnerability information and configuration information corresponding to a target system; constructing an attack graph for the target system using the vulnerability information and configuration information as vulnerabilities, wherein the attack graph includes at least one attack path composed of the vulnerabilities; determining the attack success probability for each vulnerability based on the probabilistic influence relationship between the vulnerability and the corresponding set of preceding nodes in the attack path; and determining the attack risk value for the target system based on the attack success probability. This method comprehensively considers the harm of vulnerabilities and misconfigurations to system security, providing an effective quantitative reference indicator for the security assessment of complex information systems.

[0162] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0163] Based on the same inventive concept, this disclosure also provides a system security quantification device corresponding to the system security quantification method. Since the principle of the device in this disclosure for solving the problem is similar to the system security quantification method described above in this disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0164] Please see Figure 4 , Figure 4 This is a schematic diagram of a system security quantification device provided in an embodiment of this disclosure. Figure 4 As shown in the illustration, the system security quantification device 400 provided in this embodiment includes:

[0165] The acquisition module 410 is used to acquire vulnerability information and configuration information corresponding to the target system.

[0166] The attack graph construction module 420 is used to construct an attack graph corresponding to the target system based on the vulnerability information and the configuration information as vulnerabilities, wherein the attack graph includes at least one attack path composed of the vulnerabilities.

[0167] The vulnerability attack quantification module 430 is used to determine the attack success probability of each vulnerability point based on the probability influence relationship between the vulnerability point and the corresponding set of preceding nodes in the attack path for each attack path.

[0168] The network risk quantification module 440 is used to determine the attack risk value corresponding to the target system based on the attack success probability.

[0169] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0170] This disclosure provides a system security quantification device that acquires vulnerability information and configuration information corresponding to a target system; constructs an attack graph corresponding to the target system using the vulnerability information and configuration information as vulnerabilities, wherein the attack graph includes at least one attack path composed of the vulnerabilities; for each attack path, determines the attack success probability corresponding to each vulnerability based on the probability influence relationship between the vulnerability and the corresponding set of preceding nodes in the attack path; and determines the attack risk value corresponding to the target system based on the attack success probability. This device can comprehensively consider the harm of vulnerabilities and misconfigurations to system security, providing an effective quantitative reference indicator for the security assessment of complex information systems.

[0171] Corresponding to Figure 1 and Figure 3 In addition to the method for quantifying system security, this disclosure also provides an electronic device 500, such as... Figure 5 The diagram shown is a structural schematic of an electronic device 500 provided in an embodiment of this disclosure, including:

[0172] Processor 51, memory 52, and bus 53; memory 52 is used to store execution instructions, including main memory 521 and external memory 522; the main memory 521, also called internal memory, is used to temporarily store the computational data in processor 51, as well as the data exchanged with external memory 522 such as hard disk. Processor 51 exchanges data with external memory 522 through main memory 521. When the electronic device 500 is running, processor 51 and memory 52 communicate through bus 53, enabling processor 51 to execute... Figure 1 and Figure 3 The steps of the quantification method for system security in [the context of the text].

[0173] This disclosure also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the system security quantification method described in the above-described method embodiments. The storage medium may be a volatile or non-volatile computer-readable storage medium.

[0174] This disclosure also provides a computer program product, which includes computer instructions. When the computer instructions are executed by a processor, they can perform the steps of the system security quantification method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0175] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0176] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this disclosure, it should be understood that the disclosed device and method can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0177] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0178] In addition, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0179] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0180] Finally, it should be noted that the above-described embodiments are merely specific implementations of this disclosure, used to illustrate the technical solutions of this disclosure, and not to limit it. The protection scope of this disclosure is not limited thereto. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this disclosure. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be covered within the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be determined by the protection scope of the claims.

Claims

1. A method for quantifying system security, characterized in that, include: Obtain vulnerability information and configuration information corresponding to the target system; Using the vulnerability information and the configuration information as vulnerabilities, an attack graph corresponding to the target system is constructed, wherein the attack graph includes at least one attack path composed of the vulnerabilities; For each attack path, the probability of attack success for each vulnerability is determined based on the probabilistic relationship between the vulnerability and the corresponding set of preceding nodes in the attack path. Based on the attack success probability, determine the attack risk value corresponding to the target system; For each attack path, the success probability of the attack corresponding to each vulnerability is determined based on the probabilistic influence relationship between the vulnerability and the corresponding set of preceding nodes in the attack path. Specifically, this includes: Determine the node type corresponding to each vulnerability in the attack graph, wherein the node type includes permission acquisition nodes and attack step nodes; If the current vulnerability is the permission acquisition node, then determine the attack failure probability corresponding to the set of preceding nodes; Based on the attack failure probability corresponding to the set of preceding nodes, determine the attack success probability corresponding to the current vulnerability. If the current vulnerability is the attack step node, then determine the preset exploitability probability corresponding to the vulnerability and the attack success probability corresponding to the set of preceding nodes; Based on the attack success probability corresponding to the set of preceding nodes and the preset exploitability probability, determine the attack success probability corresponding to the current vulnerability. Determining the attack failure probability corresponding to the set of preceding nodes specifically includes: Based on the attack graph, determine whether there are branch nodes before the vulnerability in the attack path where the vulnerability is located. If it does not exist, the attack failure probability corresponding to the set of preceding nodes is represented by the product operation of the attack failure probabilities corresponding to the vulnerability points; If it exists, then determine the attack failure probability corresponding to the branch node, and the failure condition probability corresponding to the set of preceding nodes under the condition that the attack on the branch node fails; Based on the attack failure probability corresponding to the branch node and the failure condition probability, determine the attack failure probability corresponding to the set of preceding nodes; The attack success probability corresponding to the set of preceding nodes is determined based on the following steps: Based on the attack graph, determine whether there are branch nodes before the vulnerability in the attack path where the vulnerability is located. If it does not exist, the success probability of attack corresponding to the set of preceding nodes is represented by the product of the success probability of attacking the vulnerability corresponding to the vulnerability. If it exists, then determine the attack success probability corresponding to the branch node, and the success condition probability corresponding to the set of preceding nodes under the condition that the attack on the branch node is successful; The attack success probability corresponding to the set of preceding nodes is determined based on the attack success probability corresponding to the branch node and the success condition probability. The branch node is determined based on the following steps: D-separation processing is performed on the vulnerabilities in the attack graph to determine the minimum D-separation set corresponding to the attack graph; The vulnerable points corresponding to the vertices in the minimum D separation set are identified as the branch nodes; The determination of the preset exploitability probability corresponding to the vulnerability specifically includes: When the vulnerability is the vulnerability information, determine the attack complexity index of the vulnerability information in the general vulnerability scoring system CVSS; The preset exploit probability corresponding to the vulnerability information is determined based on the preset mapping relationship between the attack complexity index and the preset exploit probability. When the vulnerability is the configuration information, a preset attack probability table for configuration items is accessed, wherein the attack probability table for configuration items stores the correspondence between the configuration information and the preset exploit probability. Based on the correspondence, the preset availability probability corresponding to the configuration information is determined.

2. The method according to claim 1, characterized in that, The step of determining the attack risk value corresponding to the target system based on the attack success probability specifically includes: Based on the attack success probability, determine the path attack probability corresponding to the attack path; Based on the path attack probability, the attack risk value corresponding to the target system is determined.

3. A device for quantifying system safety, characterized in that, include: The acquisition module is used to obtain vulnerability information and configuration information corresponding to the target system. An attack graph construction module is used to construct an attack graph corresponding to the target system based on the vulnerability information and the configuration information as vulnerabilities. The attack graph includes at least one attack path composed of the vulnerabilities. The vulnerability attack quantification module is used to determine the attack success probability of each vulnerability for each attack path based on the probability influence relationship between the vulnerability and the corresponding set of preceding nodes in the attack path. Specifically, this includes: determining the node type corresponding to each vulnerability in the attack graph, wherein the node type includes permission acquisition nodes and attack step nodes; if the current vulnerability is a permission acquisition node, determining the attack failure probability corresponding to the set of preceding nodes; determining the attack success probability corresponding to the current vulnerability based on the attack failure probability corresponding to the set of preceding nodes; if the current vulnerability is an attack step node, determining the preset exploit probability corresponding to the vulnerability and the attack success probability corresponding to the set of preceding nodes; and determining the attack success probability corresponding to the current vulnerability based on the attack success probability corresponding to the set of preceding nodes and the preset exploit probability. The step of determining the attack failure probability corresponding to the set of preceding nodes specifically includes: based on the attack graph, determining whether there is a branch node before the vulnerability in the attack path where the vulnerability is currently located; if not, representing the attack failure probability corresponding to the set of preceding nodes by multiplying the attack failure probabilities corresponding to the vulnerability; if so, determining the attack failure probability corresponding to the branch node, and the failure condition probability corresponding to the set of preceding nodes under the condition that the branch node attack fails; and determining the attack failure probability corresponding to the set of preceding nodes based on the attack failure probability corresponding to the branch node and the failure condition probability. The attack success probability corresponding to the set of preceding nodes is determined based on the following steps: According to the attack graph, determine whether there is a branch node before the vulnerability in the attack path where the vulnerability is currently located; if not, represent the attack success probability corresponding to the set of preceding nodes by multiplying the vulnerability attack success probabilities corresponding to the vulnerability; if so, determine the attack success probability corresponding to the branch node, and the success conditional probability corresponding to the set of preceding nodes under the condition that the branch node attack is successful; determine the attack success probability corresponding to the set of preceding nodes based on the attack success probability corresponding to the branch node and the success conditional probability. The branch node is determined based on the following steps: performing D-separation processing on the vulnerability points in the attack graph to determine the minimum D-separation set corresponding to the attack graph; and determining the vulnerability points corresponding to the vertices in the minimum D-separation set as the branch nodes. The step of determining the preset exploitability probability corresponding to the vulnerability specifically includes: when the vulnerability is the vulnerability information, determining the attack complexity index of the vulnerability information in the Common Vulnerability Scoring System (CVSS); determining the preset exploitability probability corresponding to the vulnerability information based on the preset mapping relationship between the attack complexity index and the preset exploitability probability; when the vulnerability is the configuration information, accessing a preset configuration item attack probability table, wherein the configuration item attack probability table pre-stores the correspondence between the configuration information and the preset exploitability probability; and determining the preset exploitability probability corresponding to the configuration information based on the correspondence. The network risk quantification module is used to determine the attack risk value corresponding to the target system based on the attack success probability.

4. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is in operation, the processor communicates with the memory via the bus, and the machine-readable instructions, when executed by the processor, perform the steps of the system security quantification method as described in any one of claims 1 to 2.

5. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the method for quantifying system security as described in any one of claims 1 to 2.

Images