Attack information prediction method and prediction device

Abstract

The disclosure provides an attack information prediction method and device, and relates to the field of network and information security. A set of attack methods of a to-be-predicted attack IP pair is collected, the attack IP pair comprising an attacker IP and an attack target IP; a first attack chain of the to-be-predicted attack IP pair is formed according to the set of attack methods of the to-be-predicted attack IP pair currently collected and attack stages to which each attack method belongs; the first attack chain is subjected to complete matching and fuzzy matching with known attack chains, so as to obtain matched attack chains; and an optimal matched attack chain is selected from the matched attack chains, and is used as an attack chain of the to-be-predicted attack IP pair predicted. Through the fuzzy matching of the attack chain in different attack stages, the prediction range in the attack chain prediction process is expanded, the attack chain prediction success rate is increased, and the real attack chain data that cannot be captured due to complete matching is reduced.

Description

Technical Field

[0001] This disclosure relates to the field of network and information security, and in particular to an attack information prediction method and device. Background Technology

[0002] Currently, cybersecurity professionals are no longer limited to processing single-point triggered alerts. Instead, they increasingly use comprehensive observation of attackers' attack paths and methods over a specific time period from different log sources to obtain attack chains. Therefore, attack chains have become a crucial basis for determining system damage and preventing attacks in advance. Summary of the Invention

[0003] This disclosure expands the prediction range in the attack chain prediction process by performing fuzzy matching on the attack chain at different attack stages, increases the success rate of attack chain prediction, and reduces the amount of real attack chain data that is not captured due to perfect matching.

[0004] This disclosure provides an attack information prediction method through several embodiments, including:

[0005] Collect a set of attack methods for the attack IP pairs to be predicted. The attack IP pairs include the attacker's IP and the target IP.

[0006] Based on the collection of attack methods of the IP pairs to be predicted and the attack stages to which each attack method belongs, the first attack chain of the IP pairs to be predicted is formed.

[0007] The first attack chain is matched with the known attack chain by full matching and fuzzy matching to obtain the matching attack chain. Fuzzy matching means that at least some nodes of the first attack chain are different from the corresponding nodes of the known attack chain, but the attack methods of the nodes of the known attack chain include the attack methods of the corresponding nodes of the first attack chain, and the other nodes of the first attack chain are the same as the corresponding nodes of the known attack chain.

[0008] The optimal matching attack chain is selected from the matching attack chains and used as the attack chain for the predicted attack IP pair.

[0009] In some embodiments, each node in the attack chain can characterize the attack phase to which the node belongs and the attack method employed by the node.

[0010] In some embodiments, each combination of attack phase and attack method corresponds to a master number. If any first combination has the same attack phase as any second combination and the attack method of the second combination includes the attack method of the first combination, the second combination also corresponds to a sub-number, and the value of the sub-number of the second combination is the master number of the first combination. The master numbers of each combination of attack methods and corresponding attack phases of the currently collected attack IP pairs to be predicted are chained together in the order of attack phases to form the first attack chain of the attack IP pairs to be predicted.

[0011] In some embodiments, performing full matching and fuzzy matching between the first attack chain and known attack chains to obtain a matching attack chain includes:

[0012] A known attack chain that perfectly matches each of the major numbers of the first attack chain is considered a perfect match attack chain.

[0013] If at least some nodes of the first attack chain have different primary numbers from the corresponding nodes of the known attack chain, but the primary numbers of these nodes of the first attack chain exist in the sub-numbers of the corresponding nodes of the known attack chain, and the other nodes of the first attack chain have the same primary number as the corresponding nodes of the known attack chain, then the known attack chain that meets the aforementioned conditions is designated as a fuzzy matching attack chain.

[0014] In some embodiments, selecting the optimal matching attack chain from the matching attack chains includes: if there are multiple matching attack chains, comparing the occurrence counts of the multiple matching attack chains, and selecting the matching attack chain with the highest occurrence count as the optimal matching attack chain.

[0015] In some embodiments, selecting the optimal matching attack chain from the matching attack chains further includes: if there are multiple matching attack chains that occur most frequently, comparing the occurrence frequency of the next stage attack method in the matching attack chains, and selecting the matching attack chain that occurs most frequently in the next stage attack method as the optimal matching attack chain.

[0016] In some embodiments, an attack pre-attack stage is provided in each attack stage, and the fuzzy matching is performed on the attack pre-attack stage.

[0017] In some embodiments, a fuzzy coefficient is provided, and the fuzzy matching is performed on a corresponding number of attack phases according to the fuzzy coefficient.

[0018] In some embodiments, each attack phase includes a detection phase, a payload delivery phase, an attack penetration phase, a tool installation phase, and a malicious activity phase; the pre-attack phase includes a detection phase and a payload delivery phase.

[0019] In some embodiments, the next stage of the attack method in the optimal matching attack chain is used as the predicted attack behavior of the attacker IP in the next stage.

[0020] Some embodiments of this disclosure provide an attack information prediction apparatus, including: a memory; and a processor coupled to the memory, the processor being configured to execute an attack information prediction method based on instructions stored in the memory.

[0021] Some embodiments of this disclosure propose a non-transitory computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of an attack information prediction method. Attached Figure Description

[0022] The accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. This disclosure can be more clearly understood from the following detailed description with reference to the accompanying drawings.

[0023] Obviously, the accompanying drawings described below are merely some embodiments of this disclosure. Those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0024] Figure 1 A flowchart illustrating an attack information prediction method according to some embodiments of this disclosure is shown.

[0025] Figure 2 A schematic diagram of the structure of an attack information prediction apparatus according to some embodiments of the present disclosure is shown. Detailed Implementation

[0026] The technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0027] Unless otherwise stated, the terms "first," "second," etc., used in this disclosure are used to distinguish different objects and are not used to indicate size or sequence.

[0028] Figure 1 A flowchart illustrating an attack information prediction method according to some embodiments of this disclosure is shown.

[0029] like Figure 1 As shown, the attack information prediction method in this embodiment includes the following steps.

[0030] In step 110, a set of attack methods for the attack IP (Internet Protocol) pairs to be predicted is collected. The attack IP pairs include the attacker's IP and the target IP.

[0031] A collection of attack methods for the IP pairs to be predicted can be gathered from the logs. Attack methods include, but are not limited to, Trojans, flood attacks, password intrusion, and URL spoofing, etc., which are not limited in this disclosure.

[0032] In step 120, a first attack chain for the predicted attack IP pair is formed based on the collection of attack methods of the currently collected attack IP pairs and the attack stage to which each attack method belongs.

[0033] The attack phases include, for example, the detection phase, the payload delivery phase, the attack penetration phase, the tool installation phase, and the malicious activity phase. Among these, the detection phase and the payload delivery phase serve as pre-attack phases.

[0034] Each node in the various attack chains disclosed herein can characterize the attack stage to which the node belongs and the attack method employed by the node.

[0035] Each combination of attack phase and attack method corresponds to a primary number. If any first combination has the same attack phase as any second combination, and the attack method of the second combination includes the attack method of the first combination, the second combination also corresponds to a sub-number, the value of which is the primary number of the first combination.

[0036] The main IDs of each combination of attack methods and corresponding attack stages of the currently collected attack IP pairs to be predicted are linked together in the order of the attack stages to form the first attack chain of the attack IP pairs to be predicted.

[0037] In step 130, the first attack chain is fully matched and fuzzy matched with the known attack chains to obtain the matched attack chain.

[0038] A known attack chain is an attack chain formed based on historical experience data. A complete match means that all nodes of the first attack chain are exactly the same as those of the known attack chain. A fuzzy match means that at least some nodes of the first attack chain are different from the corresponding nodes of the known attack chain, but the attack methods of those nodes in the known attack chain include the attack methods of the corresponding nodes in the first attack chain, and the other nodes of the first attack chain are the same as the corresponding nodes of the known attack chain.

[0039] Based on the aforementioned primary and secondary numbers, perform full matching and fuzzy matching to obtain matching attack chains, including: taking known attack chains that fully match each primary number of the first attack chain as full matching attack chains; if at least some nodes of the first attack chain have different primary numbers from the corresponding nodes of the known attack chain, but the primary numbers of these nodes of the first attack chain exist in the secondary numbers of the corresponding nodes of the known attack chain, and the other nodes of the first attack chain have the same primary numbers as the corresponding nodes of the known attack chain, then take known attack chains that meet the aforementioned conditions as fuzzy matching attack chains.

[0040] Fuzzy matching can be performed on all attack stages or on select attack stages. For example, as mentioned earlier, each attack stage includes a pre-attack phase. Fuzzy matching can be performed on the pre-attack phase, while precise matching is performed on the other attack stages. The pre-attack phases include the detection phase and the payload delivery phase. The attack methods in these two phases are more diverse and complex. Therefore, adding fuzzy matching to the pre-attack phases can increase the matching probability of the pre-attack phases, thereby avoiding the loss of real attack chain data due to perfect matching in the pre-attack phases and improving the success rate of attack chain prediction.

[0041] A fuzzy coefficient can also be set, and fuzzy matching can be performed on a corresponding number of attack stages according to the fuzzy coefficient, thereby controlling the range of the matching result expansion. For example, if the fuzzy coefficient is 1, fuzzy matching can be performed on one attack stage, and if the fuzzy coefficient is 2, fuzzy matching can be performed on two attack stages. The value of the fuzzy coefficient can be preset.

[0042] In step 140, the optimal matching attack chain is selected from the matching attack chains as the attack chain for the predicted attack IP pair. The next stage attack method in the optimal matching attack chain can also be used as the next stage attack behavior of the predicted attacker IP.

[0043] If there is only one matching attack chain, that matching attack chain is taken as the optimal matching attack chain. If there are multiple matching attack chains, the occurrence frequency of each matching attack chain is compared, and the matching attack chain with the highest occurrence frequency is taken as the optimal matching attack chain. If there are multiple matching attack chains with the highest occurrence frequency, the occurrence frequency of the next stage attack method within each matching attack chain is compared, and the matching attack chain with the highest occurrence frequency of the next stage attack method is taken as the optimal matching attack chain. Thus, the most likely attack chain is found, which is used as the predicted attack chain.

[0044] By applying fuzzy matching to different stages of the attack chain, the prediction range in the attack chain prediction process is expanded, increasing the success rate of attack chain prediction and reducing the amount of real attack chain data missed due to perfect matching. Furthermore, considering the greater diversity and complexity of attack techniques in the pre-attack stages, adding fuzzy matching in these stages can increase the matching probability, thereby avoiding the loss of real attack chain data due to perfect matching in these stages and improving the success rate of attack chain prediction. In addition, limiting the fuzzy coefficient of the fuzzy matching can control the range of the expanded matching results.

[0045] Attack chain prediction conditions: Assume the attack chain consists of five stages: detection, payload delivery, attack penetration, tool installation, and malicious activity. Each attack stage is treated as a node. Predicting the behavior of the next stage of the attack chain begins when the number of adjacent nodes is greater than or equal to 2.

[0046] Fuzzy matching attack phase numbering method: When a new combination of attack techniques and attack phases appears, a new main number is assigned, and the existing combinations are queried to see if there is a sub-number of the new combination, or whether the new combination is a sub-number of other combinations.

[0047] During prediction: When a matching attack method is found, its main number is taken, and it is checked whether the main number exists in the sub-numbers of other combinations. If it exists, the prediction considers multiple possibilities of the attack chain where the main number is located and the attack chain where the sub-number is located.

[0048] The following is an example of an application for predicting attack information.

[0049] The table below is a collection of attack method numbers.

[0050]

[0051] Assume the attack chain is known as follows:

[0052] [A1,B1,C1,D2,E1]5, [A2,B2,C1,D2,E1]8, [A3,B1,C1,D1,E1]9, [A3,B1,C1,D1,E2]2,

[0053] [A3,B2,C1,D1,E1]6, [A3,B2,C1,D2,E1]7, [A3,B2,C1,D2,E2]9

[0054] The numbers outside the square brackets represent the number of times the attack chain appears.

[0055] Assume the currently detected set of IP attack methods is as follows:<v1;w1,w2;x2,x3>

[0056] 1. The attack chain is formed as follows: [A1, B1, C1]

[0057] 2. Based on the attack chain query, A1 and B1 exist in the sub-numbers of A3 and B2, therefore fuzzy matching is possible.

[0058] 3. Find a matching attack chain within the known attack chains.

[0059] [A1,B1,C1,D2,E1]5, [A3,B1,C1,D1,E1]9, [A3,B1,C1,D1,E2]2, [A3,B2,C1,D1,E1]6, [A3,B2,C1,D2,E1]7, [A3,B2,C1,D2,E2]9

[0060] 4. Compare the occurrence counts of matching attack chains. The highest number of occurrences of the attack chains are equal, both being 9.

[0061] 5. Compare the number of times the next attack method occurs; D1 > D2

[0062] 6. The predicted behavior of the attacking IP in the next stage is likely to be D1, i.e., y4.

[0063] Continue monitoring the logs. If, at this point, the IP address is detected to have added v2 and w3 to the attack method set, then the attack method set is...<v1,v2;w1,w2,w3;x2,x3>

[0064] 1. The attack chain is formed as follows: [A3, B2, C1]

[0065] 2. According to the attack chain query, A3, B2, and C1 do not exist in the sub-numbers of other combinations, therefore fuzzy matching is not possible.

[0066] 3. Find a matching attack chain within the known attack chains.

[0067] [A3,B2,C1,D1,E1]6, [A3,B2,C1,D2,E1]7, [A3,B2,C1,D2,E2]9

[0068] 4. Compare the occurrence counts of matching attack chains; the value should be [A3, B2, C1, D2, E2]9.

[0069] 5. The predicted behavior of the attacking IP in the next stage is D2, i.e., y1+y4.

[0070] Continue monitoring the logs. If, at this point, the IP address is detected to be adding y1 and y4 to the attack method set, then the attack method set is...<v1,v2;w1,w2,w3;x2,x3;y1,y4>

[0071] 1. The attack chain is: [A3, B2, C1, D2]

[0072] 2. According to the attack chain query, A3, B2, and C1 do not exist in the sub-numbers of other combinations, therefore fuzzy matching is not possible.

[0073] 3. Find a matching attack chain within the known attack chains.

[0074] [A3,B2,C1,D2,E1]7, [A3,B2,C1,D2,E2]9

[0075] 4. Compare the occurrence counts of matching attack chains; the value should be [A3, B2, C1, D2, E2]9.

[0076] 5. The next stage of the attacking IP is predicted to be E2, i.e., z6.

[0077] Figure 2 A schematic diagram of the structure of an attack information prediction apparatus according to some embodiments of the present disclosure is shown.

[0078] like Figure 2 As shown, the attack information prediction device 200 of this embodiment includes: a memory 210 and a processor 220 coupled to the memory 210. The processor 220 is configured to execute the attack information prediction method in any of the foregoing embodiments based on instructions stored in the memory 210.

[0079] The memory 210 may include, for example, system memory, fixed non-volatile storage media, etc. The system memory stores, for example, the operating system, application programs, boot loader, and other programs.

[0080] The processor 220 can be implemented using a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistors, or other discrete hardware components.

[0081] The attack information prediction device 200 may also include an input / output interface 230, a network interface 240, a storage interface 250, etc. These interfaces 230, 240, 250, and the memory 210 and processor 220 can be connected, for example, via a bus 260. The input / output interface 230 provides a connection interface for input / output devices such as a monitor, mouse, keyboard, and touchscreen. The network interface 240 provides a connection interface for various networked devices. The storage interface 250 provides a connection interface for external storage devices such as SD cards and USB flash drives. The bus 260 can use any bus architecture from various bus structures. For example, bus architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MCA) bus, and the Peripheral Component Interconnect (PCI) bus.

[0082] Some embodiments of this disclosure propose a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the attack information prediction method of any one of claims 1-10.

[0083] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more non-transitory computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer program code.

[0084] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0085] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0086] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0087] The above description is only a preferred embodiment of this disclosure and is not intended to limit this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the protection scope of this disclosure.

Claims

1. An attack information prediction method, characterized in that, include: Collect a set of attack methods for the attack IP pairs to be predicted. The attack IP pairs include the attacker's IP and the target IP. Based on the collection of attack methods for the currently collected attack IP pairs to be predicted and the attack stages to which each attack method belongs, the main numbers of each combination of attack methods and corresponding attack stages of the currently collected attack IP pairs to be predicted are linked together in the order of the attack stages to form the first attack chain of the attack IP pairs to be predicted. Each node in the attack chain can represent the attack stage to which the node belongs and the attack method used by the node. Each combination of attack stage and attack method corresponds to a main number. If any first combination has the same attack stage as any second combination and the attack method of the second combination includes the attack method of the first combination, the second combination also corresponds to a sub-number. The value of the sub-number of the second combination is the main number of the first combination. The first attack chain is matched with the known attack chain by full matching and fuzzy matching to obtain the matching attack chain. Fuzzy matching means that at least some nodes of the first attack chain are different from the corresponding nodes of the known attack chain, but the attack methods of the nodes of the known attack chain include the attack methods of the corresponding nodes of the first attack chain, and the other nodes of the first attack chain are the same as the corresponding nodes of the known attack chain. The optimal matching attack chain is selected from the matching attack chains and used as the attack chain for the predicted attack IP pair.

2. The method according to claim 1, characterized in that, Performing full and fuzzy matching between the first attack chain and known attack chains yields the following matched attack chains: A known attack chain that perfectly matches each of the major numbers of the first attack chain is considered a perfect match attack chain. If at least some nodes of the first attack chain have different primary numbers from the corresponding nodes of the known attack chain, but the primary numbers of these nodes of the first attack chain exist in the sub-numbers of the corresponding nodes of the known attack chain, and the other nodes of the first attack chain have the same primary number as the corresponding nodes of the known attack chain, then the known attack chain that meets the aforementioned conditions is designated as a fuzzy matching attack chain.

3. The method according to claim 1, characterized in that, Selecting the optimal matching attack chain from the matching attack chains includes: If there are multiple matching attack chains, compare the occurrence counts of the multiple matching attack chains and select the matching attack chain with the highest occurrence count as the optimal matching attack chain.

4. The method according to claim 3, characterized in that, Selecting the optimal matching attack chain from the matching attack chain also includes: If there are multiple matching attack chains with the most occurrences, compare the occurrence frequency of the next stage attack method in each matching attack chain, and select the matching attack chain with the most occurrences of the next stage attack method as the optimal matching attack chain.

5. The method according to claim 1, characterized in that, Each attack phase includes an attack pre-phase, and the fuzzy matching is performed on the attack pre-phase.

6. The method according to claim 1, characterized in that, A fuzzy coefficient is set, and fuzzy matching is performed on a corresponding number of attack stages according to the fuzzy coefficient.

7. The method according to claim 5, characterized in that, Each attack phase includes the detection phase, payload delivery phase, attack penetration phase, tool installation phase, and malicious activity phase; The pre-attack phase includes the detection phase and the payload delivery phase.

8. The method according to any one of claims 1-7, characterized in that, The next stage of the attack method in the optimal matching attack chain is used as the predicted attack behavior of the attacker's IP in the next stage.

9. An attack information prediction device, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the attack information prediction method of any one of claims 1-8 based on instructions stored in the memory.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the attack information prediction method of any one of claims 1-8.

Images