A markov attack path prediction method based on cvss

Abstract

The application discloses a Markov attack path prediction method based on CVSS, and specifically comprises the following steps: step 1, scanning network host vulnerability information to generate a configuration file of.nessus; step 2, generating an attack graph: importing the configuration file generated in the previous step into Mulval, associating information between various host vulnerabilities through Mulval, and generating an attack graph; step 3, constructing a state transition graph: obtaining a simplified state transition graph according to the attack graph generated in step 2; step 4, initializing a Markov probability transition matrix: obtaining a probability transition matrix according to the state transition graph; and step 5, predicting an attack path probability. The method adopts a mode of measuring attack benefits to accurately predict a path to a single vulnerability level, realizes multi-step and multi-time prediction, simplifies the prediction method, and solves the problems of path redundancy, rationality and effectiveness of prior probability setting in the prediction path of the Bayesian model.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network control, and specifically relates to a Markov attack path prediction method based on CVSS. BACKGROUND

[0002] With the rapid development of network technology, human life has become very convenient, and various network attack activities are common, which has seriously affected the information security of individuals and society, and network security is facing severe challenges, so it is particularly important to take quick and efficient defense measures against specific network attacks. The first task of taking defense measures is to obtain the attack path of the attacker. Attack graph, as a model-based network security evaluation technology, finds all possible attack paths based on comprehensive analysis of various network configurations and vulnerability information from the perspective of the attacker. On this basis, defense strategies can be effectively selected to repair vulnerabilities that threaten nodes.

[0003] The commonly used attack path prediction is based on the attack graph and adopts the Bayesian model, knowledge graph and other methods, which can calculate the attack path according to the attack graph to a certain extent, but has its own defects and problems, and the above methods mostly predict the attack type, the stage where the attack type stays, and cannot be accurate to the vulnerability exploitation level. When the Bayesian model is used to predict the attack path, a prior probability needs to be known at the beginning, and the prior probability is often dependent on assumptions in many cases, which will lead to a large difference between the accuracy of the prediction result and the actual result. Secondly, there is a problem of node confidence calculation error caused by path redundancy when the path is predicted. In order to solve the problems in predicting the attack path by the Bayesian model and the knowledge graph, the Markov process is introduced in the application.

[0004] A Markov process is a class of stochastic process, given a process, the conditional probability distribution of future states given the present state and all past states is independent of the past states. In short, the probability of a state occurring in a stochastic process depends only on its previous state, and has nothing to do with the states at other times. And in the Markov process, the probability of the current state and the probability of the past state and the probability of the future state are independent and irrelevant. If a non-periodic Markov chain has a state transition matrix P, and its any two states are connected, then after enough times of probability transition, a stable state will be reached. The randomness and stability of the Markov process can be well combined with the behavior of the attacker attacking the network node. The selection of the target of the attacker when attacking is random, and each attack behavior is independent and has no influence on each other. If the attack probability of the current state of the attacker is known, the next attack of the attacker can be predicted. In the past, when predicting the attack path, only single-step and single-time prediction can be made. Taking the Bayesian model to predict the path as an example, the probability of the child node can be calculated only when the probability of the current node is known, and only the probability at this time can be predicted. When using the Markov model to predict the attack path, as long as the state transition matrix is obtained, multi-step and multi-time probability prediction can be made. The rationality and effectiveness of the prior probability setting when using the Bayesian model to predict the path are solved, and there is no path redundancy problem.

[0005] Common Vulnerability Scoring System (CVSS) is an industry standard for assessing the severity of system security vulnerabilities. CVSS has entered the third version, its main purpose is to help people establish a standard for measuring the severity of vulnerabilities, so that people can compare the severity of vulnerabilities, so as to determine the priority of handling them. The present application evaluates the attack benefits of the vulnerabilities existing in the network system by using the base score, the exploitability score and the way the attacker takes to launch an attack in the vulnerability evaluation, and then predicts the attack path, which accurately predicts the attack to the level of a single vulnerability.

[0006] In view of the problems of single-step, single-time, path redundancy and rationality of prior probability setting in the attack path prediction by using Bayesian model and knowledge graph, a Markov attack path prediction method based on CVSS is proposed based on CVSS and Markov process, which realizes multi-step and multi-time attack path prediction and solves the problems in the attack path prediction by using Bayesian model and knowledge graph, and realizes multi-step and multi-time attack path prediction. In summary, compared with the previous attack path prediction method, the Markov model combined with the CVSS vulnerability scoring details has the following innovations: first, the attack path prediction is accurately refined to the single vulnerability level by measuring the attack benefit. Second, multi-step and multi-time path prediction is realized. Third, the rationality and effectiveness of the prior probability setting of the Bayesian model path prediction are solved. SUMMARY

[0007] The application designs a Markov attack path prediction method based on CVSS. The purpose is to solve the problems of path redundancy and rationality and effectiveness of prior probability setting in the Bayesian path prediction model, and to accurately refine the attack prediction to the single vulnerability level by measuring the attack benefit.

[0008] To achieve the above purpose, the application provides the following technical scheme: a Markov attack path prediction method based on CVSS, specifically comprising the following steps:

[0009] Step 1, scanning network host vulnerability information: first, select the host or network segment to be scanned by using the Nessus vulnerability scanning tool, obtain the detailed information of the host vulnerability, and generate the configuration file of.nessus;

[0010] Step 2, generating an attack graph: importing the configuration file generated in the above step into Mulval, associating the information between the host vulnerabilities by Mulval, and generating an attack graph;

[0011] Step 3, constructing a state transition graph: simplifying the attributes and conditions of the attack graph according to the attack graph generated in step 2, and obtaining a simplified state transition graph;

[0012] Step 4, initializing the Markov probability transition matrix: initializing the node information of the state transition graph according to the state transition graph, and obtaining the probability transition matrix;

[0013] Step 5, predicting the attack path probability: according to the Markov initialization probability transition matrix and the current state vector, predicting the state probability at the next time, and stopping until the Markov stable state is reached.

[0014] The initialization of the Markov probability transition matrix in step 4 is a three-tuple (S, M, H), wherein S represents a state set of nodes, S = {S1, S2, S3, S4, S5, S6, S7}, wherein S1 represents an initial state, i.e., a state of an attacker, S7 represents a final state, i.e., a final target state of the attacker, and the remaining states are transition states;

[0015] M represents a Markov state transition matrix, representing a probability of transition from one state to another state;

[0016]

[0017] u ai = ((NP*DC i *DL)-L*OL*EXP) (1)

[0018] In formula 1), u ai represents a benefit obtained by attacking the i-th node; NP represents a node property, mainly including two types of nodes, a transition node and a target node, and the calculation methods of the transition node and the target node are different;

[0019] Transition node:

[0020] Target node:

[0021] wherein NP represents a transition node, NP o represents a target node, N represents a total number of nodes, N t represents a number of transition nodes, and N o represents a number of target nodes; DC i represents a node importance, which is calculated by formula 4) and is measured by a degree centrality of the node;

[0022]

[0023] wherein N represents a total number of nodes, k i represents a sum of an out-degree and an in-degree of the node, a is a parameter; DL represents a dangerous fatal degree of the node, which is measured by a CVSS score of a vulnerability; L represents a length of an attack path; OL represents an operation cost of attack; and EXP represents a difficulty of vulnerability exploitation, which is obtained from specific information of the vulnerability according to published vulnerability information;

[0024]

[0025] Formula 5) is used to initialize elements in the state transition matrix, M si，sjs i s j s i s i s aj s

[0026]

[0027] The formula 6) is a constraint condition of the Markov process, and the sum of all probabilities from the current state to the next possible state is 1, that is, the sum of each row element of the Markov probability transition matrix must be 1.

[0028] H represents the state combination of the initialization vector, and there are 7 states in total, so there are 7 initialization vectors, H={H1, H2, H3, H4, H5, H6, H7}, and the function of the initialization vector is to predict together with the probability transition matrix.

[0029] Compared with the prior art, the beneficial effects of the present application are as follows:

[0030] The present application combines the CVSS vulnerability scoring details, and the attack path method based on the Markov model, compared with other attack path prediction models, the characteristics are that the attack path prediction is accurately to the single vulnerability level by using the attack income measurement method, multi-step and multi-time prediction is realized, the method used for prediction is simplified, but the accuracy rate does not decrease, and the rationality and effectiveness of the prior probability setting in the Bayesian model prediction path and the problem of path redundancy are solved.

[0031] Since the current attack is mostly advanced persistent threat (APT) attack, its main features are strong targeting, high concealment and long duration. The general firewall and intrusion detection system are matched according to the specific parameters in the network data packet, and have a certain lag, and have no way to prevent the attack from happening, so it is difficult to implement effective defense, so it is necessary to effectively predict the attack path. But the general attack path prediction can only achieve single-step prediction, that is, it can only predict the probability of the first stage of the attack, or single-time prediction, which can only predict the probability of the attack intention at the first attack time, and cannot predict the attack path probability at the next time. Attackers launch attacks mainly through the way of exploiting vulnerabilities to obtain information or obtain permissions, which can be linked to the Markov model, combined with the CVSS vulnerability scoring details, scanning the vulnerabilities in the network system, and evaluating the attack benefits of the existing vulnerabilities, and then predicting through the Markov model. The Markov model is used to predict the attack path, which can achieve multi-stage prediction and multi-time prediction, and can well solve the above two problems, and accurately predict the single vulnerability of the attack. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 A CVSS-based Markov attack path prediction flowchart of the application;

[0033] Figure 2 A Nessus vulnerability scanning result of the application;

[0034] Figure 3 A network topology graph of the application;

[0035] Figure 4 An attack graph of the application;

[0036] Figure 5 A state transition graph of the application. DETAILED DESCRIPTION

[0037] The technical solutions of the embodiments of the application will be clearly and completely described below with reference to the drawings of the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all embodiments. Based on the embodiments of the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0038] The application is a Markov model-based attack path prediction method based on CVSS, and the flowchart is as shown in Figure 1 The specific implementation steps are as follows:

[0039] Step 1, scanning network host vulnerability information: first, through the Nessus vulnerability scanning tool, selecting the network segment to be scanned as 10.102.4.1-10.102.4.40, a total of 8 host vulnerability details are obtained, as shown in Figure 2 , the host vulnerability information scanned is generated in the configuration file of.nessus;

[0040] Step 2, generating an attack graph: according to the configuration file of.nessus generated in the previous step, an attack graph is generated by Mulval, and the information between the host vulnerabilities is associated by Mulval to generate an attack graph as Figure 4 ;

[0041] Step 3, constructing a state transition graph: according to the attack graph of the network node generated in step 2 Figure 4 ) and the network topology graph of the node Figure 3 ), the properties and conditions of the attack graph are simplified, unnecessary branches are pruned, and a simplified state transition graph is obtained, which contains the specific information of the host position in the network and the vulnerabilities existing on the host;

[0042] Step 4, initializing the Markov probability transition matrix: the Markov model constructed by the present application is a three-tuple (S, M, H), wherein S represents the state set of the node, which is known from Figure 5 , a total of 7 states, S = {S1, S2, S3, S4, S5, S6, S7}, wherein S1 represents the initial state, i.e. the state of the attacker, S7 represents the final state, i.e. the final target state of the attacker, and the remaining states are transition states.

[0043] M represents the Markov state transition matrix, which represents the probability of transitioning from one state to another.

[0044]

[0045] The element initialization calculation is completed by formula 1), formula 5), and formula 6).

[0046] u ai = ((NP*DC i *DL)-L*OL*EXP) (1)

[0047] In formula 1), u ai represents the income obtained by attacking the i-th node. NP represents the node property, mainly including two types of nodes, transition nodes and target nodes, and the calculation methods are different.

[0048] Transition node:

[0049] Target node:

[0050] where NP t represents the transition node, NP o represents the target node, N represents the total number of nodes, N t represents the number of transition nodes of the node, N o represents the number of target nodes; DC i represents the importance of the node, which is calculated by formula 4), which is measured by the out-degree and in-degree of the node.

[0051]

[0052] where N represents the total number of nodes, k i represents the sum of the out-degree and in-degree of the node, a is a parameter; DL represents the dangerous and fatal degree of the node, which can be measured by the CVSS score of the vulnerability; L represents the length of the attack path; OL represents the operation cost of the attack; EXP represents the difficulty of vulnerability exploitation, which can be obtained from the specific information of the published vulnerability information.

[0053]

[0054] Formula 5) is to initialize the elements in the state transition matrix, M si，sj represents the probability of transitioning from s i state to s j state, dout(s i ) represents the out-degree of node s i , u aj represents the benefit of attacking the jth node, and the state transition matrix of the entire Markov process can be obtained by formula 4).

[0055]

[0056] Formula 6) is a constraint condition of Markov process, which is the sum of all probabilities of transitioning from the current state to the next possible state is 1, that is, the sum of each row elements of the Markov probability transition matrix must be 1.

[0057] H represents the state combination of the initialization vector, which is Figure 5 known that there are a total of 7 states, so there are 7 initialization vectors, H = {H1, H2, H3, H4, H5, H6, H7}, the main function of the initialization vector is to predict together with the probability transition matrix.

[0058] Step 5, predicting attack path probability: according to the Markov initialization probability transition matrix M and the current state vector H obtained in step 4, the state probability at the next time can be predicted until the Markov stable state is reached.

[0059] P(X t |X1,X2,X3,...X t-1 )=P(X t |X t-1 ),t=1,2,... (7)

[0060] Equation 7) represents the Markov process, which is only related to the state at t-1 time and has nothing to do with the rest of the state. At t=1, the probability of the state at t=2 can be predicted according to the current state vector H1 and the state transition matrix M By analogy, the probability of the state at t time can be obtained Thus, the probability of the rest of the state at t time can be obtained. Until the probability of all states at t time is the same as that at t-1 time, that is, the Markov stable state is reached.

[0061] Example 1: the following is based on Figures 2-5 , the implementation of the Markov attack path prediction method based on CVSS is described in detail.

[0062] First, corresponding to step 1, scan the vulnerability information of the network host. Since the ip address of the host is 10.102.4.92, the vulnerability information of the host with ip in 10.102.4.1-10.102.4.40 is scanned, and the information as shown in Figure 2 ) is obtained, and finally the scanned vulnerability information is generated.nessus file export.

[0063] Secondly, corresponding to step 2, generate attack graph. The.nessus configuration file generated in the previous step is first converted into.p file through nessus_translate.sh command, and then the.p file is generated into attack graph in pdf format through graph_gen.sh nessus.P-v command.

[0064] Thirdly, corresponding to step 3, build state transition graph: simplify the attack graph generated in the previous step, cut and delete unimportant conditions and information, and only keep the network host information and the vulnerability information required to reach the current host state, to obtain a simplified state transition graph.

[0065] Then corresponding to step 4, the Markov probability transition matrix is initialized: according to the state transition graph, the node information is initialized, the income that can be obtained by attacking each node is calculated according to formula 1), and then each element M i，j is initialized according to formula 5), and finally the elements of each row in the matrix are constrained, the sum of the probabilities of the current state reaching the next possible state is always 1, and then the probability transition matrix M is obtained as follows:

[0066]

[0067] Finally, corresponding to step 5, the attack path probability is predicted: according to the Markov initialization probability transition matrix M obtained in step 4 and the current state vector H, the state probability of the next time is predicted until the Markov stable state is reached. The results of the first prediction are shown in Table 1, according to the state transition graph of Figure 5 There are a total of 11 attack paths from the initial node S1 to the target node S7, and the cumulative attack success probability of the 11 attack paths and the probability of the 11 attack paths, i.e. the probability size in the 11 attack paths, are given, and the cumulative attack success probability and the probability of each path at each time before reaching the stable state can be calculated by analogy, achieving the purpose of multi-step, multi-time attack path prediction.

[0068]

[0069]

[0070] Table 1 Path prediction probability

[0071] Although embodiments of the present application have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions and alterations can be made without departing from the principles and spirit of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A Markov attack path prediction method based on CVSS, characterized in that, Specifically, the following steps are included: Step 1, Scan for network host vulnerabilities: First, use the Nessus vulnerability scanning tool to select the host or network segment to be scanned, obtain detailed information on host vulnerabilities, and generate a .nessus configuration file; Step 2, Generate Attack Graph: Import the configuration file generated in the previous step into Mulval, and use Mulval to associate the information between the vulnerabilities of each host to generate an attack graph; Step 3, Construct a state transition diagram: Based on the attack graph generated in Step 2, simplify the attributes and conditions of the attack graph to obtain a simplified state transition diagram; Step 4, Initialize the Markov probability transition matrix: Based on the state transition diagram, initialize the node information of the state transition diagram to obtain the probability transition matrix; Step 5, predict the attack path probability: Based on the Markov initialization probability transition matrix and the current state vector, predict the state probability at the next moment until the Markov steady state is reached. In step 4, the initialization of the Markov probability transition matrix is ​​a triple (S, M, H), where S represents the set of node states, S = {S1, S2, S3, S4, S5, S6, S7}, where S1 represents the initial state, i.e. the state of the attacker, S7 represents the final state, i.e. the attacker's final target state, and the other states are transition states. M represents the Markov state transition matrix, which represents the probability of transitioning from one state to another. u ai =((NP*DC i *DL)-L*OL*EXP) (1) In equation 1), u ai This represents the profit gained from attacking the i-th node; the node is NP-hard, including two types of nodes: transitional nodes and target nodes; the calculation methods for transitional nodes and target nodes are different. Transition Node: Target node: NP t This represents a transition node, NP. o N represents the target node, and N represents the total number of nodes. t N represents the number of transition nodes in a node. o This indicates the number of target nodes; DC i This represents the importance of a node, calculated using Equation 4), and the degree centrality is measured by the out-degree and in-degree of the node. Where N represents the total number of nodes, k i represents the sum of the out-degree and in-degree of a node, where 'a' is a parameter; DL represents the criticality and lethality of a node, measured by the vulnerability's CVSS score; L represents the length of the attack path; OL represents the operational cost of performing the attack; EXP represents the difficulty of exploiting the vulnerability, obtained from published vulnerability information. Equation 5) initializes the elements in the state transition matrix, M si,sj It means from s i State transition to s j The probability of a state, dout(s) i ) represents the out-degree of node i, u aj This represents the reward for attacking the j-th node. The state transition matrix of the entire Markov process can be obtained through Equation 4). Equation 6) is a constraint condition of the Markov process, which is that the sum of all probabilities of transitioning from the current state to the next possible state is 1, that is, the sum of the elements in each row of the Markov probability transition matrix must be 1. H represents the state combination of the initialization vector. There are a total of 7 states, so there are 7 initialization vectors: H = {H1, H2, H3, H4, H5, H6, H7}. The role of the initialization vector is to make predictions together with the probability transition matrix.

Images