A network attack path planning method and device, electronic equipment and storage medium

Abstract

The present application relates to the technical field of network security, and particularly relates to a network attack path planning method and device, electronic equipment and a storage medium, wherein the method comprises: obtaining network topology information; constructing a target network accessible directed graph based on the network topology information; determining a starting asset node and a target asset node in the target network accessible directed graph; and calculating a best attack efficiency path from the starting asset node to the target asset node based on the target network accessible directed graph by using an improved ant colony algorithm. The present application can realize automatic planning of a network attack path.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to a network attack path planning method, device, electronic device, and storage medium. Background Art

[0002] As networks expand and cyberattacks become more modular, intelligent, and targeted, they are causing increasing cybersecurity challenges. Traditional security tools, such as firewalls and antivirus software, struggle to detect and address potential vulnerabilities and the security risks they pose. Penetration testing, as a controlled, simulated intrusion behavior, can uncover potential security flaws or system configuration issues by actively exploiting vulnerabilities, and has become a crucial tool for measuring network system security.

[0003] Penetration testing is a highly specialized activity that involves proactively analyzing a system for any weaknesses, technical flaws, or vulnerabilities. This process typically requires testers to possess diverse security knowledge and skills, resulting in high demands, time, and effort. Attack path planning, which involves selecting the most cost-effective, efficient, and precise sequence of actions from the attacker's perspective to achieve the intended penetration target, is an essential step in penetration testing. Summary of the Invention

[0004] Based on the problem that current penetration testing is too dependent on manual labor and difficult to automate, the embodiments of the present invention provide a network attack path planning method, device, electronic device and storage medium, which can automatically plan network attack paths and provide technical support for realizing the automation of the entire penetration testing process.

[0005] In a first aspect, an embodiment of the present invention provides a network attack path planning method, comprising:

[0006] Obtain network topology information;

[0007] Based on the network topology information, a target network accessible directed graph is constructed; the target network accessible directed graph has network assets as nodes, accessibility as directed edges, and attack effectiveness values ​​corresponding to the nodes as weights on the edges; the attack effectiveness values ​​are used to represent the utility of the attack;

[0008] Determining a starting asset node and a target asset node in the target network accessible directed graph;

[0009] Based on the target network accessible directed graph, an improved ant colony algorithm is used to calculate the optimal attack effectiveness path from the starting asset node to the target asset node; in the improved ant colony algorithm, the increment of pheromone is determined based on the sum of the attack effectiveness of the path, the attack effectiveness attenuation coefficient, and the length of the entire path.

[0010] Optionally, the network topology information includes network asset node names, accessibility relationships between network asset nodes, and vulnerability information of network asset nodes;

[0011] The step of constructing a target network accessible directed graph based on the network topology information includes:

[0012] Construct a list of network asset node links based on the network asset node names and the accessible relationships between network asset nodes;

[0013] Build a vulnerability list based on the network asset node name and vulnerability information of the network asset node;

[0014] Based on the network asset node link list and the vulnerability list, a target network accessible directed graph is constructed.

[0015] Optionally, the vulnerability information includes the degree of vulnerability damage;

[0016] The construction vulnerability list includes:

[0017] Determine the attack effectiveness value corresponding to the vulnerability based on the severity of the vulnerability.

[0018] Optionally, the vulnerability information includes a CVSS value of the vulnerability;

[0019] The construction vulnerability list includes:

[0020] Determine the attack effectiveness value corresponding to the vulnerability based on the CVSS value of the vulnerability.

[0021] Optionally, the attack effectiveness value corresponding to the node is determined based on the attack effectiveness value corresponding to the vulnerability existing in the node.

[0022] Optionally, the attack effectiveness value corresponding to the node is determined based on the maximum attack effectiveness value corresponding to each vulnerability existing in the node, or

[0023] The attack effectiveness value corresponding to the node is determined based on the average attack effectiveness value corresponding to each vulnerability existing in the node, or

[0024] The attack effectiveness value corresponding to the node is determined based on the sum of the attack effectiveness values ​​corresponding to the vulnerabilities existing in the node.

[0025] Optionally, in the improved ant colony algorithm, the pheromone increment expression is:

[0026]

[0027] Among them, Q is the pheromone enhancement coefficient, ω is the sum of the attack effectiveness of the path, λ is the attack effectiveness attenuation coefficient, L kis the length of the entire path.

[0028] In a second aspect, an embodiment of the present invention further provides a network attack path planning device, comprising:

[0029] Acquisition module, used to obtain network topology information;

[0030] a graph construction module, configured to construct a target network accessible directed graph based on the network topology information; the target network accessible directed graph has network assets as nodes, accessibility as directed edges, and attack effectiveness values ​​corresponding to the nodes as weights on the edges; the attack effectiveness values ​​are used to represent the utility of the attack;

[0031] A fixed-point module, configured to determine a starting asset node and a target asset node in the target network accessible directed graph;

[0032] A solution module is configured to calculate, based on the target network accessible directed graph, an optimal attack effectiveness path from the starting asset node to the target asset node using an improved ant colony algorithm; in the improved ant colony algorithm, the increment of pheromone is determined based on the sum of the attack effectiveness of the path, the attack effectiveness attenuation coefficient, and the length of the entire path.

[0033] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0034] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method described in any embodiment of this specification.

[0035] Embodiments of the present invention provide a network attack path planning method, device, electronic device and storage medium. The present invention constructs a directed graph accessible to the target network based on network topology information to simulate the actual network structure and avoid damage caused by testing the real network structure. The improved ant colony algorithm is used to calculate the optimal attack effectiveness path from the starting asset node to the target asset node, and the influence of the path length on the attack effectiveness is introduced. The automatic planning of the attack path can be realized, providing technical support for the automation of the entire penetration test process. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 This is a flow chart of a network attack path planning method provided by one embodiment of the present invention;

[0038] Figure 2 This is a hardware architecture diagram of an electronic device provided by one embodiment of the present invention;

[0039] Figure 3 This is a structural diagram of a network attack path planning device provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0041] As mentioned earlier, penetration testing is a highly specialized activity, requiring testers to possess diverse security knowledge and skills, knowledge gained through repeated practice. Furthermore, penetration testing often lasts for extended periods, spanning days or even weeks, and may even require repeated testing, inspection, and maintenance of network systems. Compared to traditional, manual penetration testing processes, automating the entire penetration testing process eliminates reliance on expert expertise, saves time and labor costs, and improves penetration efficiency, becoming the future direction of penetration testing.

[0042] Automatic attack path planning is essential for automated penetration testing. Attack path planning involves selecting the most cost-effective, efficient, and accurate action sequence from the attacker's perspective to achieve the intended penetration target. Existing attack path discovery methods are mostly based on attack graph models. While these methods can discover efficient attack paths when the network is small, they often suffer from slow computational speeds and inability to solve the problem as the network scales. The Ant Colony Optimization (ACO) algorithm is a swarm intelligence biomimetic algorithm. Inspired by the natural foraging behavior of ants, which consistently find an optimal path from their nest to a food source, it is developed to solve complex optimization problems. It is widely used in the path planning field, boasting outstanding search capabilities, high concurrency, and ease of integration with other algorithms. However, it has not yet been effectively applied to network attack path planning.

[0043] In view of this, the present invention provides a network attack path planning method, device, electronic device and storage medium based on an improved ant colony algorithm to improve the efficiency of network attack path planning and provide a theoretical basis and technical reference for automated penetration testing research.

[0044] The specific implementation of the above concept is described below.

[0045] Please refer to Figure 1 , an embodiment of the present invention provides a network attack path planning method, the method comprising:

[0046] Step 100: Obtain network topology information;

[0047] Step 102: Based on the obtained network topology information, a target network accessible directed graph is constructed; the target network accessible directed graph uses network assets as nodes, accessibility as directed edges, and attack effectiveness values ​​corresponding to the nodes as weights on the corresponding edges; the attack effectiveness values ​​are used to represent the utility of the attack;

[0048] This step 102 constructs a target network accessible directed graph to simulate a real network structure. The target network accessible directed graph may include multiple network assets. If network asset A can access network asset B, then there is a directed edge from node a representing network asset A to node b representing network asset B. The attack effectiveness value is used to represent the utility of attacking the corresponding node. That is, the weight of the directed edge from node a to node b is used to represent the utility of node a attacking node b, reflecting the attack benefit from attacking network asset A on network asset B, or the vulnerability of the network.

[0049] Step 104: determining a starting asset node and a target asset node in the target network accessible directed graph;

[0050] Step 106: Based on the target network accessible directed graph, an improved ant colony algorithm is used to calculate the optimal attack effectiveness path from the determined starting asset node to the target asset node. In the improved ant colony algorithm, the pheromone increment is determined based on the sum of the attack effectiveness of the path, the attack effectiveness attenuation coefficient, and the length of the entire path.

[0051] In this step 106, an improved ant colony algorithm is used to search for the best attack effectiveness path. Generally, the weight of the target network accessible directed graph is such that a larger weight indicates a higher risk. In step 106, a path with the maximum sum of attack effectiveness is calculated.

[0052] The present invention addresses the needs of automated penetration testing. Existing attack path planning methods may suffer from slow calculation speeds and inability to solve problems. Ant colony algorithms, while prominent in the field of path planning, have not yet been widely applied to network attack path planning, lacking applicability to network environments. A network attack path planning method based on an improved ant colony algorithm is proposed. In an embodiment of the present invention, a target network accessible directed graph is constructed based on network topology information to simulate the actual network structure, avoiding damage caused by testing the actual network structure and improving computational efficiency. Furthermore, the present invention utilizes the improved ant colony algorithm and the target network accessible directed graph to calculate the optimal attack effectiveness path from the starting asset node to the target asset node. During the calculation of the optimal attack effectiveness path, the pheromone increment is determined based on the sum of the attack effectiveness of the path, the attack effectiveness attenuation coefficient, and the length of the entire path. This incorporates the influence of path length on attack effectiveness, making it more adaptable to the characteristics of network attacks. The method provided by the present invention finds the attack path with the best attack effectiveness, which is also the attack path with the greatest vulnerability in the network, effectively understanding the maximum security risk of the network system. The present invention achieves automatic attack path planning, providing technical support for achieving full-process automation of penetration testing.

[0053] Described below Figure 1 How to perform the steps shown.

[0054] Optionally, with respect to step 100, “obtaining network topology information”, the network topology information includes at least the names of network asset nodes, the accessible relationships between network asset nodes, and vulnerability information of the network asset nodes.

[0055] The above information can effectively reflect the actual network system accessibility relationship and potential security risks.

[0056] Optionally, with respect to step 102, “constructing a target network accessible directed graph” further includes:

[0057] Construct a list of network asset node links based on the network asset node names and the accessible relationships between network asset nodes;

[0058] Build a vulnerability list based on the network asset node name and vulnerability information of the network asset node;

[0059] Based on the network asset node link list and the vulnerability list, a target network accessible directed graph is constructed.

[0060] By adopting the above embodiment, a network asset node link list and a vulnerability list can be constructed based on the accessible relationship between nodes and the vulnerability information of the nodes, so as to establish the target network accessible directed graph.

[0061] In a specific embodiment, a specific network asset node link list is shown in Table 1 below:

[0062] Table 1 A list of network asset node links

[0063]

[0064] In Table 1 above, PC1 to PC5 are the names of network asset nodes. The horizontal axis of Table 1 represents the starting asset node (referred to as the starting node), and the vertical axis represents the target asset node (referred to as the target node). The number 1 indicates that the target asset node is accessible from the starting asset node, and the number 0 indicates that the target asset node is inaccessible from the starting asset node. In other embodiments, other forms of network asset node link lists may also be used.

[0065] Furthermore, the vulnerability information existing in the network asset node includes: the degree of vulnerability damage;

[0066] The construction vulnerability list includes:

[0067] According to the severity of the vulnerability, determine the attack effectiveness value corresponding to the vulnerability and record it in the vulnerability list.

[0068] The vulnerability information obtained in the above embodiment includes the vulnerability severity, and the corresponding attack effectiveness value can be obtained based on the vulnerability severity evaluation. The advantage is that the processing speed is fast. For example, the vulnerability severity (super critical, high risk, medium risk and low risk) published by CNNVD can be used as the vulnerability information. The higher the vulnerability severity, the greater the attack effectiveness value. Super critical corresponds to 9.5, high risk corresponds to 8, medium risk corresponds to 5.5, and low risk corresponds to 2. In a specific embodiment, a specific vulnerability list is shown in Table 2 below:

[0069] Table 2 A list of vulnerabilities

[0070]

[0071] In Table 2 above, the vulnerability list includes the node name, vulnerability number, vulnerability severity, and corresponding attack effectiveness value, where the vulnerability number is the CVE number and the vulnerability severity is the vulnerability severity published by CNNVD.

[0072] In other embodiments, other forms of vulnerability information may also be used to determine the attack effectiveness value corresponding to the vulnerability.

[0073] Optionally, the vulnerability information includes a CVSS value of the vulnerability;

[0074] The construction vulnerability list includes:

[0075] Based on the CVSS value of the vulnerability, determine the attack effectiveness value corresponding to the vulnerability and record it in the vulnerability list.

[0076] The above embodiment can determine the attack effectiveness with higher accuracy, which has the advantage of higher accuracy in subsequent path planning, which is more in line with the actual network situation. In other embodiments, other attack effectiveness evaluation methods can also be used to determine the attack effectiveness with higher accuracy, which will not be detailed here.

[0077] Optionally, the attack effectiveness value corresponding to the node is determined based on the attack effectiveness value corresponding to the vulnerability existing in the node.

[0078] The above embodiment considers that a node representing a network asset may have multiple vulnerabilities, and the attack effectiveness value corresponding to each vulnerability may be different. As shown in Table 2, comprehensive evaluation of the attack effectiveness values ​​corresponding to each vulnerability is more helpful in determining the attack effectiveness value corresponding to the node.

[0079] Furthermore, the attack effectiveness value corresponding to the node is determined based on the maximum attack effectiveness value corresponding to each vulnerability existing in the node, or

[0080] The attack effectiveness value corresponding to the node is determined based on the average attack effectiveness value corresponding to each vulnerability existing in the node, or

[0081] The attack effectiveness value corresponding to the node is determined based on the sum of the attack effectiveness values ​​corresponding to the vulnerabilities existing in the node.

[0082] In the above embodiment, the attack effectiveness value corresponding to a node is determined based on the maximum attack effectiveness value corresponding to each vulnerability present at that node. Generally, a larger attack effectiveness value indicates a higher risk, so the attack effectiveness value is determined based on the maximum attack effectiveness value corresponding to each vulnerability present at the node; this maximum value reflects the maximum loss a single attack can cause. Alternatively, determining the attack effectiveness value corresponding to a node based on the average attack effectiveness value or the sum of the attack effectiveness values ​​corresponding to each vulnerability present at the node more comprehensively reflects the potential loss resulting from compromising the corresponding node. In other embodiments, the attack effectiveness value corresponding to a node can be determined based on other rules, as long as it can be used to represent the attack benefit of an attack path.

[0083] Optionally, for step 106, the improved ant colony algorithm includes the following two processes:

[0084] 1. State transfer process

[0085] At time t, the ant randomly selects the next node, and the probability ρ of ant k at node i choosing node j as the transfer target k ij (t) is calculated as follows:

[0086]

[0087] Among them, α is the information heuristic factor, which indicates the influence of pheromones. The larger its value, the more likely the ants are to choose the route with more pheromones. β is the expectation heuristic factor, which indicates the importance of the distance between two nodes. The larger its value, the greater the expectation function η. ij The more obvious the impact on ants; τ ij is the pheromone concentration on path (i, j) at time t, τ α ij (t) is τ ij α to the power of η ij is the heuristic information of the path (i, j) distance, usually defined as η ij =1 / d ij , d ij represents the distance between nodes i and j, η β ij (t) is η ij β power; allow k It is the set of nodes that ant k has not visited at time t, and taboo tables are often used to restrict access.

[0088] 2. Improved pheromone renewal process

[0089] To prevent pheromone accumulation from increasing the information heuristic effect and drowning out the expected heuristic effect, each ant needs to accumulate and volatilize the pheromones on the path after completing an iteration. At time t+n, the pheromone update formula on path (i, j) is:

[0090]

[0091] Among them, ρ (0<ρ<1) is the pheromone volatility factor, m represents the total number of ants, (1-ρ)τ ij (t) is the remaining pheromone volatilized, Δτ ij (t) is the pheromone increment at time t, Δτ k ij (t) represents the pheromone increment of the kth ant on path i, j) at time t.

[0092] When the traditional ant colony algorithm updates pheromones, the increment of pheromones is Q / L k Among them, Q is the pheromone enhancement coefficient, L k is the length of the entire path, that is, the sum of the lengths of all edges in the path. However, in network attack and defense confrontation, the factor that affects the optimal attack path is mainly the sum of the attack effectiveness of each attack node in the path (that is, the sum of the weights of the edges passed through). The higher the attack effectiveness value, the better the attack effect of the path. In addition, the length of the attack path will also affect the attack effect. As the attack path length increases, the attack effect will decrease accordingly. Therefore, the present invention improves the pheromone update rule. In the improved ant colony algorithm, the pheromone increment expression is:

[0093]

[0094] Among them, Q is the pheromone enhancement coefficient, ω is the sum of the attack effectiveness of the path, λ is the attack effectiveness attenuation coefficient, L k is the length of the entire path.

[0095] The above-mentioned embodiment improves the ant colony algorithm based on the characteristics of network attacks. The factor affecting the optimal attack path is mainly the sum of the attack effectiveness of each attack node along the path. In addition, the length of the attack path also affects the attack effect, and as the attack path length increases, the attack effect decreases accordingly. The present invention applies the ant colony algorithm's optimal solution technology to the field of network attack path planning, and introduces the impact of the network attack path length on the network attack effect into the network attack path planning, making the obtained results more in line with the requirements of network attack planning.

[0096] like Figure 2 、 Figure 3As shown, the embodiment of the present invention provides a network attack path planning device. The device embodiment can be implemented by software, hardware, or a combination of software and hardware. From the hardware level, as Figure 2 The figure shows a hardware architecture diagram of an electronic device where a network attack path planning device provided by an embodiment of the present invention is located. Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a logical device, the CPU of the electronic device in which it is located reads the corresponding computer program in the non-volatile memory into the internal memory and runs it. This embodiment provides a network attack path planning device, including:

[0097] Acquisition module 301, used to acquire network topology information;

[0098] A graph construction module 302 is configured to construct a target network accessible directed graph based on the network topology information; the target network accessible directed graph has network assets as nodes, accessibility as directed edges, and attack effectiveness values ​​corresponding to the nodes as weights on the edges; the attack effectiveness values ​​are used to represent the utility of the attack;

[0099] A fixed-point module 303 is configured to determine a starting asset node and a target asset node in the target network accessible directed graph;

[0100] The solution module 304 is configured to calculate, based on the target network accessible directed graph, an optimal attack effectiveness path from the starting asset node to the target asset node using an improved ant colony algorithm. In the improved ant colony algorithm, the pheromone increment is determined based on the sum of the attack effectiveness of the path, the attack effectiveness attenuation coefficient, and the length of the entire path.

[0101] In an embodiment of the present invention, the acquisition module 301 can be used to execute step 100 in the above method embodiment, the composition module 302 can be used to execute step 102 in the above method embodiment, the fixed point module 303 can be used to execute step 104 in the above method embodiment, and the solution module 304 can be used to execute step 106 in the above method embodiment.

[0102] Optionally, the acquisition module acquires network topology information, where the network topology information includes network asset node names, accessibility relationships between network asset nodes, and vulnerability information of network asset nodes;

[0103] The mapping module constructs a target network accessible directed graph based on the network topology information, including performing the following operations:

[0104] Construct a list of network asset node links based on the network asset node names and the accessible relationships between network asset nodes;

[0105] Build a vulnerability list based on the network asset node name and vulnerability information of the network asset node;

[0106] Based on the network asset node link list and the vulnerability list, a target network accessible directed graph is constructed.

[0107] Optionally, the vulnerability information includes the degree of vulnerability damage;

[0108] The mapping module builds a vulnerability list, including executing:

[0109] Determine the attack effectiveness value corresponding to the vulnerability based on the severity of the vulnerability.

[0110] Optionally, the vulnerability information includes a CVSS value of the vulnerability;

[0111] The mapping module builds a vulnerability list, including executing:

[0112] Determine the attack effectiveness value corresponding to the vulnerability based on the CVSS value of the vulnerability.

[0113] Optionally, the graph construction module constructs a directed graph accessible to the target network, and the attack effectiveness value corresponding to the node is determined based on the attack effectiveness value corresponding to the vulnerability existing in the node.

[0114] Optionally, the attack effectiveness value corresponding to the node is determined based on the maximum attack effectiveness value corresponding to each vulnerability existing in the node, or

[0115] The attack effectiveness value corresponding to the node is determined based on the average attack effectiveness value corresponding to each vulnerability existing in the node, or

[0116] The attack effectiveness value corresponding to the node is determined based on the sum of the attack effectiveness values ​​corresponding to the vulnerabilities existing in the node.

[0117] Optionally, in the improved ant colony algorithm, the pheromone increment expression is:

[0118]

[0119] Among them, Q is the pheromone enhancement coefficient, ω is the sum of the attack effectiveness of the path, λ is the attack effectiveness attenuation coefficient, L k is the length of the entire path.

[0120] It is understood that the structure illustrated in the embodiments of the present invention does not constitute a specific limitation on a network attack path planning device. In other embodiments of the present invention, a network attack path planning device may include more or fewer components than shown, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0121] The information interaction, execution process, etc. between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention and will not be repeated here.

[0122] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a network attack path planning method in any embodiment of the present invention is implemented.

[0123] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor executes a network attack path planning method according to any embodiment of the present invention.

[0124] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0125] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0126] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0127] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0128] In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0129] Each embodiment of the present invention has at least the following beneficial effects:

[0130] 1. In one embodiment of the present invention, a network attack path planning method and apparatus are provided. This method uses an improved ant colony algorithm to calculate the optimal attack effectiveness path from a starting asset node to a target asset node. This method takes into account the impact of path length on attack effectiveness, enabling automatic attack path planning and providing technical support for fully automated penetration testing processes.

[0131] 2. In one embodiment of the present invention, a network attack path planning method and device are provided, which construct a target network accessible directed graph based on network topology information. The network topology information includes the names of network asset nodes, the accessible relationships between network asset nodes, and the vulnerability information of network asset nodes. The constructed target network accessible directed graph can simulate the actual network structure and avoid damage caused by testing the real network structure.

[0132] It should be noted that, in this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0133] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk, etc. Various media that can store program codes.

[0134] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A network attack path planning method, characterized in that: include: Obtain network topology information; The network topology information includes the names of network asset nodes, the accessible relationships between network asset nodes, and vulnerability information of network asset nodes; Construct a list of network asset node links based on the network asset node names and the accessible relationships between network asset nodes; Build a vulnerability list based on the network asset node name and vulnerability information of the network asset node; Based on the network asset node link list and the vulnerability list, a target network accessible directed graph is constructed; the target network accessible directed graph has network assets as nodes, accessibility as directed edges, and attack effectiveness values ​​corresponding to the nodes as weights on the edges; the attack effectiveness values ​​are used to represent the utility of the attack; Determining a starting asset node and a target asset node in the target network accessible directed graph; Based on the target network accessible directed graph, an improved ant colony algorithm is used to calculate an optimal attack effectiveness path from the starting asset node to the target asset node; in the improved ant colony algorithm, the increment of pheromone is determined based on the sum of the attack effectiveness of the path, the attack effectiveness attenuation coefficient, and the length of the entire path; If the vulnerability information includes vulnerability damage levels, then the step of constructing a vulnerability list includes: determining attack effectiveness values ​​corresponding to the vulnerabilities according to the vulnerability damage levels; If the vulnerability information includes a CVSS value of the vulnerability, then the step of constructing the vulnerability list includes: determining an attack effectiveness value corresponding to the vulnerability based on the CVSS value of the vulnerability; In the improved ant colony algorithm, the incremental expression of the pheromone is: in, is the pheromone enhancement coefficient, is the sum of the attack effectiveness of the path, is the attack effectiveness attenuation coefficient, is the length of the entire path.

2. The method according to claim 1, characterized in that The attack effectiveness value corresponding to the node is determined based on the attack effectiveness value corresponding to the vulnerability existing in the node.

3. The method according to claim 2, characterized in that The attack effectiveness value corresponding to the node is determined based on the maximum attack effectiveness value corresponding to each vulnerability existing in the node, or The attack effectiveness value corresponding to the node is determined based on the average attack effectiveness value corresponding to each vulnerability existing in the node, or The attack effectiveness value corresponding to the node is determined based on the sum of the attack effectiveness values ​​corresponding to the vulnerabilities existing in the node.

4. A network attack path planning device, characterized in that: include: Acquisition module, used to obtain network topology information; The network topology information includes the names of network asset nodes, the accessible relationships between network asset nodes, and vulnerability information of network asset nodes; A graph construction module, used to construct a list of network asset node links based on the network asset node names and the accessible relationships between the network asset nodes; Build a vulnerability list based on the network asset node name and vulnerability information of the network asset node; Based on the network asset node link list and the vulnerability list, a target network accessible directed graph is constructed; the target network accessible directed graph has network assets as nodes, accessibility as directed edges, and attack effectiveness values ​​corresponding to the nodes as weights on the edges; the attack effectiveness values ​​are used to represent the utility of the attack; A fixed-point module, configured to determine a starting asset node and a target asset node in the target network accessible directed graph; A solution module is configured to calculate, based on the target network accessible directed graph, an optimal attack effectiveness path from the starting asset node to the target asset node using an improved ant colony algorithm; in the improved ant colony algorithm, the increment of pheromone is determined based on the sum of the attack effectiveness of the path, the attack effectiveness attenuation coefficient, and the length of the entire path; If the vulnerability information includes vulnerability damage levels, then the step of constructing a vulnerability list includes: determining attack effectiveness values ​​corresponding to the vulnerabilities according to the vulnerability damage levels; If the vulnerability information includes a CVSS value of the vulnerability, then the step of constructing the vulnerability list includes: determining an attack effectiveness value corresponding to the vulnerability based on the CVSS value of the vulnerability; In the improved ant colony algorithm, the incremental expression of the pheromone is: in, is the pheromone enhancement coefficient, is the sum of the attack effectiveness of the path, is the attack effectiveness attenuation coefficient, is the length of the entire path.

5. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 3 is implemented.

6. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 3.

Images