A network attack prediction method based on ATT&CK framework

Abstract

The present invention relates to the field of network security, and in particular to a network attack prediction method based on the ATT&CK framework. The method comprises determining a used feature sequence of a target attack event according to the ATT&CK threat framework. The used feature sequence is processed for similarity with each historical feature sequence in a historical event feature library, and the similarity between each historical technique and tactic and the used feature sequence is generated. The historical feature sequence whose corresponding similarity is greater than a prediction threshold is determined as a target prediction feature sequence. Based on the attack features in the target prediction feature sequence, attack information of the target attack event occurring at a future moment is generated. The present invention uses a historical event feature library to perform similarity calculation with attack events that have not yet been completed to predict the attack behavior that may occur next, thereby quickly predicting the attack intention and attack range of the attack event. The lag of defense measures can be reduced, attack behaviors can be effectively stopped, and defense capabilities can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network attack prediction method based on the ATT&CK framework. Background Art

[0002] The rapid development of the Internet has led to higher requirements for network security. In-depth analysis of network attacks is a very complex research field. How to predict possible future threats based on known attack events is one of the key directions of current security research.

[0003] It is unlikely that a single-step attack can threaten a target. Most attackers coordinate attacks through a series of steps and combinations to implement specific action plans. This makes the security problems faced by the network increasingly serious, and network security presents a situation where it is easy to attack but difficult to defend.

[0004] Prior art often employs a passive, auxiliary defense strategy to prevent and defend against attacks that have already occurred. This means that corresponding defensive measures are only implemented after the attack has already succeeded. Consequently, these defensive measures are delayed, preventing effective and timely responses to attacks and resulting in low defensive capabilities. Summary of the Invention

[0005] In order to solve the technical problem that the above-mentioned defense measures are relatively lagging, unable to effectively stop the attack behavior in a more timely manner, and have low defense capabilities, the technical solution adopted by the present invention is:

[0006] According to one aspect of the present invention, a network attack prediction method based on the ATT&CK framework is provided, the method comprising the following steps:

[0007] Based on the ATT&CK threat framework, determine the used feature sequence of the target attack event. The used feature sequence is the sequence of all attack features that the target attack event has at the current time.

[0008] Perform similarity processing on the used feature sequence and each historical feature sequence in the historical event feature library to generate the similarity between each historical tactic and the used feature sequence; the historical feature sequence is the sequence of all attack features in the historical attack event;

[0009] The historical feature sequence whose similarity is greater than the prediction threshold is determined as the target prediction feature sequence;

[0010] According to the attack features corresponding to the used feature sequences in the target prediction feature sequence, attack information of the target attack event occurring at a future moment is generated.

[0011] In the present invention, further, the attack characteristics include attack technique and tactical characteristics, and the similarity processing includes:

[0012] Performing path feature similarity processing on the used feature sequence and each historical feature sequence to generate a first similarity corresponding to each historical feature sequence;

[0013] The used feature sequence and each historical feature sequence are subjected to feature time series similarity processing to generate a second similarity corresponding to each historical feature sequence.

[0014] In the present invention, further, the first similarity corresponds to a first weight; the second similarity corresponds to a second weight;

[0015] The historical feature sequences whose corresponding similarity is greater than the prediction threshold are determined as the target prediction feature sequences, including:

[0016] Generate a first mixed similarity corresponding to each historical feature sequence according to the first similarity, the second similarity, the first weight, and the second weight;

[0017] The historical feature sequence whose first mixed similarity is greater than the prediction threshold is determined as the target prediction feature sequence.

[0018] In the present invention, further, the attack features also include attack behavior features, and the similarity processing also includes:

[0019] The used feature sequence and each historical feature sequence are processed for attack behavior similarity to generate a third similarity corresponding to each historical feature sequence.

[0020] In the present invention, further, the first similarity corresponds to the first weight; the second similarity corresponds to the second weight; the third similarity corresponds to the third weight;

[0021] The historical feature sequences whose corresponding similarity is greater than the prediction threshold are determined as the target prediction feature sequences, including:

[0022] Generate a second mixed similarity corresponding to each historical feature sequence according to the first similarity, the second similarity, the third similarity, the first weight, the second weight, and the third weight;

[0023] The historical feature sequence whose second mixed similarity is greater than the prediction threshold is determined as the target prediction feature sequence.

[0024] In the present invention, further, the historical event feature library includes multiple attack types, each attack type corresponds to at least one technical and tactical sequence, and each technical and tactical sequence corresponds to at least one attack behavior sequence.

[0025] In the present invention, further, generating attack information of a target attack event occurring at a future time includes:

[0026] Generate attack technique and tactic information and / or attack behavior information of target attack events occurring at a future moment.

[0027] According to a second aspect of the present invention, a network attack prediction device based on the ATT&CK framework is provided, comprising:

[0028] The sequence determination module is used to determine the used feature sequence of the target attack event based on the ATT&CK threat framework. The used feature sequence is the sequence of all attack features that the target attack event has at the current time.

[0029] A similarity processing module is used to perform similarity processing on the used feature sequence and each historical feature sequence in the historical event feature library to generate the similarity between each historical technique and tactic and the used feature sequence; the historical feature sequence is the sequence of all attack features in the historical attack event;

[0030] A sequence prediction module is used to determine the historical feature sequence whose corresponding similarity is greater than the prediction threshold as the target prediction feature sequence;

[0031] The prediction information generation module is used to generate attack information of a target attack event occurring at a future moment based on the attack feature corresponding to the used feature sequence in the target prediction feature sequence.

[0032] According to a third aspect of the present invention, a non-transitory computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned network attack prediction method based on the ATT&CK framework.

[0033] According to a fourth aspect of the present invention, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned network attack prediction method based on the ATT&CK framework is implemented.

[0034] The present invention has at least the following beneficial effects:

[0035] The present invention uses the ATT&CK framework to determine the techniques, tactics, and behaviors used in network attacks. In this way, a corresponding used feature sequence can be formed. At the same time, many attack groups and organizations use the same technology to attack their targets, which can be understood as the attack group's own technical and tactical manual. Therefore, most of the existing attack methods are obtained by using existing attack methods or making slight improvements. Therefore, there is a certain degree of similarity between the existing attack methods and the attack methods that have occurred in history. The present invention uses the results of the analysis of historical attack events to form a historical event feature library of attack targets, attack intentions, used techniques and tactics, etc. The historical event feature library is used to perform similarity calculations with the used feature sequences of attack events that have not yet completed the implementation stage, and attack events with similar feature sequences are obtained. Combined with the supply characteristics of similar historical attack events, the attack behavior that may occur next is predicted, thereby quickly predicting the attack intention and attack scope of the attack event.

[0036] Before an attack is successfully launched, automated methods can be used to predict the next attack behavior, thereby understanding the attacker's attack intent and scope, and proactively strengthening the security of assets and networks and developing countermeasures. This can reduce the lag in defensive measures, effectively stopping attacks in a timely manner, and improving defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0038] Figure 1 A flowchart of a network attack prediction method based on the ATT&CK framework provided in an embodiment of the present invention.

[0039] Figure 2 This is a structural block diagram of a network attack prediction device based on the ATT&CK framework provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0041] According to one aspect of the present invention, Figure 1 As shown in FIG, a network attack prediction method based on the ATT&CK framework is provided, which includes the following steps:

[0042] S100: Determine the used feature sequence of the target attack event based on the ATT&CK threat framework. The used feature sequence is the sequence of all attack features that the target attack event has at the current time.

[0043] ATT&CK is a framework of "Adversarial Tactics, Techniques, and Common Knowledge" provided by MITRE. It is a curated knowledge base consisting of 12 tactics and 244 enterprise techniques that attackers use when attacking enterprises. All tactics, techniques, and procedures (TTPs) in the ATT&CK framework are based on real-world observations of real attack groups, providing a comprehensive picture of the behaviors attackers employ when attacking networks. ATT&CK converts known attacker behaviors into a structured list, aggregates these known behaviors into tactics and techniques, and represents them through several matrices, as well as the Structured Threat Information Expression (STIX) and the Trusted Automated Exchange of Indicator Information (TAXII). This makes ATT&CK useful for a variety of offensive and defensive metrics, representations, and other mechanisms.

[0044] Based on the attack phase and behavior mapping of the ATT&CK threat framework, the attack characteristics, such as the tactics and attack behaviors used in each cyberattack, can be standardized and defined, thereby forming a corresponding tactical sequence and attack behavior sequence for the target attack event. The tactical sequence can include the types of tactics used and the corresponding order of use.

[0045] Analysts combine the existing threat intelligence database with information about the current target attack event to determine the attack behaviors used in the target attack event. Then, based on the correspondence between each attack behavior and tactics in the ATT&CK threat framework, they determine the corresponding technical and tactical feature sequence for the target attack event. For example: TA0043 / T1592 / T1592.004, TA0001 / T1566 / T1566.003, TA0002 / T1559 / T1559.001, TA0004 / T1037 / T1037.002, TA0006 / T1606 / T1606.001, TA0008 / T1563 / T1563.002, TA0009 / T1573 / T1573.001.

[0046] S200: Perform similarity processing on the used feature sequence and each historical feature sequence in the historical event feature library to generate the similarity between each historical tactic and the used feature sequence. The historical feature sequence is the sequence of all attack features in the historical attack event.

[0047] The historical event signature database allows technical personnel to analyze past cyberattack events and, in combination with the ATT&CK threat framework, extract attack characteristics corresponding to each cyberattack event, including attack techniques and tactics, attack behaviors, and attack targets. Based on these attack characteristics, a historical signature sequence corresponding to each cyberattack is constructed. This historical signature sequence can include a sequence of attack techniques and tactics, a sequence of attack behaviors, and a sequence of corresponding attack targets.

[0048] Since many attack groups and organizations use the same technology to attack their targets, it can be understood as the attack group's own technical and tactical manual. Therefore, most of the existing attack methods are obtained by using existing attack methods or making slight improvements. Therefore, there is a certain degree of similarity between the existing attack methods and the attack methods that have occurred in history. In the present invention, the results of the analysis of historical attack events are used to form a historical event feature library of attack targets, attack intentions, and techniques and tactics used in attack events. The historical event feature library is used to perform similarity calculations with the used feature sequences of attack events that have not yet completed the implementation stage, and attack events with similar feature sequences are obtained. Combined with the supply features of historical similar attack events, the attack behavior that may occur next is predicted, thereby quickly predicting the attack intention and attack scope of the attack event.

[0049] To facilitate similarity calculation, existing technologies can be used to encode the various tactics and attack behaviors in the ATT&CK threat framework. This allows used and historical feature sequences to be represented by corresponding multidimensional vectors. Similarity can then be calculated using existing methods such as cosine similarity, Pearson correlation coefficient, Euclidean distance, and Manhattan distance.

[0050] In order to further improve the help of the information contained in the historical event feature library in predicting current attacks. Preferably, the historical event feature library includes multiple attack types, each attack type corresponds to at least one technical and tactical sequence, and each technical and tactical sequence corresponds to at least one attack behavior sequence. That is, when constructing the historical event feature library, it is necessary to classify the large number of technical and tactical sequences and attack behavior sequences obtained through analysis, and assign corresponding attack event categories to each type of attack feature. For example, the attack event category is set to ransomware attack, and the technical and tactical sequences and attack behavior sequences obtained belonging to ransomware attacks are all classified under this event type. At the same time, since a technical and tactical sequence can be realized through multiple attack behavior sequences, each technical and tactical sequence will also correspond to multiple attack behavior sequences.

[0051] In addition, each technical and tactical sequence and attack behavior sequence will correspond to an attack event type. Therefore, when the final attack information is output, the attack event category can also be output, so that analysts can set corresponding defense measures and strategies based on the predicted attack event category.

[0052] Specifically, the information contained in the historical event feature database can be in the following form:

[0053] Event Type 1 / [Technical and Tactical Sequence 11] / [Offensive Behavior Sequence 111], Event Type 1 / [Technical and Tactical Sequence 11] / [Offensive Behavior Sequence 112], Event Type 1 / [Technical and Tactical Sequence 11] / [Offensive Behavior Sequence 113].

[0054] Event Type 1 / [Technical and Tactical Sequence 12] / [Offensive Behavior Sequence 121], Event Type 1 / [Technical and Tactical Sequence 12] / [Offensive Behavior Sequence 122], Event Type 1 / [Technical and Tactical Sequence 12] / [Offensive Behavior Sequence 123].

[0055] Event Type 2 / [Technical and Tactical Sequence 21] / [Offensive Behavior Sequence 211], Event Type 2 / [Technical and Tactical Sequence 21] / [Offensive Behavior Sequence 212], Event Type 2 / [Technical and Tactical Sequence 21] / [Offensive Behavior Sequence 213].

[0056] S300: Determine the historical feature sequence whose corresponding similarity is greater than the prediction threshold as the target prediction feature sequence.

[0057] By calculating the similarity, the current attack event can be matched with the historical attack event, and the historical attack event with a higher matching degree can be used as the corresponding predicted event. Specifically, the prediction threshold in this embodiment can be determined according to actual usage, and its value range can be 60%-100%.

[0058] S400: Generate attack information of a target attack event occurring at a future time according to the attack feature corresponding to the used feature sequence in the target prediction feature sequence.

[0059] Preferably, generating attack information of a target attack event occurring at a future time includes: generating attack technique and tactics information and / or attack behavior information of the target attack event occurring at a future time.

[0060] Specifically, the attack features corresponding to the target prediction feature sequence that are located after the used feature sequence are output as prediction information, so that analysts can set corresponding defense measures based on the prediction information.

[0061] Since this embodiment is based on similarity prediction, there may be multiple final output results. For example, through similarity calculation, the current technical and tactical sequence corresponding to the used feature sequence and the two under the ransom event type in the historical feature sequence

[0062] If the historical technical and tactical sequences have a high degree of similarity, two predicted technical and tactical features will be output. To further improve the practicality of the prediction, the same method can be used to determine multiple historical attack behavior sequences and output the corresponding attack behavior features as prediction information.

[0063] The present invention can identify the possible targets and attack behaviors of an attack event from a large amount of historical attack data, so as to strengthen the security of these targets or take other security measures in advance to minimize the loss.

[0064] The analysis of links and behaviors assists security analysts in quickly restoring the attack process, discovering high-risk events, predicting the attacker's attack behavior and attack scope, reducing security analysis costs, understanding possible security risks, and formulating defense strategies and countermeasures. At the same time, the present invention can also help users discover potential threats or advanced threats based on the prediction results. By quickly locating the attack target and possible attack behaviors, timely security measures or countermeasures can be taken. Rapidly evaluate the discovered threat activities, understand their impact on the business, and quickly stop the loss. Qualitatively characterize the incident and implement relevant mitigation measures to reduce and ultimately eliminate the risks brought to the business.

[0065] As a possible embodiment of the present invention, the attack characteristics include attack technique and tactical characteristics, and the similarity processing includes:

[0066] S201: Perform path feature similarity processing on the used feature sequence and each historical feature sequence to generate a first similarity corresponding to each historical feature sequence.

[0067] S202: Perform feature time series similarity processing on the used feature sequence and each historical feature sequence to generate a second similarity corresponding to each historical feature sequence.

[0068] Since most of the attack methods used in current attack events are slightly improved versions of existing attack methods, the tactics and techniques used in the used feature sequence, as well as the order in which they were used, will differ from the tactics and techniques used in the corresponding historical feature sequence, as well as the order in which they were used. In this embodiment, similarities are calculated for the path features (tactics and techniques used) and feature time series (the order in which tactics and techniques were used) in the attack path, respectively, to obtain a first similarity and a second similarity. Thus, corresponding prediction thresholds can be set for the first similarity and the second similarity, providing greater flexibility.

[0069] Because some attack methods improved based on existing attack techniques primarily change the order in which certain techniques and tactics are used, their corresponding second similarity will be lower in this case. Similarly, other types of attack improvements primarily modify certain techniques and tactics used, so their corresponding first similarity will be lower in this case.

[0070] Therefore, the corresponding prediction thresholds can be set based on the first similarity and the second similarity corresponding to the attack types that are generally more likely to occur in a certain usage scenario, or the attack types that require more attention, thereby further improving the accuracy of the prediction results in each scenario.

[0071] As a possible embodiment of the present invention, the first similarity corresponds to a first weight, and the second similarity corresponds to a second weight.

[0072] S300: Determine the historical feature sequence whose corresponding similarity is greater than the prediction threshold as the target prediction feature sequence, including:

[0073] S301: Generate a first mixed similarity corresponding to each historical feature sequence according to the first similarity, the second similarity, the first weight, and the second weight.

[0074] Because different types of items contribute differently to the similarity of two attack events, corresponding weights need to be set to weight the sum of the similarities of each item to make the final result more accurate. For example, in this embodiment, the similarity contribution of the time series features is smaller than that of the path features. Therefore, the corresponding first weight is greater than the second weight. Specifically, the first weight A = 0.7 and the second weight B = 0.3. The first mixed similarity W1 satisfies the following condition: W1 = A*X1 + B*X2.

[0075] Among them, X1 is the first similarity; X2 is the second similarity.

[0076] S302: Determine the historical feature sequence whose first mixed similarity is greater than the prediction threshold as the target prediction feature sequence.

[0077] In this embodiment, the final first mixed similarity is obtained by weighted summing the first and second similarities according to their corresponding weights. This better represents the degree of similarity between the current used feature sequence and the previous historical feature sequence. This allows for more accurate determination of the target prediction feature sequence from multiple historical feature sequences.

[0078] As a possible embodiment of the present invention, the attack feature further includes an attack behavior feature, and the similarity processing further includes:

[0079] S203: Perform attack behavior similarity processing on the used feature sequence and each historical feature sequence to generate a third similarity corresponding to each historical feature sequence.

[0080] The above example predicts the future sequence of tactics and techniques that will be used by the current attack event. While this prediction information can help analysts predict the attack intent and scope of the attack event based on the tactics and techniques, the predicted range is relatively large and cannot accurately predict the attack behavior, thereby preventing more targeted defenses against the attack.

[0081] In this embodiment, attack behavior is further predicted. Because each technical and tactical sequence corresponds to multiple different attack behavior sequences, the same similarity calculation method can be used to obtain historical attack behavior sequences corresponding to the current attack behavior sequence. Typically, the multiple attack behavior prediction sequences obtained all correspond to the same technical and tactical feature prediction sequence. Therefore, attack behaviors in historical attack behavior sequences that occur after the current attack behavior sequence can be output as prediction information. The attack behavior sequence includes specific attack methods and corresponding attack targets.

[0082] This embodiment calculates similarities between attack behavior features to obtain corresponding attack behavior sequences from historical attack events. This allows for predictions of future attack behaviors. This allows for more detailed and targeted predictions of current attack events, allowing analysts to develop more effective defense measures based on this information.

[0083] As a possible embodiment of the present invention, the first similarity corresponds to a first weight, the second similarity corresponds to a second weight, and the third similarity corresponds to a third weight.

[0084] S300: Determine the historical feature sequence whose corresponding similarity is greater than the prediction threshold as the target prediction feature sequence, including:

[0085] S303: Generate a second mixed similarity corresponding to each historical feature sequence according to the first similarity, the second similarity, the third similarity, the first weight, the second weight, and the third weight.

[0086] S304: Determine the historical feature sequence whose second mixed similarity is greater than the prediction threshold as the target prediction feature sequence.

[0087] This embodiment also performs a weighted calculation on the reference items of each similarity to generate a more accurate second mixed similarity. Specifically, in this embodiment, the similarity contribution of the time series feature is less than the similarity contribution of the attack behavior, and the similarity contribution of the attack behavior is less than the similarity contribution of the path feature. Therefore, the corresponding first weight is greater than the third weight and greater than the second weight. Specifically, the first weight A = 0.5, the third weight C = 0.3, and the second weight B = 0.2. The second mixed similarity W2 satisfies the following conditions: W2 = A*X1+B*X2+C*X3.

[0088] Among them, X1 is the first similarity; X2 is the second similarity; X3 is the third similarity.

[0089] Therefore, this embodiment can more accurately predict the next attack behavior of an attack event through an automated method before the attack event is successfully implemented, and then perceive the attacker's attack intention and attack scope, strengthen the security of its own assets and networks in advance, and formulate countermeasures.

[0090] According to a second aspect of the present invention, a network attack prediction device based on the ATT&CK framework is provided, comprising:

[0091] The sequence determination module is used to determine the used feature sequence of the target attack event based on the ATT&CK threat framework. The used feature sequence is the sequence of all attack features that the target attack event has at the current time.

[0092] The similarity processing module is used to perform similarity processing on the used feature sequence and each historical feature sequence in the historical event feature library, generating the similarity between each historical tactic and the used feature sequence. The historical feature sequence is the sequence of all attack features in the historical attack event.

[0093] The sequence prediction module is used to determine the historical feature sequence whose corresponding similarity is greater than the prediction threshold as the target prediction feature sequence.

[0094] The prediction information generation module is used to generate attack information of a target attack event occurring at a future moment based on the attack feature corresponding to the used feature sequence in the target prediction feature sequence.

[0095] The present invention uses the ATT&CK framework to determine the techniques, tactics, and behaviors used in network attacks. In this way, a corresponding used feature sequence can be formed. At the same time, many attack groups and organizations use the same technology to attack their targets, which can be understood as the attack group's own technical and tactical manual. Therefore, most of the existing attack methods are obtained by using existing attack methods or making slight improvements. Therefore, there is a certain degree of similarity between the existing attack methods and the attack methods that have occurred in history. The present invention uses the results of the analysis of historical attack events to form a historical event feature library of attack targets, attack intentions, used techniques and tactics, etc. The historical event feature library is used to perform similarity calculations with the used feature sequences of attack events that have not yet completed the implementation stage, and attack events with similar feature sequences are obtained. Combined with the supply characteristics of similar historical attack events, the attack behavior that may occur next is predicted, thereby quickly predicting the attack intention and attack scope of the attack event.

[0096] Before an attack is successfully launched, automated methods can be used to predict the next attack behavior, thereby understanding the attacker's attack intent and scope, and proactively strengthening the security of assets and networks and developing countermeasures. This can reduce the lag in defensive measures, effectively stopping attacks in a timely manner, and improving defense capabilities.

[0097] An embodiment of the present invention also provides a non-transitory computer-readable storage medium, which can be set in an electronic device to store at least one instruction or at least one program related to implementing a method in a method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the method provided in the above embodiment.

[0098] An embodiment of the present invention further provides an electronic device including a processor and the aforementioned non-transitory computer-readable storage medium.

[0099] An embodiment of the present invention further provides a computer program product, which includes program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present invention described above in this specification.

[0100] Although some specific embodiments of the present invention have been described in detail by way of example, it will be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present invention. It will also be understood by those skilled in the art that various modifications may be made to the embodiments without departing from the scope and spirit of the present invention. The scope of the present invention is defined by the appended claims.

Claims

1. A network attack prediction method based on the ATT&CK framework, characterized by: The method comprises the following steps: Based on the ATT&CK threat framework, determine the used feature sequence of the target attack event; the used feature sequence is the sequence of all attack features that the target attack event has at the current time; the attack feature sequence includes the types of techniques and tactics used and the corresponding order of use; Performing similarity processing on the used feature sequence and each historical feature sequence in the historical event feature library to generate a similarity between each historical tactic and the used feature sequence; the historical feature sequence is a sequence of all attack features in historical attack events; The historical feature sequence whose similarity is greater than the prediction threshold is determined as the target prediction feature sequence; Generate attack information of the target attack event occurring at a future time according to the attack feature corresponding to the used feature sequence in the target prediction feature sequence; The attack features include attack technique and tactic features, and the similarity processing includes: Performing path feature similarity processing on the used feature sequence and each of the historical feature sequences to generate a first similarity corresponding to each of the historical feature sequences; Path characteristics are the techniques and tactics used in the attack path; The used feature sequence and each of the historical feature sequences are processed for feature time sequence similarity to generate a second similarity corresponding to each of the historical feature sequences; the feature time sequence is the order in which techniques and tactics are used in the attack path.

2. The method according to claim 1, characterized in that The first similarity corresponds to a first weight; the second similarity corresponds to a second weight; The historical feature sequences whose corresponding similarity is greater than the prediction threshold are determined as the target prediction feature sequences, including: Generating a first mixed similarity corresponding to each of the historical feature sequences according to the first similarity, the second similarity, the first weight, and the second weight; The historical feature sequence whose first mixed similarity is greater than the prediction threshold is determined as the target prediction feature sequence.

3. The method according to claim 1, characterized in that The attack feature also includes attack behavior features, and the similarity processing further includes: The used feature sequence and each of the historical feature sequences are subjected to attack behavior similarity processing to generate a third similarity corresponding to each of the historical feature sequences.

4. The method according to claim 3, characterized in that The first similarity corresponds to a first weight; the second similarity corresponds to a second weight; the third similarity corresponds to a third weight; The historical feature sequences whose corresponding similarity is greater than the prediction threshold are determined as the target prediction feature sequences, including: generating a second mixed similarity corresponding to each of the historical feature sequences according to the first similarity, the second similarity, the third similarity, the first weight, the second weight, and the third weight; The historical feature sequence whose second mixed similarity is greater than the prediction threshold is determined as the target prediction feature sequence.

5. The method according to claim 1, wherein The historical event feature library includes multiple attack types, each attack type corresponds to at least one technical and tactical sequence, and each technical and tactical sequence corresponds to at least one attack behavior sequence.

6. The method according to claim 1, wherein Generating attack information of the target attack event occurring at a future time, including: Generate attack technique and tactics information and / or attack behavior information of the target attack event occurring at a future moment.

7. A network attack prediction device based on the ATT&CK framework, characterized in that: include: A sequence determination module is used to determine the used feature sequence of the target attack event based on the ATT&CK threat framework; the used feature sequence is the sequence of all attack features that the target attack event has at the current time; the attack feature sequence includes the types of techniques and tactics used and the corresponding order of use; A similarity processing module is used to perform similarity processing on the used feature sequence and each historical feature sequence in the historical event feature library to generate a similarity between each historical tactic and the used feature sequence; the historical feature sequence is a sequence of all attack features in historical attack events; A sequence prediction module is used to determine the historical feature sequence whose corresponding similarity is greater than the prediction threshold as the target prediction feature sequence; A prediction information generation module, configured to generate attack information of the target attack event occurring at a future time based on the attack features corresponding to the used feature sequence in the target prediction feature sequence; The attack features include attack technique and tactic features, and the similarity processing includes: Performing path feature similarity processing on the used feature sequence and each of the historical feature sequences to generate a first similarity corresponding to each of the historical feature sequences; Path characteristics are the techniques and tactics used in the attack path; The used feature sequence and each of the historical feature sequences are processed for feature time sequence similarity to generate a second similarity corresponding to each of the historical feature sequences; the feature time sequence is the order in which techniques and tactics are used in the attack path.

8. A non-transitory computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements a network attack prediction method based on the ATT&CK framework as described in any one of claims 1 to 6.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, it implements a network attack prediction method based on the ATT&CK framework as described in any one of claims 1 to 6.

Images