An attack scene intelligent construction method and system, and an electronic device

Abstract

The application discloses an attack scene intelligent construction method and system and electronic equipment, comprising: collecting vulnerable information from a target network; generating a Bayesian attack graph by using the vulnerable information; planning an optimal attack path from an attack initiator to a target attack host by using the Bayesian attack graph; simulating and verifying the target attack host by using attack software tools along the optimal attack path; when an intermediate attack host in the optimal attack path fails, the optimal attack path from the attack initiator to the target attack host is re-planned by using the Bayesian attack graph; the target attack host is simulated and verified again by using attack software tools along the re-planned optimal attack path; and the above process is repeated to realize intelligent construction of an attack scene. The application improves the attack success rate of a target attack host node.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of network security, and particularly relates to an intelligent attack scenario construction method and system and an electronic device. BACKGROUND

[0002] At present, the cyberspace is becoming the fifth strategic space after land, sea, air and sky, and its depth and breadth cover various aspects such as politics, economy, culture, society, military and diplomacy. The cyberspace security has become a core component of national security and plays an important role in guaranteeing the economic and social development and the safety of key infrastructure. Meanwhile, along with the dependence on the Internet, the network security problem has become a very important problem. People enjoy the convenience brought by it, but also bear the great risk. Due to the internationality, lack of legal constraints and other problems of the network itself, combined with the complexity and heterogeneity of the structure itself, the network system risk and hidden danger are further increased, which provides convenience for various attacks such as Trojan viruses, backdoor intrusion, denial of service, cross-site scripting, system vulnerabilities, etc., which also leads to frequent occurrence of network security incidents.

[0003] With the increasing automation and intelligence of network attacks, the speed of vulnerability discovery and exploitation is getting faster and faster, the penetration rate of firewalls is getting higher and higher, the asymmetry of security threats is increasing, and the damage to network infrastructure is getting bigger and bigger. Therefore, under this trend, the traditional passive defense has been unable to cope with the current network security problems. Thus, from the perspective of attackers, new network attack techniques have gradually developed, which promote defense and replace defense. Network attack techniques test target systems by simulating real network attacks, thereby discovering the vulnerabilities of target systems in advance. This helps security personnel of enterprises to discover suspicious connections and security vulnerabilities of networks in advance before attacks by malicious attackers, helps enterprises to repair and improve target system networks and to formulate security policies, thereby reinforcing systems and ensuring system security, effectively avoiding the occurrence of security incidents. At present, the models of network attack techniques mainly include two attack frameworks, namely, Penetration Tseting Execution Standard (PTES) and Advanced Persistent Threat (APT). The PTES penetration testing process is a security detection based on vulnerability scanning, and its purpose is to discover vulnerabilities and then present them in the form of reports, and it does not involve real and destructive attacks. The APT attack framework is a real and destructive attack framework, but its attack implementation is based on a process of continuous trial and error, and the attack process is confusing and lacks clear planning. In combination with the above two network attack techniques, a real network attack simulation and test can be proposed by intelligently constructing a network attack scene, and an attack library is deployed under the planning of intelligent construction of an attack path, thereby discovering the vulnerabilities of target systems in advance and repairing them.

[0004] However, the combination of the above two attack techniques cannot guarantee that each attack can achieve vulnerability exploitation to obtain corresponding permissions and attack benefits according to the pre-planned steps in a real network attack environment, that is, there are attack node failure cases. In this case, due to the attack failure node in the predetermined attack path, the entire pre-planned optimal attack path fails. This situation is not considered when designing and implementing attack graphs by predecessors. SUMMARY

[0005] In order to solve the above problems in the prior art, the present application provides an attack scene intelligent construction method, system and electronic equipment. The technical problems to be solved by the present application are solved by the following technical solutions:

[0006] In a first aspect, an attack scene intelligent construction method is provided, comprising:

[0007] collecting vulnerable information from a target network system;

[0008] generating a Bayesian attack graph using the vulnerable information; the Bayesian attack graph including a set of target network host devices, a set of static ARP connection relationships between the target network host devices, and a set of corresponding risk values of the target network host devices;

[0009] planning an optimal attack path from an attack initiating host to a target attack host using the Bayesian attack graph;

[0010] conducting attack simulation verification on the target attack host along the optimal attack path using an attack software tool;

[0011] when an intermediate attack host in the optimal attack path fails, re-planning an optimal attack path from the attack initiating host to the target attack host using the Bayesian attack graph;

[0012] conducting attack simulation verification on the target attack host again along the re-planned optimal attack path using the attack software tool.

[0013] In an embodiment of the present application, the application is applied to an internal network environment, and the connection relationships between all target network host devices in the internal network environment are set as static ARP connection relationships, and the corresponding dynamic ARP connection relationships are closed.

[0014] In an embodiment of the present application, the corresponding risk value of each target network host device is determined through a CVSS vulnerability scoring system.

[0015] In an embodiment of the present application, the corresponding risk value of each target network host device is used as a prior probability of the target network host device for planning an optimal attack path from an attack initiating host to a target attack host.

[0016] In an embodiment of the present application, planning an optimal attack path from an attack initiating host to a target attack host using the Bayesian attack graph includes:

[0017] calculating a conditional probability value corresponding to each target network host device according to the prior probability of the target network host device using an OR structure formed by all target network host devices in the Bayesian attack graph;

[0018] calculating a joint probability value corresponding to each path from the attack initiating host to the target attack host according to the conditional probability value;

[0019] selecting a path corresponding to a maximum joint probability value in all joint probability values as a current optimal attack path.

[0020] In an embodiment of the present application, the Bayesian attack graph is used to re-plan an optimal attack path from an attack initiating host to a target attack host, comprising:

[0021] calculating a joint probability value corresponding to each path from the parent attack host corresponding to the failed intermediate attack host to the child attack host corresponding to the failed intermediate attack host;

[0022] selecting a path corresponding to the maximum joint probability value among all joint probability values as a current local optimal attack path;

[0023] re-planning an optimal attack path according to the current local optimal attack path and the attack path before the failed intermediate attack host and after the child attack host in the optimal attack path before re-planning.

[0024] In an embodiment of the present application, the joint probability value corresponding to each path from the parent attack host corresponding to the failed intermediate attack host to the child attack host corresponding to the failed intermediate attack host is calculated, comprising:

[0025] calculating a posterior probability value of each host from the parent attack host corresponding to the failed intermediate attack host to the child attack host corresponding to the failed intermediate attack host;

[0026] calculating a joint probability value corresponding to each path from the parent attack host corresponding to the failed intermediate attack host to the child attack host corresponding to the failed intermediate attack host according to the posterior probability value.

[0027] In a second aspect, an embodiment of the present application provides an intelligent attack scenario construction system, comprising:

[0028] a vulnerable information collection module configured to collect vulnerable information from a target network system;

[0029] a Bayesian attack graph generation module configured to generate a Bayesian attack graph using the vulnerable information; the Bayesian attack graph comprises a set of target network host devices, a set of static ARP connection relationships between the target network host devices, and a set of risk values corresponding to the target network host devices;

[0030] an optimal attack path planning module configured to plan an optimal attack path from an attack initiating host to a target attack host using the Bayesian attack graph;

[0031] a first attack processing module configured to perform attack simulation verification on the target attack host along the optimal attack path using an attack software tool;

[0032] The optimal attack path re-planning module re-plans the optimal attack path from the attack initiating host to the target attack host by using the Bayesian attack graph when the intermediate attack host in the optimal attack path fails.

[0033] The second attack processing module uses the attack software tool to attack the target attack host again along the re-planned optimal attack path.

[0034] In an embodiment of the present application, further comprising:

[0035] The attack library deployment module is configured to provide the attack software tool required in the attack simulation verification process.

[0036] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete mutual communication through the communication bus.

[0037] The memory is configured to store a computer program.

[0038] The processor is configured to execute the program stored in the memory to implement the steps of the attack scenario intelligent construction method.

[0039] The present application has the following beneficial effects:

[0040] The attack scenario intelligent construction method provided by the present application firstly collects the vulnerable information of the target network system according to the design of the attack scenario intelligent construction technology, generates a Bayesian attack graph according to the collected vulnerable information, plans an optimal attack path according to the Bayesian attack graph, uses attack software to attack for attack simulation verification under the guidance of the optimal attack path, and considers the attack node failure in actual attack, re-plans the optimal attack path, and uses attack software to attack for attack simulation verification under the guidance of the optimal attack path again. It can be seen that the present application has clear attack modeling and can realize real and destructive multi-step combined attack, and can better realize the purpose of attack instead of defense and attack promoting defense, and promote the development of network security. The structure of the Bayesian attack graph is optimized, the Bayesian attack graph is suitable for rapid generation in a large-scale complex network and avoids the problem of information explosion due to the increase of the complexity of the target network system. The attack success rate of the target attack host node is improved by considering the attack failure in the determination of the attack path.

[0041] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1is a flowchart of a method for intelligently constructing an attack scenario according to an embodiment of the present application.

[0043] Figure 2 is a flowchart of planning an optimal attack path according to an embodiment of the present application.

[0044] Figure 3 is a flowchart of re-planning an optimal attack path according to an embodiment of the present application.

[0045] Figure 4 is an example diagram of re-planning an optimal attack path according to an embodiment of the present application.

[0046] Figure 5 is a structural diagram of a system for intelligently constructing an attack scenario according to an embodiment of the present application.

[0047] Figure 6 is a structural diagram of another system for intelligently constructing an attack scenario according to an embodiment of the present application.

[0048] Figure 7 is a structural diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0049] The present application will be further described in detail below with reference to specific embodiments, but the embodiments of the present application are not limited thereto.

[0050] Currently, there is no security testing based on real network attacks, and the overall process lacks perfect attack modeling based on fuzzy testing for planning and guidance, and the attack path does not consider the attack failure condition, i.e., a certain attack node may fail, and the attack path such as the attack path planning based on the global attack graph does not consider the discrete relationship between the attack nodes in the attack graph, i.e., whether a certain device node is attacked depends on whether its parent node or ancestor node is successfully attacked, so that the attack path may have invalid attack paths, or the attack path selection algorithm has high complexity. Figure 1 According to the above problems, an embodiment of the present application provides a method for intelligently constructing an attack scenario, which specifically includes the following steps:

[0051] S10, collecting vulnerable information from a target network system.

[0052] The vulnerable information collected by the embodiment of the present application in the target network system includes the port opening situation, service opening information, MAC address, operating system and the like of the target IP or multiple targets of IP ends by the Nessus tool, and the network topology information and host information obtained by the vulnerability scanning.

[0053] S20, generating a Bayesian attack graph by using the vulnerability information; the Bayesian attack graph comprises a set of target network host devices, a set of static ARP connection relationships between the target network host devices, and a set of corresponding risk values of the target network host devices.

[0054] Embodiments of the present application generate a Bayesian attack graph by using the vulnerability information collected in S10, and the Bayesian attack graph is defined as BAG = <V, E, D> and is a directed acyclic graph with multiple nodes. Specifically:

[0055] V represents a set of points in the Bayesian attack graph, and the nodes in the BAG graph are abstractions of the target network host devices, represented as V = {v i | i = 1, 2, 3,..., N}, and N represents the number of target network host devices. Embodiments of the present application take the target network host devices as the node units in the Bayesian attack graph, rather than the traditional single vulnerability, thereby optimizing the AND-OR structure in the traditional attack graph and unifying it into an OR structure.

[0056] E represents a set of edges in the Bayesian attack graph, which is mainly applied to an internal network environment. In the internal network environment, to prevent ARP attacks, the connection relationships between all target network host devices are set as static ARP connection relationships, and dynamic ARP connection relationships are closed. That is, the trust relationship corresponding to the edges in embodiments of the present application is a static ARP connection relationship.

[0057] D represents a set of risk values, which are used as weights in the Bayesian attack graph and are used as the basis for subsequent optimal path design. Here, the risk value corresponding to each target network host device is determined according to the Common Vulnerability Scoring System (CVSS), that is, the node weight is determined according to the vulnerability information of the host device of each node after information collection. The risk value calculation formula is:

[0058]

[0059] Wherein, AV represents Attack Vector, AC represents Attack Complexity, PR represents Privilege Required, and UI represents User Interaction. The calculation of AV, AC, PR, and UI is performed by using the prior art, and will not be described again. The risk value corresponding to each target network host device is used as the prior probability of the target network host device, and is used for subsequent planning of the optimal attack path from the attack initiator host to the target attack host.

[0060] The Bayesian attack graph optimization provided by the embodiment of the application optimizes the single vulnerability as a node in the traditional attack graph, the once atomic attack as the node connection relationship, and optimizes the target network host device in the network as a node (such as a PC, a server, etc.), the static ARP connection relationship between the target network host devices as the connection between the nodes, and the risk value of each target network host device calculated by the CVSS vulnerability scoring system as the prior probability to be introduced, so that the optimized Bayesian attack graph is more suitable for the internal network environment after the ARP attack defense is established. Meanwhile, the AND-OR structure in the traditional Bayesian attack graph is unified as an OR structure, the complexity of calculation is simplified, the generated Bayesian attack graph is more concise, the state explosion problem of the attack graph itself is further solved, the time spent in the subsequent optimal attack path calculation and the adjustment of the optimal attack path based on the attack failure node is improved, and the efficiency is improved.

[0061] S30, planning an optimal attack path from the attack initiator host to the target attack host by using the Bayesian attack graph.

[0062] Since all the target network host device nodes in the target network system have a connection relationship, it has no practical significance to measure a single isolated node. Similarly, whether the target network host device nodes in the Bayesian attack graph are attacked depends on whether the parent nodes or ancestor nodes are successfully attacked, so when planning the optimal attack path, the dependency relationship between the target network host device nodes must be considered. The dependency is the trust relationship between the target network host device nodes in the optimized Bayesian attack graph confirmed by the static ARP connection, and the connection relationship fits the causal reasoning under the Bayesian exact reasoning, that is, the trust relationship between the attack nodes and the parent nodes in the Bayesian attack graph confirmed by the static ARP connection relationship. Therefore, the embodiment of the application provides an optional solution, please refer to Figure 2 , the conditional probability value corresponding to each target network host device is calculated according to the prior probability of the target network host device by using the OR structure formed by all the target network host devices in the Bayesian attack graph; the joint probability value corresponding to each path from the attack initiator host to the attack target host is calculated by traversing the conditional probability value; and the path corresponding to the maximum joint probability value in all the joint probability values is selected as the current optimal attack path. The detailed analysis is as follows:

[0063] First, the conditional probability of a target network host device node being attacked by its parent node is calculated. Specifically:

[0064] Suppose that the set of target network host device nodes in the optimized Bayesian attack graph is V, v i , v jThis represents a node abstracted from a target network device along an attack path. Then, for this attack node v... i The conditional probability is represented by P(v i |Par(v i )) indicates that Par(v i Par(D) represents the set of probabilities of an attack occurring on its parent node. D represents the set of all risk values. i The ) represents the prior probability of the current attacking node confirmed by the risk value, which is determined by the CVSS vulnerability scoring system. Since the optimized Bayesian attack graph uses each target network host device in the target network system as a node, the AND-OR structure with multiple parent nodes is unified into an OR structure. In the OR structure, a certain attacking node v i The conditional probability is calculated as follows:

[0065]

[0066] After planning an attack path on the optimized Bayesian attack graph, since it has multiple nodes, this means that multiple attack events will be carried out along this path. These attack events are typically discrete, meaning that the exploitation of vulnerabilities in device nodes is an independent event. The probability of the target host being compromised depends on the probability of successful exploitation of vulnerabilities across all attack paths. Therefore, the path with the highest joint probability is selected as the optimal attack path from the initiating host to the target host. The joint probability is calculated as follows:

[0067] Suppose we have A1, A2, ... A N There are N attack events in total, and their joint probability can usually be expressed as:

[0068] P(A1,A2,...,A N )=P(A1)P(A2|A1)P(A3|A1,A2)...P(A N |A1,A2,...,A N-1 );

[0069] Where P(A1) represents the probability of attack event A1 occurring, which is the conditional probability value calculated in the previous paragraph; P(A2|A1) represents the joint probability that attack event A2 also succeeds if attack event A1 succeeds; and so on, P(A3|A1,A2), etc. In this embodiment of the invention, path calculation uses the conditional probability of a target network host device node in the optimized Bayesian attack graph to calculate the corresponding joint probability. For example, using P(v... j ) represents the target network host device node v jThe probability of being successfully attacked, assuming that the current path is composed of v i j k l Four target network host device nodes, then the joint probability of this path can be expressed as P(v i j k l P(v j ), P(v k ), P(v l ) are the conditional probabilities of the target network host device nodes calculated in the previous paragraph, then the joint probability of the current path is calculated as follows:

[0070] P(v i j k l ) = P(v i ) P(v j |v i ) P(v k |v i j ) P(v l |v i j k );

[0071] When the conditional probability of each target network host device node is calculated, all paths from the attack initiator host to the target attack host are traversed on the optimized Bayesian attack graph, and then the joint probability values of these paths are calculated in turn.

[0072] Finally, the path with the maximum joint probability value is taken from all joint probability values as the current optimal attack path.

[0073] S40, using attack software tools to attack the target attack host along the optimal attack path for attack simulation verification.

[0074] The attack software tools of the embodiment of the application include network protocol-based attack software attacks, network defect-based attack software attacks, and operating system-based attack software attacks, which are used to attack the target attack host along the optimal attack path for attack simulation verification.

[0075] S50, when the intermediate attack host in the optimal attack path fails, the Bayesian attack graph is used to re-plan the optimal attack path from the attack initiator host to the target attack host.

[0076] ​​​​​​​​​​​​When the attack is performed according to the current attack path, it is normal that the attack node failure occurs, that is, the attack does not achieve the expected effect. The traditional attack path planning does not consider this, and based on this, an embodiment of the present application designs a path dynamic adjustment scheme under the attack node failure condition, please refer to Figure 3 , comprising:

[0077] iteratively calculating a joint probability value corresponding to each path of a parent attack host corresponding to the intermediate attack host to a child attack host corresponding to the intermediate attack host of the attack failure; selecting a path corresponding to the maximum joint probability value in all joint probability values as a current local optimal attack path; and obtaining a re-planned optimal attack path according to the current local optimal attack path and an attack path before the parent attack host corresponding to the intermediate attack host of the attack failure and after the child attack host corresponding to the intermediate attack host of the attack failure in the optimal attack path before the re-planning. Wherein, the iteratively calculating a joint probability value corresponding to each path of a parent attack host corresponding to the intermediate attack host to a child attack host corresponding to the intermediate attack host of the attack failure comprises: iteratively calculating a posterior probability value of each host of a parent attack host corresponding to the intermediate attack host to a child attack host corresponding to the intermediate attack host of the attack failure; and iteratively calculating a joint probability value corresponding to each path of a parent attack host corresponding to the intermediate attack host to a child attack host corresponding to the intermediate attack host of the attack failure according to the posterior probability value.

[0078] As can be seen from the above, the path dynamic adjustment scheme of the embodiment of the present application is divided into two steps, one is to iteratively calculate a posterior probability value of each host of a parent attack host corresponding to the intermediate attack host to a child attack host corresponding to the intermediate attack host of the attack failure, and the other is to determine a local optimal path according to the posterior probability value and to adjust and replace the overall optimal attack path according to the local optimal attack path. Specifically:

[0079] The posterior probability of the optimized Bayesian attack graph is taken as the risk value of the node, but the prior probability can only show the security situation of the target network host device node in the target network system at a certain time stamp. Therefore, when an intermediate attack host node fails, the prior probability value of the node in the entire attack graph based on the risk value needs to be dynamically updated. The embodiment of the present application proposes to use the failed intermediate attack host node to calculate its posterior probability based on the conditional probability to realize the re-dynamic update of the risk value. Wherein, V target ={v j ∈V|v j =1} represents the node after the dynamic risk value evaluation update is completed, which is a locally selectable target network host device node set, V represents a set of all target network host device nodes of the optimized Bayesian attack graph, and Va(Va∈V target) represents a set of locally selectable target network host device nodes in the optimized Bayesian attack graph.

[0080] Assuming that in V target The posterior probability update formula of an intermediate attack host node b in the set is as follows:

[0081]

[0082] Wherein, P(V target |V b ) = ∏P(V b = 1|Va), P1(V target ) = ∏P(V b = 1), P1(V b ) represents the conditional probability value of the intermediate attack host node b calculated in the previous S30 as the prior probability of the Bayesian formula here, P(V b = 1) represents the preset initial value of the intermediate attack host node b multiplied when calculating the Bayesian formula, and P(V b = 1|Va) represents the posterior probability of the intermediate attack host node b under the Va device set, that is, the risk value after dynamic updating.

[0083] The posterior probability value of each host corresponding to the parent attack host of the attack-failed intermediate attack host to the attack-failed intermediate attack host can be calculated by traversing the Bayesian attack graph and replacing the attack path corresponding to the joint probability closest to the optimal attack path with the attack path corresponding to the joint probability. However, with the growth of the target network host device, this method obviously consumes too much time. Therefore, the embodiment of the present application proposes to backtrack the attack path where the attack-failed intermediate attack host node is located, find the locally optimal path between the parent node of the attack-failed intermediate attack host node and the child node of the attack-failed intermediate attack host node (i.e., form V target set), and realize intelligent adjustment under the attack node failure scenario. For example, as shown in FIG. 4, the attack path of the attack-failed intermediate attack host node b is replaced with the locally optimal path between the parent node of the attack-failed intermediate attack host node b and the child node of the attack-failed intermediate attack host node b. Figure 4 Figure 4 ​When the attack is performed on the original optimal attack path, the attack from the attack host node X to the attack host node Y fails, that is, the attack host node Y cannot be successfully exploited, and the attack node is invalid. In this case, after updating the posterior probability of all intermediate attack host nodes from the parent attack host node X to the child attack host node Z, local adjustment of the attack path is performed. The local optimal attack path between the current attack host node X and the child attack host node Z of the invalid host node is found, that is, the attack path is adjusted from the original <..., W, X, Y, Z,...> to <..., W, X, M, N, Z,...>. Through the local optimal attack path adjustment, the last hop attack host node X, the attack host node M, the attack node N of the attack node invalidation, and the next hop attack host node Z of the attack node invalidation are reconnected, indicating that the attack path adjustment is successful at this time. It can be seen that, according to the current local optimal attack path <X, M, N, Z> and the attack path before the re-planning of the invalid intermediate attack host corresponding to the parent attack host <..., W> and the child attack host Z <...>, the re-planned optimal attack path is obtained.

[0084] It can be seen that the local adjustment method proposed in the embodiment of the application first performs dynamic adjustment of the attack host node posterior probability (risk value) in the optimal Bayesian attack graph. Then, between the next hop node and the last hop node of the invalid intermediate attack host node, the local optimal attack path is found by using the S30 similar joint probability maximum value taking method. Finally, the local optimal path is replaced by the whole optimal attack path. This local adjustment method not only considers the attack invalidation scenario, but also uses the local replacement method to reduce the overhead caused by the transmission update path, shorten the calculation time, improve the efficiency of the optimal attack path planning, and make it suitable for large-scale complex networks.

[0085] S60, the attack software tool is used to attack the target attack host along the re-planned optimal attack path for simulation verification. For details, refer to S40, which will not be repeated here.

[0086] The above S30-S60 process is repeated to realize intelligent construction of the attack scenario.

[0087] In summary, the attack scene intelligent construction method provided by the embodiment of the present application, according to the design of the attack scene intelligent construction technology, firstly, the vulnerable information of the target network system is collected, the Bayesian attack graph is generated according to the collected vulnerable information, the optimal attack path is planned according to the Bayesian attack graph, under the guidance of the optimal attack path, the attack software is used to attack and simulate verification, and meanwhile, considering that the attack node may fail in the actual attack, the optimal attack path is dynamically replanned, and under the guidance of the optimal attack path, the attack software is used to attack and simulate verification. It can be seen that the embodiment of the present application not only has clear attack modeling, but also can realize real and destructive multi-step combined attack, so that the purpose of attack instead of defense and attack promoting defense can be better realized, and the development of network security is promoted. The structure of the Bayesian attack graph is optimized, the Bayesian attack graph is suitable for rapid generation in a large-scale complex network and can avoid the problem of information explosion due to the increase of the complexity of the target network system. In the determination of the attack path, the attack failure condition is considered, and the attack success rate of the target attack host node is improved.

[0088] In a second aspect, referring to Figure 5 The embodiment of the present application provides an attack scene intelligent construction system, which comprises:

[0089] The vulnerable information collection module 501 is used for collecting vulnerable information from a target network;

[0090] The Bayesian attack graph generation module 502 is used for generating a Bayesian attack graph by using the vulnerable information. The Bayesian attack graph comprises a set of target network host devices, a set of static ARP connection relationships between the target network host devices, and a set of risk values corresponding to the target network host devices;

[0091] The optimal attack path planning module 503 is used for planning an optimal attack path from an attack initiating host to a target attack host by using the Bayesian attack graph;

[0092] The first attack processing module 504 is used for simulating and verifying the target attack host by using attack software along the optimal attack path;

[0093] The optimal attack path replanning module 505 is used for replanning the optimal attack path from the attack initiating host to the target attack host by using the Bayesian attack graph when an intermediate attack host in the optimal attack path fails;

[0094] The second attack processing module 506 is used for simulating and verifying the target attack host again by using attack software along the replanned optimal attack path.

[0095] Further, the Bayesian attack graph generation module 502 in the embodiment of the present application is applied to an intranet environment, and connection relationships among all target network host devices in the intranet environment are set as static ARP connection relationships, and corresponding dynamic ARP connection relationships are closed.

[0096] Further, the risk value corresponding to each target network host device in the Bayesian attack graph generation module 502 in the embodiment of the present application is determined through a CVSS vulnerability scoring system.

[0097] Further, the risk value corresponding to each target network host device in the Bayesian attack graph generation module 502 in the embodiment of the present application is used as a prior probability of the target network host device, and is used for planning an optimal attack path from an attack initiator host to a target attack host.

[0098] Further, the optimal attack path planning module 503 in the embodiment of the present application plans an optimal attack path from an attack initiator host to a target attack host by using a Bayesian attack graph, and the planning includes:

[0099] An OR structure formed by all target network host devices in the Bayesian attack graph is used to calculate a conditional probability value corresponding to each target network host device according to a prior probability of the target network host device;

[0100] A joint probability value corresponding to each path from the attack initiator host to the attack target host is iteratively calculated according to the conditional probability value;

[0101] A path corresponding to a maximum joint probability value in all joint probability values is selected as a current optimal attack path.

[0102] Further, the optimal attack path re-planning module 505 in the embodiment of the present application re-plans an optimal attack path from an attack initiator host to a target attack host by using a Bayesian attack graph, and the re-planning includes:

[0103] A joint probability value corresponding to each path from a parent attack host corresponding to a current attack-failed intermediate attack host to a child attack host corresponding to the attack-failed intermediate attack host is iteratively calculated;

[0104] A path corresponding to a maximum joint probability value in all joint probability values is selected as a current local optimal attack path;

[0105] A re-planned optimal attack path is obtained according to the current local optimal attack path and an attack path before the parent attack host corresponding to the attack-failed intermediate attack host and after the child attack host corresponding to the attack-failed intermediate attack host in the optimal attack path before the re-planning.

[0106] Further, the optimal attack path re-planning module 505 traverses to calculate the joint probability value corresponding to each path of the parent attack host corresponding to the intermediate attack host of the current attack failure to the child attack host corresponding to the intermediate attack host of the attack failure, including:

[0107] traversing to calculate the posterior probability value of each host of the parent attack host corresponding to the intermediate attack host of the current attack failure to the child attack host corresponding to the intermediate attack host of the attack failure;

[0108] According to the posterior probability value, the joint probability value corresponding to each path of the parent attack host corresponding to the intermediate attack host of the current attack failure to the child attack host corresponding to the intermediate attack host of the attack failure is traversed to calculate.

[0109] Further, referring to Figure 6 , the embodiment of the application provides another intelligent attack scenario construction system, which further comprises:

[0110] The attack library deployment module 507 is configured to provide attack software tools required in the attack simulation verification process.

[0111] In summary, the attack scenario intelligent construction system provided by the embodiment of the application, the attack scenario intelligent construction technology implements the attack technology through the fragile information collection module 501, the Bayesian attack graph generation module 502, the optimal attack path planning module 503, the first attack processing module 504, the optimal attack path re-planning module 505, the second attack processing module 506 and the attack library deployment module, thereby making up for the current network attack technology which is single and inefficient, the low degree of network security test automation, the chaotic attack process and the low attack success rate. The Bayesian attack graph generation module 502 optimizes the structure of the Bayesian attack graph, and the Bayesian attack graph is suitable for quickly generating in a large-scale complex network and avoiding the problem of information explosion due to the increase of the complexity of the target network system. The optimal attack path re-planning module 505 dynamically adjusts the risk value weight of the node and replaces the overall optimal attack path with the locally optimal attack path adjustment under the consideration of attack failure, thereby improving the attack success rate of the target attack host node, shortening the attack time, reducing the attack cost, and making it applicable to large-scale complex networks.

[0112] In a third aspect, referring to Figure 7 , the embodiment of the application provides an electronic device, including a processor 701, a communication interface 702, a memory 703 and a communication bus 704, wherein the processor 701, the communication interface 702 and the memory 703 complete mutual communication through the communication bus 704;

[0113] The memory 703 is configured to store a computer program.

[0114] The processor 701 is configured to implement the steps of the method for reconstructing a UAV network topology for on-demand services as described above when executing the program stored in the memory 703.

[0115] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores a computer program. The computer program is configured to implement the steps of the method for reconstructing a UAV network topology for on-demand services when executed by a processor.

[0116] For the device / electronic device / storage medium embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant part can be referred to the part of the method embodiment.

[0117] In the description of the present application, it should be understood that the terms "first", "second" are used only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0118] Although the present application is described herein in conjunction with various embodiments, other variations of the disclosed embodiments can be understood and implemented by those skilled in the art with reference to the specification and drawings. In the specification, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude a plurality. Some measures are described in mutually different embodiments, but this does not mean that these measures cannot be combined to produce good results.

[0119] The above is a further detailed description of the present application in conjunction with specific preferred embodiments, and the specific implementation of the present application cannot be limited to these descriptions. For those skilled in the art to which the present application belongs, without departing from the concept of the present application, a number of simple deductions or substitutions can be made, which should be regarded as falling within the scope of protection of the present application.

Claims

1. A method for intelligently constructing attack scenarios, characterized in that, This method is applied to intranet environments, where the connection relationships between all target network host devices are set to static ARP connections, while the corresponding dynamic ARP connections are disabled. The methods include: Collect vulnerability information from the target network system; A Bayesian attack graph is generated using the vulnerability information. The Bayesian attack graph includes a set of target network host devices, a set of static ARP connection relationships between target network host devices, and a set of risk values ​​corresponding to the target network host devices. The risk value corresponding to each target network host device is used as the prior probability of the target network host device to plan the optimal attack path from the attack initiating host to the target attacking host. The optimal attack path from the attack initiating host to the target attacking host is planned using the Bayesian attack graph. The target host was simulated and verified using attack software tools along the optimal attack path. When an intermediate attack host fails in the optimal attack path, the Bayesian attack graph is used to replan the optimal attack path from the attack initiating host to the target attack host. The target host was simulated and verified again using attack software tools along the newly planned optimal attack path; The process of planning the optimal attack path from the attack initiating host to the target attacking host using the Bayesian attack graph includes: Using the OR structure formed by all target network host devices in the Bayesian attack graph, the conditional probability value corresponding to each target network host device is calculated based on the prior probability of the target network host device; the joint probability value corresponding to each path from the attack initiating host to the attack target host is calculated by traversing based on the conditional probability value; the path corresponding to the largest joint probability value among all joint probability values ​​is selected as the current optimal attack path.

2. The intelligent attack scenario construction method according to claim 1, characterized in that, The risk value corresponding to each target network host device is determined by the CVSS vulnerability scoring system.

3. The intelligent attack scenario construction method according to claim 1, characterized in that, The optimal attack path from the attack initiating host to the target attacking host is replanned using the Bayesian attack graph, including: Iterate through and calculate the joint probability value for each path from the parent attacking host corresponding to the currently failed intermediate attacking host to the child attacking host corresponding to the failed intermediate attacking host. Select the path corresponding to the largest joint probability value among all joint probability values ​​as the current local optimal attack path; The replanned optimal attack path is obtained based on the current local optimal attack path and the attack paths before the parent attack host and after the child attack host corresponding to the failed intermediate attack host in the optimal attack path before replanning.

4. The intelligent attack scenario construction method according to claim 3, characterized in that, Iterate through and calculate the joint probability value for each path from the parent attacking host corresponding to the currently failed intermediate attacking host to the child attacking host corresponding to the failed intermediate attacking host, including: Iterate through and calculate the posterior probability value of each host from the parent host corresponding to the currently failed intermediate attack host to the child host corresponding to the failed intermediate attack host. Based on the posterior probability value, calculate the joint probability value for each path from the parent attacking host corresponding to the currently failed intermediate attacking host to the child attacking host corresponding to the failed intermediate attacking host.

5. An intelligent attack scenario construction system, characterized in that, When used in an intranet environment, the connection relationship between all target network host devices in the intranet environment is set to a static ARP connection relationship, while the corresponding dynamic ARP connection relationship is closed. The corresponding systems include: Vulnerability information collection module, used to collect vulnerability information from the target network system; A Bayesian attack graph generation module is used to generate a Bayesian attack graph using the vulnerability information. The Bayesian attack graph includes a set of target network host devices, a set of static ARP connection relationships between target network host devices, and a set of risk values ​​corresponding to the target network host devices. The risk value corresponding to each target network host device is used as the prior probability of the target network host device to plan the optimal attack path from the attack initiating host to the target attacking host. The optimal attack path planning module utilizes the Bayesian attack graph to plan the optimal attack path from the attack initiating host to the target attacking host. This planning includes: using the OR structure formed by all target network host devices in the Bayesian attack graph, calculating the conditional probability value corresponding to each target network host device based on the prior probabilities of the target network host devices; iterating through and calculating the joint probability value corresponding to each path from the attack initiating host to the attacking target host based on the conditional probability values; and selecting the path corresponding to the largest joint probability value among all joint probability values ​​as the current optimal attack path. The first attack processing module uses attack software tools to perform attack simulation verification on the target host along the optimal attack path; The optimal attack path replanning module replans the optimal attack path from the attack initiating host to the target attacking host by utilizing the Bayesian attack graph when an intermediate attacking host fails in the optimal attack path. The second attack processing module uses attack software tools to perform attack simulation verification on the target host again along the replanned optimal attack path.

6. The intelligent attack scenario construction system according to claim 5, characterized in that, Also includes: The attack library deployment module provides the attack software tools needed during the attack simulation and verification process.

7. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; The memory is used to store computer programs; When the processor executes the program stored in the memory, it implements the steps of the intelligent attack scenario construction method according to any one of claims 1 to 4.

Images