A hybrid attack graph analysis method based on model detection

Abstract

The application discloses a hybrid attack graph analysis method based on model detection, which comprises the following steps: (1) defining a hybrid attack graph (HAG) model; (2) proposing conversion rules from the hybrid attack graph to a time automaton; (3) defining system security attributes by using metric interval temporal logic (MITL); (4) performing model detection on the converted time automaton and the security attributes by using a model detector; and (5) analyzing the model detection result. The application provides the hybrid attack graph analysis method based on the model detection, solves the problems that a complex industrial internet of things system is difficult to model, network attacks are difficult to determine, and the hybrid attack graph is difficult to perform model detection, and expands coping strategies of the industrial internet of things system after network attacks. The application comprehensively considers influences of the network attacks on states of the industrial internet of things system and connections between different states, can timely and effectively find network attack behaviors, and avoids occurrence of the network attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial internet of things modeling analysis and network security, and particularly relates to a hybrid attack graph analysis method based on model detection. BACKGROUND

[0002] Industrial internet of things systems are vulnerable to complex multi-step and multi-host attacks today. Simple methods can identify vulnerabilities and analyze the security of such networks, but will produce incomplete and limited security evaluation results. In addition, some current models only consider the influence of individual vulnerabilities on system states and do not consider the mutual influence between system states. In reality, industrial internet of things systems are usually complex and interwoven, and if only individual vulnerabilities are considered without considering the mutual influence between system states, it will pose a challenge to the safe and stable operation of industrial internet of things systems. Model detection is a method for checking whether a finite state model of a system satisfies a given security property. TACK (Timed Automata Checker) is a new technology for model checking MITL properties on TA (timed automata) networks based on pure logic. This technology converts MITL and TA into constraint linear temporal logic formulas (CLTLoc, Constraint linear temporal logic over clocks) about clocks, and then the CLTLoc is verified by a suitable solver.

[0003] The present application proposes a hybrid attack graph model. In comparison, the traditional attack graph is a model-based network security evaluation technology that usually only considers the attack permissions obtained by the attacker in the system and other discrete variables and does not consider continuous variables (such as temperature and time). The hybrid attack graph expands continuous variables on the basis of the traditional attack graph, can more comprehensively analyze the influence of different attack types on the system, and has the advantage that the new model has better understandability and expandability and is also good for systems with interrelated states. The purpose of the present application is to realize model detection of the hybrid attack graph and can deduce complete attack paths and attack targets. SUMMARY

[0004] In order to solve the above problems, the purpose of the present application is to provide a hybrid attack graph analysis method based on model detection to solve the problem of coexistence of continuous variables and discrete variables in industrial internet of things systems, can give accurate judgment and analysis on the security properties of the interrelated states in the system, and support graphical analysis and processing, which is convenient to use.

[0005] To achieve the above object, the application provides the following technical scheme: a hybrid attack graph analysis method based on model detection, comprising the following steps:

[0006] Step 1: defining a hybrid attack graph (HAG) model;

[0007] Step 2: proposing conversion rules of the hybrid attack graph (HAG) to a time automaton (TA);

[0008] Step 3: defining system security properties by using metric zone temporal logic;

[0009] Step 4: performing model detection on the converted time automaton and the security properties by using a model detector;

[0010] Step 5: analyzing the result of the model detection.

[0011] Further, the hybrid attack graph defined in step 1 is represented as a tuple HAG=(N,E,C,V,X,D,Φ), wherein:

[0012] (1-1) N={n0,n1,...n m} is a set of attribute nodes, representing vulnerabilities, permissions and resources existing at corresponding positions, and an attacker can control corresponding system resources and obtain higher permissions after successfully exploiting corresponding vulnerabilities, and m is the number of nodes in the attack system;

[0013] (1-2) E is a set of edges describing specific network or physical attacks;

[0014] (1-3) C:={φ}∪Φ∪Pre(q)∪Post(q) represents a condition set, including all empty sets, variable constraints, preconditions and postconditions;

[0015] (1-4) V={φ}∪X∪D is a set of variables, including empty sets, continuous variables and discrete variables;

[0016] (1-5) X represents a set of continuous variables;

[0017] (1-6) D represents a set of discrete variables;

[0018] (1-7) is a variable constraint.

[0019] Further, in the conversion rules of the hybrid attack graph (HAG) to a time automaton (TA) in step (2), the formal definition of the time automaton is TA=(S,T,G,ID,X C ,γ): S: set of state nodes; T: set of state transitions; G: set of guards; ID: set of discrete variables; X C: set of clock variables; γ: clock constraints. The specific conversion process is as follows:

[0020] (2-1) attribute node N→state node S:

[0021] The attribute node n∈N represents the vulnerability, permission and resource existing in the corresponding position; the state node s∈S refers to a condition or situation that meets certain conditions, performs certain activities or waits for certain events in the entire system cycle; since the attribute node and the state node have similar properties, each attribute of the attribute node is detected before conversion and then converted into the corresponding state node s;

[0022] (2-2) edge set E→state transition set T:

[0023] E is the edge set, that is, the atomic attack set, and any edge e∈E represents the migration of the global state. The two ends of the edge represent the migration of one attribute node to another attribute node; T is the set of state transitions in the event automaton, representing the transition from one state to another. As can be seen, E and T are equivalent in semantics, and when E→T conversion is performed, a non-empty edge e is detected, and the nodes before and after e are converted into the corresponding states before and after t;

[0024] (2-2) edge set E→state transition set T:

[0023] E is the edge set, that is, the atomic attack set, and any edge e∈E represents the migration of the global state. The two ends of the edge represent the migration of one attribute node to another attribute node; T is the set of state transitions in the event automaton, representing the transition from one state to another. As can be seen, E and T are equivalent in semantics, and when E→T conversion is performed, a non-empty edge e is detected, and the nodes before and after e are converted into the corresponding states before and after t;

[0024] (2-3) condition set C→guard set G:

[0025] In the attack graph model, any vulnerability node can be successfully exploited when the pre-condition Pre(q) is met; and for any condition node, as long as it is considered to be met as the post-condition Post(q) of any vulnerability that can be successfully exploited; in the time automaton, Guard is a trigger, and when the value of Guard is true, the transition will be activated, and when the value of Guard is false, the transition will not be activated; as can be seen, C and G are equivalent in semantics, and if a non-empty condition node c∈C is detected in the attack graph, it is converted into the corresponding g∈G;

[0026] (2-4) variable set V→discrete variable and clock variable set (ID, X C ):

[0027] In the attack graph model, the variable v∈V is an attribute element of the node, and the variables in the set vary with the nodes; the variable can be continuous or discrete, and both represent information related to the node; in the time automaton, the discrete variable is re-assigned after the state changes. The clock variable is an increasing quantity, which is initialized to zero when the system starts, and then increases synchronously at the same rate; when the variable v is detected, if it is determined that v is a continuous variable, it is converted into a clock variable x∈X CIf it is judged that v is a constant, it is converted into a discrete variable id∈ID;

[0028] (2-5) Variable constraint Φ→Clock constraint γ:

[0029] The variable constraint and the clock constraint are the same in semantics, and the variable constraint Φ is directly converted into the clock constraint γ when it is detected.

[0030] Compared with the prior art, the present application has the following beneficial effects:

[0031] The present application proposes a new hybrid attack graph model, which solves the problems of difficult modeling, difficult determination of risk vulnerabilities, difficult tracking and difficult verification of complex industrial Internet of Things systems.

[0032] The hybrid attack graph model proposed by the present application simultaneously considers continuous variables and discrete variables in the industrial Internet of Things system, and can more comprehensively analyze the influence of different attack types on the system.

[0033] The present application proposes a conversion rule from the hybrid attack graph (HAG) to the time automaton (TA), thereby indirectly realizing the model detection of the hybrid attack graph.

[0034] The present application solves the problems of difficult modeling of complex industrial Internet of Things systems, difficult determination of network attacks, and difficult model detection of hybrid attack graphs. It expands the coping strategies of industrial Internet of Things systems after network attacks. It comprehensively considers the influence of network attacks on the state of the industrial Internet of Things system and the connection between different states, can timely and effectively discover network attack behaviors, and avoid the occurrence of network attacks.

[0035] Compared with the prior art, the traditional attack graph is a model-based network security evaluation technology, which usually only considers the attack permissions and other discrete variables obtained by the attacker in the system without considering continuous variables (such as temperature and time continuous variables). The hybrid attack graph expands the continuous variables on the basis of the traditional attack graph, can more comprehensively analyze the influence of different attack types on the system, and has the advantages of better understandability and expandability of the new model, and good adaptability to systems with mutual connection between different states. The purpose of the present application is to realize the model detection of the hybrid attack graph, and can deduce complete attack paths and attack targets.

[0036] The specific embodiments of the present application are disclosed in detail in the following description and drawings, indicating the ways in which the principles of the present application can be employed. It should be understood that the embodiments of the present application are not limited in scope in terms of the range of implementation.

[0037] Features described and / or illustrated with respect to one implementation can be used in one or more other implementations in the same or similar manner, in combination with or in place of one or more features of the other implementations.

[0038] It should be emphasized that the term "comprises / comprising" when used in this specification is taken to mean the presence of stated features, integers, steps or components but not to the exclusion of one or more other features, integers, steps, components or groups thereof. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0040] Figure 1 The detailed flow chart of the hybrid attack graph analysis method based on model detection proposed by the present application;

[0041] Figure 2 The composition schematic diagram of the smart home proposed by the present application;

[0042] Figure 3 The attack graph model schematic diagram of the smart home system proposed by the present application;

[0043] Figure 4 The model schematic diagram of the time automaton proposed by the present application. DETAILED DESCRIPTION

[0044] In order to make the technical personnel in the art better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0045] It should be noted that when an element is referred to as being "on" another element, it can be directly on the other element or there can be one or more intervening elements present. When an element is referred to as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element or intervening elements can be present. The terms "vertical", "horizontal", "left", "right", and the like as used herein are used for illustration only and do not indicate the only possible orientation of the present application.

[0046] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting of the application. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0047] Embodiment 1

[0048] A hybrid attack graph analysis method based on model detection, comprising the following steps:

[0049] Step 1: define a hybrid attack graph (HAG) model;

[0050] Step 2: propose a conversion rule of hybrid attack graph (HAG) to time automaton (TA);

[0051] Step 3: define system security properties using metric zone temporal logic;

[0052] Step 4: use a model detector to perform model detection on the converted time automaton and security properties;

[0053] Step 5: analyze the results of model detection.

[0054] A hybrid attack graph is a model-based system security evaluation technology. It starts from the perspective of an attacker, analyzes multiple system configurations and vulnerability information, finds all possible attack paths, and provides a visualization method for representing attack process scenarios, thereby helping network security managers more intuitively understand the relationships between various states in the target system, the relationships between states and system security configurations, and the potential threats resulting therefrom.

[0055] Define a hybrid attack graph (HAG) model: an attack graph is a directed graph that shows the order and effects of attacks that an attacker can launch, and is composed of two parts: vertices and directed edges. Depending on the type of attack graph, vertices can represent hosts, services, vulnerabilities, permissions, and other network security-related elements, or can represent network security states such as accounts being compromised by attackers or permissions being acquired by attackers. Edges are used to represent the order of attacker attack behavior. In theory, an attack graph can build a complete network security model, reflect the vulnerability of each node in the network, and depict all ways for an attacker to attack important nodes, making up for the fact that previous technologies could only assess the security of nodes and the entire network based on vulnerability numbers and threat levels. Traditional attack graphs only consider discrete variables in hybrid systems and ignore continuous variables, while hybrid attack graphs consider continuous variables based on traditional attack graphs. In this application, a new definition for hybrid attack graphs is proposed;

[0056] In this application, the hybrid attack graph defined in step 1 is represented as a tuple HAG=(N,E,C,V,X,D,Φ), wherein:

[0057] (1-1)N={n0,n1,...n m} is a set of attribute nodes, representing vulnerabilities, permissions and resources existing at corresponding positions, and after an attacker successfully exploits the corresponding vulnerability, the attacker can control the corresponding system resources and obtain higher permissions, and m is the number of nodes in the attack system;

[0058] (1-2)E is a set of edges describing specific network or physical attacks;

[0059] (1-3)C:={φ}∪Φ∪Pre(q)∪Post(q) represents a condition set, including all empty sets, variable constraints, preconditions and postconditions;

[0060] (1-4)V={φ}∪X∪D is a set of variables, including empty sets, continuous variables and discrete variables;

[0061] (1-5)X represents a set of continuous variables

[0062] (1-6)D represents a set of discrete variables;

[0063] (1-7) is a variable constraint.

[0064] For step (2), the conversion rules of hybrid attack graph (HAG) to time automaton (TA) are proposed, the model definition rules of hybrid attack graph are given in step (1), and the hybrid attack graph can be well modeled for industrial Internet of Things system. Time automaton can be well used for modeling real-time systems, and TACK can be used for testing and verifying real-time system models. However, the discrete logic jump and real-time continuous behavior interwoven in the hybrid system behavior are very complex and difficult to control, and conventional means such as testing and simulation cannot exhaust all possible running conditions of the system, and cannot discover all hidden problems in the system. At present, the verification of time automaton is relatively mature. Both hybrid attack graph and time automaton are represented by directed graphs, and have high similarity in semantic description. By converting the hybrid attack graph into a time automaton, the hybrid attack graph can be analyzed and verified based on the semantics of the time automaton. The formal definition of the time automaton is given as follows: TA=(S,T,G,ID,X C ,γ). S: state node set; T: state transition set; G: guard set; ID: discrete variable set; X C : clock variable set; γ: clock constraint. The specific conversion process is as follows:

[0065] (2-1) attribute node N→state node S:

[0066] An attribute node n e N represents a vulnerability, a right or a resource existing in the corresponding location; a state node s e S is a condition or situation that satisfies certain conditions, performs certain activities or waits for certain events in the entire system cycle; since attribute nodes and state nodes have similar properties, each attribute of an attribute node is detected before conversion and then converted into a corresponding state node s;

[0067] (2-2) The set of edges E→the set of state transitions T:

[0068] E is the set of edges, i.e., the set of atomic attacks, and any edge e e E represents the transition of a global state. The two ends of the edge represent the transition of an attribute node to another attribute node; T is the set of state transitions in the event automaton, representing the transition of one state to another state. As can be seen, E and T are semantically equivalent, and when E→T is converted, a non-empty edge e is detected, and the nodes before and after e are converted into the corresponding states before and after t;

[0069] (2-3) The condition set C→the guard set G:

[0070] In the attack graph model, any vulnerability node can be successfully exploited when the pre-condition Pre(q) is met; and for any condition node, as long as it is considered to be met when any vulnerability with the post-condition Post(q) can be successfully exploited; in the timed automaton, Guard is a trigger that activates the transition when its value is true, and does not activate the transition when its value is false; as can be seen, C and G are semantically equivalent, and if a non-empty condition node c e C is detected in the attack graph, it is converted into the corresponding g e G;

[0071] (2-4) The variable set V→the discrete variable and clock variable set (ID, X C ):

[0072] In the attack graph model, a variable v e V is an attribute element of a node, and the variables in the set vary with the nodes. The variable can be continuous or discrete, and both represent information related to the node; in the timed automaton, the discrete variable is re-assigned after the state changes. The clock variable is an increasing quantity that is initialized to zero when the system starts, and then increases synchronously at the same rate; when a variable v is detected, if it is determined that v is a continuous variable, it is converted into a clock variable x e X C , and if it is determined that v is a constant, it is converted into a discrete variable id e ID;

[0073] (2-5) Variable constraint Φ→clock constraint γ:

[0074] Variable constraints and clock constraints are semantically the same. When a variable constraint Φ is detected, it can be directly converted into a clock constraint γ.

[0075] In step (3), we use metric interval temporal logic to define system security properties: In logic, metric interval temporal logic (MITL) is a system of rules and symbols used to represent and reason about propositions bounded by time. This is a temporal logic system based on modal logic that can be used to describe the real-time characteristics of computer systems. The following is a definition of metric interval temporal logic:

[0076] (3-1) ei: In the process of q→q' transition, it is not true in the q state, but true in the q' state;

[0077] (3-2)ie: In the process of q→q' transition, it is true in the q state, but not true in the q' state;

[0078] (3-3)F_xy lower_time_bound upper_time_bound x,y must be associated with the value i (inclusive) or e (exclusive) and specify the formula Should lower_time_bound and upper_time_bound finally hold?

[0079] (3-4)G_xy lower_time_bound upper_time_bound x,y must be associated with the value i (inclusive) or e (exclusive) and specify the formula Should lower_time_bound and upper_time_bound always hold?

[0080] (3-5)G_x+lower_time_bound x must be associated with the value i (inclusive) or e (exclusive) and specify the formula Should lower_time_bound always hold?

[0081] (3-6)F_x+lower_time_bound x must be associated with the value i (inclusive) or e (exclusive) and specify the formula Should lower_time_bound finally hold?

[0082] (3-7) Contains

[0083] (3-8) Conjunction

[0084] (3-9) Must hold at least until is true;

[0085] (3-10) Disjunction

[0086] (3-11) Imply each other;

[0087] (3-12) p_s: process p is in state s;

[0088] (3-13) id = INT: specifies the value of variable id;

[0089] Two examples of the definition of safety properties (MITL) by the above steps

[0090] As the MITL formula (G_i+0(p1_b)) means: in (0,∞) units of time, state b is always true on process p1.

[0091] For example, the MITL formula (G_i+0(→(p1_b)(F_i+0(p1_c)))) means: in (0,∞) units of time, state b is in process p1 and state c is in process p1 in (0,∞) units of time at least once is an implication relationship, and this implication relationship is globally true.

[0092] For step (4), model checking the converted timed automaton and safety properties (MITL) using a model checker: the present application relies on the conversion of timed automata and metric zone temporal logic property formulas into CLTLoc, which is verified by available decision procedures (such as SMT-solvers). Model checking can include the following steps:

[0093] (4-1) Determine the timed automaton TA: the timed automaton is a finite state machine extended with clock variables, which is described using the same syntax of UPPAAL, evaluates the dense time model with time variables as real numbers, and all clocks are synchronized;

[0094] (4-2) Determine the safety property MITL: the MITL formula is an MTL formula, such that each set of real numbers used in the subscript is an interval, and its boundary is a natural number or infinity;

[0095] (4-3) Convert the metric temporal logic MITL formula and the time automaton TA into an intermediate logic language (CLTLoc);

[0096] (4-4) Use a decision procedure to verify the satisfiability of the intermediate logic language (CLTLoc).

[0097] For step (5), analyze the result of the model checking: The time automaton model checker is a pure logic-based method to model check the metric temporal logic properties of a time automaton network. The metric temporal logic formula and the time automaton model are converted into an intermediate logic language by encoding the constraints on the clocks, the network encoding, the encoding activity, the synchronization, and the edge constraints. The intermediate logic language is then processed by an appropriate solver.

[0098] (5-1) Output satisfied when the decision result satisfies the safety property;

[0099] (5-2) Output not satisfied when the decision result does not satisfy the safety property, and a counterexample file counterexample.txt is generated. A snippet of a counterexample file is given below for understanding:

[0100] ------time4------

[0101] now = 50.0

[0102] x5 = 17.3333333333

[0103] x1 = 30.6666666666

[0104] x2 = 0.0

[0105] x3 = 0.0

[0106] x4 = 17.3333333333

[0107] p2.s7

[0108] p1.s3

[0109] id = 1

[0110] p5.s9

[0111] p4.s9

[0112] p3.s3

[0113] The counterexample file records the current time, clock value, current state, continuous variable value and discrete variable value in each time unit. The correct attack path and attack target can be derived by the values of different states in different time units. The counterexample file can help the network security manager to intuitively understand the relationship between the states in the target system, the relationship between the states and the system security configuration, and the potential threats generated thereby.

[0114] Advantages: Compared with the prior art, the hybrid attack graph analysis method based on model detection provided by the application can analyze the influence of different attack types on the system more comprehensively compared with the traditional attack graph, and the new model has better understandability and expandability. Meanwhile, the mutual influence of different states in the industrial Internet of Things system is also considered. The hybrid attack graph is converted into a time automaton that can be subjected to model detection. Then, the time automaton and the security attribute are taken as inputs to make reasonable analysis of the security attribute by using a model detection tool. The application represents the mutual relationship between different states of the system in a graphical manner, which is image intuitive and easy to use.

[0115] The application will be further described in detail below with reference to the drawings.

[0116] Figure 1 A detailed flowchart of the hybrid attack graph analysis method based on model detection is given.

[0117] Taking an intelligent home system as an example, Figure 2 A composition schematic diagram of the intelligent home is given. The intelligent home system contains five possible attack lines.(1) The attacker connects the home internal LAN to obtain the IP address of the home camera. Assuming that the user sets a strong password, the attacker can enter the camera operation interface through brute force cracking, and then achieve the goal of adjusting the angle of the camera;(2) The attacker connects the network port on the smart lamp to enter the home internal LAN, and then obtains the network transmission data, and achieves the attack goal of triggering the smoke alarm by tampering with the detection value of the smoke alarm;(3) The attacker connects the network port on the smart lamp to enter the home internal LAN, and then obtains the network transmission data to enter the camera operation page, and then achieves the goal of adjusting the angle of the camera;(4) The attacker connects the network port on the smart lamp to enter the home internal LAN, obtains the control authority of the home smart sound box after obtaining the network transmission data, and achieves the attack goal of recording through the smart sound box;(5) The attacker connects the network port on the smart lamp to enter the home internal LAN, obtains the control authority of the home smart sound box after obtaining the network transmission data, and achieves the attack goal of controlling other home devices through the authority of the smart sound box.

[0118] Figure 3The hybrid attack graph model of the smart home system is given. The hybrid attack graph reflects the possible attack path in the smart home system. For any vertex, it is represented by a triple <n, c, v>, n∈N represents the attribute node, c∈C represents the attack condition, including the precondition and the postcondition. v∈V represents the node information, which can be a discrete variable and a discrete variable. The edge e∈E represents the path of the attack.

[0119] Figure 4 The model diagram of the time automaton is given. The time automaton theory is based on the original automaton theory with the addition of clock variables. The addition of clock variables enables the system model to express time, which effectively solves the time expression problem of real-time systems. The time automaton TA is a set of arrays, TA=(S, T, G, ID, X C , γ). s∈S represents the state node, t∈T represents the state transition, g∈G represents the guard, which is the threshold of state transition. ID and X C represent the discrete variable and clock variable set respectively, and γ represents the clock constraint

[0120] Any numerical value recited herein includes all values from the lower value and up to the upper value in increments of one unit, provided that there is a separation of at least two units between any lower value and any higher value. As an example, if a numerical value is recited as from 1 to 90, preferably from 20 to 80, more preferably from 30 to 70, it is intended that all values between 15 and 85, 22 and 68, 43 and 51, 30 and 32, etc. are expressly enumerated. For values which are less than one, one unit is considered to be 0.0001, 0.001, 0.01, 0.1, as appropriate. These are only examples of what is specifically intended and all possible combinations of numerical values between the lowest value and the highest value enumerated, are to be considered to be expressly stated in this application in a similar manner.

[0121] Unless otherwise stated, all ranges include both endpoints and all numbers between the endpoints. "About" or "approximately" as applied to any numerical value means that the value of the specified dimensional characteristic is within lower and upper values of ten percent (10%) of the stated numerical value. Thus, "about 20 to 30" is intended to cover "about 20 to about 30", inclusive of at least the specified endpoints.

[0122] All articles and references, including patent applications and publications, disclosed herein are incorporated by reference for all purposes. The term "consisting essentially of to describe a combination shall include the elements, ingredients, components or steps identified, and such other elements, ingredients, components or steps that do not materially affect the basic and novel characteristics of the combination. The use of the term "comprising" or "including" to describe combinations of elements, ingredients, components or steps herein also is taken to mean that other elements, ingredients, components or steps are optional in an embodiment of the present teachings to the extent that "comprising" or "including" is used. The use of the term "about" to describe any property, parameter or value is meant to convey that the exact value need not be used, but that the desired range is within 10% of the exact value.

[0123] Plural elements, ingredients, components or steps can be provided by a single integrated element, ingredient, component or step. Alternatively, a single integrated element, ingredient, component or step might be divided into separate plural elements, ingredients, components or steps. To the extent any of the above descriptions are presented in terms of methods, acts or steps, it should be understood that such methods, acts or steps can be performed in the order presented, or in any other order that is logically possible.

[0124] It is to be understood that the above description is intended to be illustrative, and not restrictive. Many embodiments and applications other than the examples provided would be apparent to those of skill in the art upon reading the above description. The scope of the teachings should, therefore, be determined not with reference to the above description, but should instead be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled. The disclosures of all articles and references, including patent applications and publications, are incorporated by reference for all purposes. The omission of any aspect of the subject matter disclosed herein does not preclude coverage of that aspect of the subject matter in the claims.

Claims

1. A hybrid attack graph analysis method based on model checking, characterized in that: The steps include: Step 1: Define the Hybrid Attack Graph (HAG) model; Step 2: Propose the transformation rules from hybrid attack graph (HAG) to timed automaton (TA); Step 3: Define system security attributes using measurement zone temporal logic; Step 4: Use the model checker to perform model checking on the converted timed automaton and safety properties; Step 5: Analyze the results of model testing; The hybrid attack graph defined in step 1 is represented as a tuple ,in: (1-1) It is a collection of attribute nodes, which represent the vulnerabilities, permissions and resources in the corresponding locations. After the attacker successfully exploits the corresponding vulnerability, he can control the corresponding system resources and obtain higher permissions. is the number of nodes in the attack system; (1-2) is a set of edges that describe a specific network or physical attack; (1-3) Represents a set of conditions, including all empty sets, variable constraints, preconditions, and postconditions; (1-4) is a set of variables, including the empty set, continuous variables, and discrete variables; (1-5) represents a set of continuous variables; (1-6) Represents a set of discrete variables; (1-7) is a variable constraint; The step 5 is as follows: (5-1) When the judgment result satisfies the security property, output satisfied; (5-2) When the judgment result does not satisfy the safety property, the output is not satisfied and a counterexample file counterexample.txt is generated; The counterexample file records the current time, clock value, current state, continuous variable value and discrete variable value in each time unit; the correct attack path and attack target can be deduced through the values ​​of different states in different time units.

2. The hybrid attack graph analysis method based on model checking according to claim 1 is characterized by: In the conversion rule from the hybrid attack graph (HAG) to the timed automaton (TA) in step (2), the formal definition of the timed automaton is: ; : state node collection; : state transition set; : guard collection; : a set of discrete variables; : clock variable collection; : Clock constraints; the specific conversion process is as follows: (2-1) Attribute node N → state node S: Property Node Indicates the vulnerabilities, permissions, and resources that exist at the corresponding location; status node Refers to a condition or situation in which certain conditions are met, certain activities are performed, or certain events are waited for during the entire system cycle. Since attribute nodes and state nodes have similar properties, each attribute of the attribute node is detected before conversion and then converted into the corresponding state node. ; (2-2) Edge set E → state transition set T: E is the edge set, that is, the atomic attack set, any edge Both represent the migration of global states. The two ends of the edge represent the migration from one attribute node to another attribute node. T is the set of state transitions in the event automaton, which represents the transition from one state to another. It can be seen that E and T are semantically equivalent. When E→T transitions, a non-empty edge is detected. ,Will The front and back nodes are converted to corresponding Before and after status; (2-3) Condition set C → Guard set G: In the attack graph model, any vulnerability node, when the precondition is met The vulnerability can be successfully exploited only when Any vulnerability in the attack graph can be successfully exploited, and the condition is considered to be satisfied. In the timed automaton, Guard is a trigger. When the value of Guard is true, the transition will be activated. When the value of Guard is false, the transition will not be activated. It can be seen that C and G are semantically equivalent. If a conditional node is detected in the attack graph, When it is not empty, convert it to the corresponding ; (2-4) Variable set V → discrete variables and clock variables set : In the attack graph model, the variable It is an attribute element that represents a node. The variables in the set change with different nodes. The variables can be continuous or discrete, and both represent information related to the node. In a timed automaton, discrete variables are reassigned after the state changes. The clock variable is an increasing quantity. When the system starts, they are initialized to zero and then increase synchronously at the same rate. When a variable is detected, When judging If it is a continuous variable, convert it into a clock variable If you judge is a constant, convert it into a discrete variable ; (2-5) Variable constraints →Clock Constraints : Variable constraints are semantically identical to clock constraints. Convert it directly to a clock constraint That's it.

Images