Minimum deployment method and system for breadcrumb deception resources in information networks

Abstract

The present invention relates to the field of network security technology, and in particular to a method and system for minimum deployment of breadcrumb deception resources in an information network. The method generates an uncertain attack graph based on the dependency relationship between vulnerabilities in the information network, the probability of network connectivity, and the probability of illegal external connections, and constructs a set of possible attack paths based on the uncertain attack graph: the degree of node connection is used as the importance of each node in the attack path, and the minimum key set used as breadcrumb deployment points on the attack path set is determined based on the importance of each node. The minimum number of breadcrumbs on each deployment point is determined based on a preset expected probability threshold of the attacker introducing a trap; and the number of breadcrumbs on the corresponding node is deployed based on the minimum number of breadcrumbs on each deployment point. The present invention achieves deception defense with minimal required resources by obtaining the minimum number of breadcrumbs for the attack to introduce a trap and determining the location of the deployment node, which can improve the stability of business operations and the security of key assets in the information network.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and system for minimum deployment of breadcrumb deception resources in an information network. Background Art

[0002] Deception defense, a type of active cybersecurity defense developed from honeypots, can alter the "offense-defense asymmetry." Defenders proactively deploy deceptive resources within information networks to mislead or disrupt attackers' cognitive processes, inducing them to take actions or inactions that benefit the defenders. This increases the workload, uncertainty, and complexity of the attack, wastes the attacker's precious, limited time and resources, and creates opportunities for defenders to detect, delay, or block intrusions, ultimately improving network security. Deception defense typically involves deploying deceptive resources such as honeypots or employing Moving Target Defense (MTD). For example, server-side management and configuration of honeypots employ high-interaction honeypots, which can deceive and consume the attacker's time and energy, buying time for the defense. Honeypots are deployed across various business networks to increase the probability of capturing attackers' attacks. Decoys and camouflaged agents (probes) are used to lure attackers into attacking the honeypots. The purpose of the decoys is to provide attackers with various false intelligence, allowing them to follow the bait's clues and access the honeypots. While the paper does not specify how to deploy the decoys, the baits described here are similar to the breadcrumbs discussed in this paper. Another example is the deception defense method based on mobile target defense. Based on software-defined networking, it obfuscates the target network and system information gathered by attackers and dynamically and randomly changes the IP addresses of nodes within the network, prolonging the time it takes attackers to scan for vulnerable hosts within the network, thereby increasing their time cost. Furthermore, using a quantitative deception defense approach, while achieving effective defense, it minimizes the effective information released by the deception environment. Based on optimal stopping theory, a model for maximizing information gain is constructed. This model calculates the ratio between the amount of information leaked and the amount of effective information leaked for each attack action. By maximizing information gain, the optimal suppression time is determined, allowing subsequent attacks to be suppressed. However, this method, which uses a model that releases effective information, carries certain risks.

[0003] Breadcrumbs are specialized deceptive resources planted on real assets in information networks to lure attackers into attack traps. They have no standardized form and typically consist of carefully crafted resources that attackers diligently seek out but are of little interest to legitimate employees. These include fake server addresses, evocative emails with attractive subject lines, seemingly authentic local RDP remote connection records, fake browser access history, and so on. They can also be fabricated system resources or any other files and data that attract attackers. Currently, when deploying deceptive breadcrumb resources, defenders cannot accurately calculate the required number of breadcrumbs based on network characteristics, nor can they accurately determine the appropriate placement of breadcrumbs based on patterns such as network vulnerabilities. This often leads to defenders deploying an excessive number of breadcrumbs in the system. Attackers can easily detect these deceptive resources through comparison, realizing they are being decoyed and becoming more cautious. This makes it more difficult for defenders to fully characterize the attacker. Furthermore, generating, using, and maintaining a large number of breadcrumbs requires increased manpower, material, and financial resources. Therefore, defenders strive to minimize the scale and number of breadcrumb deployments. The problem of minimum deployment of breadcrumb deception resources is how to deploy the least number of breadcrumbs to lure attackers into a trap, provide a minimum quantity benchmark for generating breadcrumbs, and provide an effective deployment method. This is very meaningful for quantifying the use of deception resources such as breadcrumbs. Summary of the Invention

[0004] To this end, the present invention provides a method and system for minimum deployment of breadcrumb deception resources in an information network. By obtaining the minimum number of breadcrumbs to introduce traps into the attack and determining the deployment node locations, deception defense with minimal required resources can be achieved, which can improve the stability of business operations and the security of key assets in the information network.

[0005] According to the design scheme provided by the present invention, a method for minimum deployment of breadcrumb deception resources in an information network is provided, which is used to quantify and deploy bait-type breadcrumb resources for deception defense in network space, including:

[0006] An uncertain attack graph is generated based on the dependency relationship between vulnerabilities in the information network, the network connectivity probability, and the illegal external connection probability, and a set of possible attack paths is constructed based on the uncertain attack graph:

[0007] The degree of node connection is used as the importance of each node in the attack path. The minimum key set used as breadcrumb deployment points on the attack path set is determined based on the importance of each node. The minimum number of breadcrumbs at each deployment point is determined based on the preset expected probability threshold of the attacker introducing a trap.

[0008] The number of breadcrumbs on the corresponding node is deployed based on the minimum number of breadcrumbs at each deployment point.

[0009] As a method for minimum deployment of breadcrumb deception resources in an information network of the present invention, further, an uncertain attack graph is generated based on the dependency relationship between vulnerabilities in the network, the network connectivity probability and the illegal external connection probability, including:

[0010] First, read the topology of the information network and scan the network vulnerability information to generate attack graph nodes;

[0011] Next, we connect each node in a direction based on the vulnerability dependency relationship and the probability of connection, network connectivity probability, and illegal external connection probability to form a parent-child node relationship, and use each conditional probability as the weight of each directed edge.

[0012] Then, for child nodes with multiple parent nodes, an uncertain attack graph is obtained based on whether there are logical AND and logical OR relationships between their parent nodes.

[0013] As a method for minimum deployment of breadcrumb deception resources in an information network of the present invention, further, a set of possible attack paths is constructed based on the uncertain attack graph, including:

[0014] First, the target node set to be protected in the uncertain attack graph is set, and the set of nodes without incoming edges is defined as the initial node set;

[0015] Then, each node in the target node set is traversed, and the attack path set is obtained by searching the parent node and the child nodes of the parent node path of each node.

[0016] As a method for minimum deployment of breadcrumb deception resources in an information network of the present invention, further, an attack path set is obtained by searching the parent node of each node and the child nodes of the parent node path, including:

[0017] Select a node from the target node set and set the path child node recorded in the node data structure to empty;

[0018] According to the directed edges of the attack graph, reverse search for all parent nodes of the node, record its path child node as the current node in the data structure of each parent node, and add the parent node to the first-in-first-out queue used as the edge set. Use the first-in-first-out queue of the edge set and build a path set by finding whether the parent node of the current node belongs to the initial node set. Add the nodes that belong to the initial node set to the path set until all nodes in the target node set are traversed;

[0019] Take all nodes from the path set in turn, find the next node through the child nodes recorded in each node data structure, until the end of the path, and form each corresponding directed path by connecting the nodes.

[0020] As a method for minimizing the deployment of breadcrumb deception resources in an information network of the present invention, further, a first-in-first-out queue of an edge set is utilized and a path set is constructed by finding whether the parent node of the current node belongs to the initial node set, including:

[0021] Take the head node from the edge set and determine whether the head node belongs to the initial node set. If it does, put the node into the path set. If not, put the head node into the edge set.

[0022] As a method for minimum deployment of breadcrumb deception resources in an information network of the present invention, further, a minimum key set for serving as breadcrumb deployment points on an attack path set is determined based on the importance of each node, including:

[0023] First, a node is taken from the attack path set. Based on the path subnodes of the node, the next path subnode on the path is found until the target node set is reached. Finally, the sequence of all the found path subnodes is used as the corresponding directed path.

[0024] Then, the directed path is regarded as a first-in-first-out queue. By calculating the degree of each node in the queue, the node with the largest degree is selected and incorporated into the minimum critical set; until all nodes in the attack path set are taken, the minimum critical set as the breadcrumb deployment point is obtained.

[0025] As a method for minimum deployment of breadcrumb deception resources in an information network of the present invention, further, a directed path is regarded as a first-in-first-out queue. By calculating the degree of each node in the queue, the node with the largest degree is selected and incorporated into the minimum key set until all nodes in the attack path set are obtained, and the minimum key set as the breadcrumb deployment point is obtained, which includes:

[0026] Set the variable Max for recording the maximum degree of the node in the directed path and the variable c for recording the node with the maximum degree in the directed path, and the variable C for recording the minimum key set. The initial value of Max is 0, the initial value of c is an empty node, and the initial value of C is an empty set. Determine whether the current head node belongs to the target node set. If it does, incorporate the node recorded by variable c into the minimum key set, and select the next directed path from the attack path set as the first-in-first-out queue. If it does not belong, determine whether the degree of the current head node is greater than Max. If it is, assign the current head node to variable c, and assign the degree of the current head node to variable Max. If it is not, then take the current head node out of the first-in-first-out queue and determine whether it belongs to the target node set, until all nodes in the attack path set are traversed and the final minimum key set C is output.

[0027] As a method for minimum deployment of breadcrumb deception resources in an information network of the present invention, further, a minimum number of breadcrumbs at each deployment point is determined according to a preset expected probability threshold of an attacker introducing a trap, including:

[0028] First, the uncertain attack graph is regarded as a Bayesian network, and the path subset passing through the deployment point nodes in the minimum critical set is obtained from the attack path set;

[0029] Next, the Bayesian network is used to solve and obtain the probability that the deployment point node is discovered by the attacker on the path subset;

[0030] Then, the number of breadcrumbs required for each node in the minimum critical set is obtained by using the pre-set breadcrumb temptation value, the expected probability threshold of introducing traps, and the probability of the deployment point node being discovered by the attacker on the path subset.

[0031] As a method for minimum deployment of breadcrumb deception resources in an information network of the present invention, further, a calculation formula for the number of breadcrumbs required for each node in the minimum key set is represented as follows: Among them, P sweetness Indicates the breadcrumb temptation value, ξ represents the expected probability threshold of introducing a trap, P find It represents the probability that the deployment point node is discovered by the attacker on the path subset, and h represents the number of breadcrumbs required for each node in the minimum critical set.

[0032] Furthermore, the present invention also provides a minimum deployment system for breadcrumb deception resources in an information network, which is used to quantify and deploy bait-type breadcrumb resources for deception defense in network space, including: a path acquisition module, a node evaluation module and a node deployment module, wherein:

[0033] The path acquisition module is used to generate an uncertain attack graph based on the dependency relationship between vulnerabilities in the information network, the network connectivity probability, and the illegal external connection probability, and to construct a set of possible attack paths based on the uncertain attack graph:

[0034] The node evaluation module is used to use the degree of node connection as the importance of each node in the attack path. Based on the importance of each node, the minimum key set used as breadcrumb deployment points on the attack path set is determined. The minimum number of breadcrumbs at each deployment point is determined based on the preset expected probability threshold of the attacker introducing a trap.

[0035] The node deployment module is used to deploy the number of breadcrumbs on the corresponding node based on the minimum number of breadcrumbs at each deployment point.

[0036] Beneficial effects of the present invention:

[0037] In response to the current lack of quantitative guidance for the deployment of breadcrumb resources for deception defense in cyberspace, the present invention provides a method for calculating the minimum number of breadcrumbs required to ensure that attacks are led into traps and determining their deployment locations. This method uses an uncertain attack graph to construct a set of possible attack paths, and calculates the minimum key set on the attack path set as the deployment points of the breadcrumbs. Based on a preset expected probability threshold of the attacker introducing a trap, the minimum number of breadcrumbs at each point is determined, thereby constructing a deception defense system with minimal resource requirements. Implementing deception defense in information networks can improve the level of normal business operations and the security of key assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 Schematic diagram of the minimum deployment process of breadcrumb deception resources in the information network in the embodiment;

[0039] Figure 2 This is an example diagram of the attack graph structure in the embodiment;

[0040] Figure 3 This is a schematic diagram of the principle architecture of the minimum deployment system of breadcrumb deception resources in the embodiment. DETAILED DESCRIPTION

[0041] In order to make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below with reference to the accompanying drawings and technical solutions.

[0042] Existing deception resources include honeypots and secret networks, but deploying them on information networks is still very costly, and limited honeypots are difficult to deploy on all real assets. In information network deception defense, defenders consider the types of steps an attacker may need to take and their attack targets, and place breadcrumb baits along the attack path to lure intruders into fake honeypots. These breadcrumb baits are related to the adversary's possible targets. If the attacker's target is credentials, the credentials and other Active Directory server addresses should be forged as breadcrumb baits. The present invention addresses the question of where to place these breadcrumb baits. Figure 1 As shown, a method for minimum deployment of breadcrumb deception resources in an information network is provided, which is used to quantify and deploy bait-type breadcrumb resources for deception defense in network space, including:

[0043] S101. Generate an uncertain attack graph based on the dependency relationship between vulnerabilities in the information network, the network connectivity probability, and the illegal external connection probability, and construct a set of possible attack paths based on the uncertain attack graph:

[0044] S102: Using the degree of node connectivity as the importance of each node in the attack path, determining a minimum key set of breadcrumb deployment points on the attack path set based on the importance of each node, and determining the minimum number of breadcrumbs at each deployment point based on a preset expected probability threshold of the attacker introducing a trap;

[0045] S103: Deploy the number of breadcrumbs on the corresponding node according to the minimum number of breadcrumbs at each deployment point.

[0046] By obtaining the minimum number of breadcrumbs introduced by the attack trap and determining the deployment node location, deception defense with minimal resources is achieved to improve the stability of business operations and the security of key assets in the information network.

[0047] As a preferred embodiment, further, when generating an uncertain attack graph, first, the topological structure of the information network is read and the network vulnerability information is scanned to generate attack graph nodes; then, each node is connected in a direction according to the vulnerability dependency relationship and the probability of connection occurrence, the network connectivity probability and the probability of illegal external connection to form a parent node and child node relationship, and each conditional probability is used as the weight of each directed edge; then, for a child node with multiple parent nodes, an uncertain attack graph is obtained based on whether there is a logical AND and logical OR relationship between its parent nodes.

[0048] The topology of the information network is read, network vulnerability information is scanned, and the nodes of the attack graph are generated. Based on the vulnerability dependency relationship and the probability of connection occurrence, network connectivity probability, and the probability of possible illegal external connections, each node is connected in a direction, forming a parent-child relationship. The value (weight) of each directed edge is the conditional probability value. If a node has multiple parents, the parent nodes have both an AND relationship and an OR relationship. This results in an uncertain attack graph. Furthermore, the uncertain attack graph can be represented as a triple AG = (N, E, P):

[0049] 1) N represents the set of attribute nodes in the attack graph, and N = Nstart ∪ Npass ∪ Ntarget, where Nstart represents the set of attack-initiating nodes, Ntarget represents the set of target nodes to be protected, and Npass represents the set of intermediate nodes passed through in the process of moving from the initial node to the target node.

[0050] 2) E={E1,E2,…,E J} represents an edge set, representing the directed association relationship between attribute nodes, where J is the number of edges in the attack graph.

[0051] 3) P = {P1, P2, ..., P J} represents the set of conditional probability values of the edge set.

[0052] The uncertainty attack graph is used as a mapping tool for the breadcrumb minimum deployment problem. Breadcrumbs are deployed on nodes in the attack graph. When an attacker invades a node, the breadcrumb is activated with a certain probability and is attracted to the target node with a certain probability, thus no longer being able to reach the Ntarget set to be protected, that is, the target node set.

[0053] Use the vulnerability scanning software Nessus to scan the vulnerabilities in the network, and generate the uncertain attack graph AG = (N, E, P) of the information network based on the dependency relationship, network connectivity probability and possible illegal external connection probability of the vulnerability. Figure 2 As shown, the graph is a directed graph, and the parameters on the directed edges are the probability of occurrence, such as P(E 41 )=0.8, that is, the probability of the atom N1 transitioning to N4 is 0.8. Let {N1, N2, N3} be Nstart, {N 15} is Ntarget.

[0054] As a preferred embodiment, further, a possible attack path set is constructed based on the uncertain attack graph, including: first, setting the target node set to be protected in the uncertain attack graph, and defining the set consisting of nodes without incoming edges as the initial node set, and the target node set can be specified by the user; then, traversing each node in the target node set, and obtaining the attack path set by finding the parent node and parent node path child node of each node.

[0055] Each attack path Path is a directed subgraph of AG. It is taken from the set of elements in N. If the following conditions are met, Path can be used as an attack path, denoted by L i , where i represents the path number.

[0056] 1) Path's initial node N i To the target node N j There is at least one directed path between them, where N i ∈Nstart,N j ∈Ntarget;

[0057] 2) The prerequisites of each node in the path are met. That is, if the parent nodes of a node in the path are in an AND relationship, the attributes of all its parent nodes must be met; if the parent nodes of a node in the path are in an OR relationship, only the attributes of one parent node need to be met.

[0058] 3) There is no non-empty directed subgraph other than itself in Path.

[0059] As a preferred implementation, further, the attack path set is obtained by searching the parent node and the parent node path child node of each node, including: selecting a node from the target node set, setting the path child node recorded in the node data structure to empty; reversely searching all parent nodes of the node according to the directed edges of the attack graph, recording its path child node as the current node in the data structure of each parent node, and adding the parent node to the first-in-first-out queue used as the edge set, using the first-in-first-out queue of the edge set and constructing the path set by searching whether the parent node of the current node belongs to the initial node set; taking out all nodes from the path set in turn, and finding the next node through the child node recorded in the data structure of each node until the end of the path, forming each corresponding directed path through node connections.

[0060] The specific algorithm of the attack path from Nstart to Ntarget can be designed as follows:

[0061] 1) The edge set (frontier) is set to empty, and the path set L is set to empty;

[0062] 2) Take a node from Ntarget. The data structure of this node records that its path child node is NULL. Then the element in Ntarget is 1 less. If the node cannot be taken out, go to 6);

[0063] 3) Based on the directed edges of the attack graph, reverse search all parent nodes of the current node, record its path child node as the current node in the data structure of each parent node, and then add the parent node to the edge set, which is a first-in-first-out queue;

[0064] 4) Take the head node from the edge set and determine whether it belongs to the Nstart set. If it does, a path has been found and the node is placed in the set L; if it does not belong to the Nstart set, the head node is placed in the edge set;

[0065] 5) Determine whether the edge set is empty. If not, go back to step 4). If it is empty, go back to step 2.

[0066] 6) From the path set L, take out all the head nodes in turn. Each head node searches for the next node in the path according to the child nodes recorded in its data structure until the end of the path, and obtains each directed path.

[0067] When breadcrumbs are deployed in the target node set Ntarget, the attacker has already reached the target node, and the attacker cannot be tricked away from the target node. Therefore, the minimum breadcrumb deployment problem is formalized as follows: Deploy breadcrumbs in the initial node set Nstart and the intermediate node set Npass of the attack graph AG = (N, E, P) so that the probability of the attacker being led into the trap is higher than the threshold ξ, and the number of breadcrumbs is minimal.

[0068] Therefore, breadcrumb deployment can be summarized into two steps: the first step is to select nodes in the attack graph suitable for breadcrumb deployment. The second step is to set up multiple independent breadcrumbs at each deployment node to ensure that attackers can successfully lure them into the trap when they invade the node. The problem of minimum breadcrumb deployment is transformed into two subproblems: selecting deployment nodes and selecting the number of breadcrumbs per node. The optimal solution to both subproblems is to deploy the minimum number of breadcrumbs required on the fewest deployment nodes, thereby minimizing the overall number of breadcrumbs used.

[0069] As a preferred embodiment, further, a minimum key set for breadcrumb deployment points on the attack path set is determined based on the importance of each node. This method includes: first, extracting a node from the attack path set, and based on the node's path child nodes, searching for the next path child node on the path until the target node set is reached. The sequence of all found path child nodes is the corresponding directed path. Then, treating the directed path as a first-in, first-out queue, calculating the degree of each node in this queue, and selecting the node with the largest degree to be incorporated into the minimum key set. This continues until all nodes in the attack path set are extracted, resulting in a minimum key set for breadcrumb deployment points.

[0070] Taking the degree of each node in the path (i.e., the number of connected directed edges, including incoming and outgoing edges, and the sum of in-degree and out-degree) as the importance measure, the algorithm for determining the minimum breadcrumb deployment location set can be designed as follows:

[0071] 1) For the path set L, use C′ to represent the minimum key set, and C′ is initially an empty set;

[0072] 2) Take a directed path L from the path set L i , the number of elements in L is reduced by 1; use the variable Max to record L i The maximum degree of the node in the middle, the initial value of Max is zero; use variable c to record L i The node with the largest degree has c initially set to null. If the element in L is 0, go to step 5, otherwise continue below.

[0073] 3) The directed path L i Treat it as a first-in-first-out queue, take out the current head node s′, and determine whether s′ belongs to Ntarget. If it does, set C′=C′∪{c} and go to 2); if not, continue below;

[0074] 4) Calculate the degree of the node (degree(s′)). If degree(s′) is greater than Max, assign the node s′ to the variable c and assign degree(s′) to the Max variable; otherwise, go back to step 3);

[0075] 5) Obtain the minimum key set C′.

[0076] As a preferred embodiment, further, the minimum number of breadcrumbs on each deployment point is determined based on a preset expected probability threshold of the attacker introducing a trap, comprising: first, regarding the uncertain attack graph as a Bayesian network, and obtaining a path subset passing through the deployment point nodes in the minimum critical set from the attack path set; then, using the Bayesian network to solve and obtain the probability of the deployment point nodes being discovered by the attacker on the path subset; and then, using a preset breadcrumb temptation value, the expected probability threshold of introducing a trap, and the probability of the deployment point nodes being discovered by the attacker on the path subset to obtain the required number of breadcrumbs for each node in the minimum critical set.

[0077] Breadcrumbs are independent of each other. When an attacker invades a real asset node, the probability of triggering the deployment of breadcrumbs on it is P find , after the breadcrumbs are triggered, they will be triggered with a certain probability P sweetness Being attracted into the trap, thus changing the original attack path, called P find is the probability of breadcrumbs being found, P sweetness is the sweetness of the breadcrumbs. The probability of breadcrumbs being discovered is related to the attacker's ability to collect information. The stronger the attacker's ability to collect information, the greater the probability of discovering breadcrumbs deployed on real assets, and vice versa. The sweetness of breadcrumbs is directly related to the temptation of the breadcrumbs themselves. Taking into account the attacker's ability to discover breadcrumbs and the sweetness of breadcrumbs, the probability of an attacker successfully being lured into the trap after invading a node is P sweetness ·P find .

[0078] During the implementation, the current node N j The probability of being discovered by the attacker P find The problem can be solved using a Bayesian network, that is, the uncertain attack graph is regarded as a Bayesian network and solved using the prior joint probability of the Bayesian network.

[0079] The path set L passes through N j The path subset is denoted as Among them, m is the number of j The number of paths, then node N j Probability of being discovered by an attacker

[0080]

[0081] in, Indicates that the attacker passes the path Reach N j Probability. Assume that the path reaches N j When the directed edge passes through the nodes in the reverse direction, xj1 ,…,x1, where x1 represents the head of the path, then

[0082]

[0083] and

[0084] P(N j ,x j-1 ,…,x1)=P(N j |x j-1 ,…,x1)P(x j-1 x j-2 ,…,x1)…P(x2|x1)P(x1)=P(N j |Parents(N j ))·P(x j-1 |Parents(x j-1 ))·…P(x1)

[0085] Among them, Parents() represents the parent node of a node.

[0086] Deploying multiple independent breadcrumbs on a deployment node can increase the success rate of attracting attackers into the trap. ξ is the expected probability that a node breadcrumb leads an attacker into a trap, deployed on a deployment node h A breadcrumb, h Should meet the following requirements:

[0087] 1-(1-P find +(1-P sweetness )·P find ) h ≥ξ

[0088] From the above formula, we can get the number of breadcrumbs on a single deployment node that meets the threshold: h :

[0089]

[0090] Furthermore, based on the above method, an embodiment of the present invention also provides a minimum deployment system for breadcrumb deception resources in an information network, which is used to quantify and deploy bait-type breadcrumb resources for deception defense in network space, including: a path acquisition module, a node evaluation module and a node deployment module, wherein:

[0091] The path acquisition module is used to generate an uncertain attack graph based on the dependency relationship between vulnerabilities in the information network, the network connectivity probability, and the illegal external connection probability, and to construct a set of possible attack paths based on the uncertain attack graph:

[0092] The node evaluation module is used to use the degree of node connection as the importance of each node in the attack path. Based on the importance of each node, the minimum key set used as breadcrumb deployment points on the attack path set is determined. The minimum number of breadcrumbs at each deployment point is determined based on the preset expected probability threshold of the attacker introducing a trap.

[0093] The node deployment module is used to deploy the number of breadcrumbs on the corresponding node based on the minimum number of breadcrumbs at each deployment point.

[0094] The principle architecture of the minimum deployment solution for breadcrumb deception resources can be as follows Figure 3 As shown in the figure, the uncertain attack graph generation module first scans the information network shown on the left of the figure to generate an uncertain attack graph; then, the human-computer interaction configuration module receives the key protected nodes from the user, forming a subset Ntarget of the vertex set of the uncertain attack graph; then, the attack path generation module generates the attack path set L; the breadcrumb deployment node set determination module generates the minimum key set C′; the single node discovery probability calculation module calculates the discovery probability P of each node in the minimum key set C based on the attack path set L. find (N j ),N j ∈C′; Then, the node breadcrumb quantity determination module, according to the P set by the human-computer interface module sweetness Value and expected probability threshold for trap introduction ξ , according to the following formula

[0095]

[0096] The number of breadcrumbs h required for each node in the minimum key set C is calculated; finally, the breadcrumb generation module generates and deploys a deception defense system with minimal deception resources based on the minimum key set C and the number of each node h.

[0097] The present invention can generate a deployment plan that uses the least amount of breadcrumbs based on the structural characteristics of breadcrumbs and the network, providing a scientific basis for the quantitative deployment of breadcrumbs. It can not only reduce the cost of generating, maintaining, and using deceptive resources, but also reduce the degree of suspicion of attackers about the deployment of deceptive resources, and can improve the efficiency of information networks from both economic and security aspects.

[0098] Unless otherwise specifically stated, the relative steps, numerical expressions and values of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0099] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0100] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0101] Those skilled in the art will appreciate that all or part of the steps in the above method can be performed by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps in the above embodiment can be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or software functional modules. The present invention is not limited to any specific combination of hardware and software.

[0102] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A method for minimizing the deployment of breadcrumb deception resources in an information network, for quantifying and deploying decoy breadcrumb resources for deception defense in a network space, characterized in that: Include: Step 1: Generate an uncertain attack graph based on the dependency relationship between vulnerabilities in the information network, network connectivity probability, and illegal external connection probability, and construct a set of possible attack paths based on the uncertain attack graph; Construct a set of possible attack paths based on the uncertain attack graph, including: First, the target node set to be protected in the uncertain attack graph is set, and the set of nodes without incoming edges is defined as the initial node set; Then, traverse each node in the target node set and obtain the attack path set by finding the parent node and the child nodes of the parent node path of each node; The attack path set is obtained by finding the parent node and the child nodes of the parent node path of each node, including: Select a node from the target node set and set the path child node recorded in the node data structure to empty; According to the directed edges of the attack graph, all parent nodes of the selected node are reversely searched. In the data structure of each parent node, its path child node is recorded as the current node. The parent node is added to the first-in-first-out queue of the edge set. The first-in-first-out queue of the edge set is used to build the path set by checking whether the parent node of the current node belongs to the initial node set, until all nodes in the target node set are traversed. Take all nodes from the path set in sequence, find the next node through the child nodes recorded in each node data structure, until the end of the path, and form each corresponding directed path by connecting the nodes; Step 2: The degree of node connectivity is used as the importance of each node in the attack path. Based on the importance of each node, the minimum key set for breadcrumb deployment points on the attack path set is determined. The minimum number of breadcrumbs at each deployment point is determined based on the preset expected probability threshold of the attacker introducing a trap. Step 3: Deploy the number of breadcrumbs on the corresponding node based on the minimum number of breadcrumbs at each deployment point.

2. The method for minimizing the deployment of breadcrumb deception resources in an information network according to claim 1, characterized in that: Generate an uncertain attack graph based on the dependency relationships between vulnerabilities in the network, network connectivity probability, and illegal external connection probability, including: First, read the topology of the information network and scan the network vulnerability information to generate attack graph nodes; Next, we connect each node in a direction based on the vulnerability dependency relationship and the probability of connection, network connectivity probability, and illegal external connection probability to form a parent-child node relationship, and use each conditional probability as the weight of each directed edge. Then, for child nodes with multiple parent nodes, an uncertain attack graph is obtained based on whether there are logical AND and logical OR relationships between their parent nodes.

3. The method for minimizing the deployment of breadcrumb deception resources in an information network according to claim 1, characterized in that: The first-in-first-out queue of the edge set is used to build a path set by finding whether the parent node of the current node belongs to the initial node set, including: Take the head node from the edge set and determine whether the head node belongs to the initial node set. If it does, put the node into the path set. If not, put the head node into the edge set.

4. The method for minimizing the deployment of breadcrumb deception resources in an information network according to claim 1, characterized in that: The minimum key set used as breadcrumb deployment points on the attack path set is determined based on the importance of each node, including: First, a node is taken from the attack path set. Based on the path subnodes of the node, the next path subnode on the path is found until the target node set is reached. Finally, the sequence of all the found path subnodes is used as the corresponding directed path. Then, the directed path is regarded as a first-in-first-out queue. By calculating the degree of each node in the queue, the node with the largest degree is selected and incorporated into the minimum critical set; until all nodes in the attack path set are taken, the minimum critical set as the breadcrumb deployment point is obtained.

5. The method for minimum deployment of breadcrumb deception resources in an information network according to claim 4, characterized in that: Treat the directed path as a first-in-first-out queue. By calculating the degree of each node in the queue, select the node with the largest degree and incorporate it into the minimum critical set until all nodes in the attack path set are taken. The minimum critical set used as the breadcrumb deployment point is obtained, which includes: Set the variable Max for recording the maximum degree of the node in the directed path and the variable c for recording the node with the maximum degree in the directed path, and the variable C for recording the minimum key set. The initial value of Max is 0, the initial value of c is an empty node, and the initial value of C is an empty set. Determine whether the current head node belongs to the target node set. If it does, incorporate the node recorded by variable c into the minimum key set, and select the next directed path from the attack path set as the first-in-first-out queue. If it does not belong, determine whether the degree of the current head node is greater than Max. If it is, assign the current head node to variable c, and assign the degree of the current head node to variable Max. If it is not, then take the current head node out of the first-in-first-out queue and determine whether it belongs to the target node set, until all nodes in the attack path set are traversed and the final minimum key set C is output.

6. The method for minimizing the deployment of breadcrumb deception resources in an information network according to claim 1, characterized in that: The minimum number of breadcrumbs at each deployment point is determined based on the expected probability threshold of the attacker introducing the trap, including: First, the uncertain attack graph is regarded as a Bayesian network, and the path subset passing through the deployment point nodes in the minimum critical set is obtained from the attack path set; Next, the Bayesian network is used to solve and obtain the probability that the deployment point node is discovered by the attacker on the path subset; Then, the number of breadcrumbs required for each node in the minimum critical set is obtained by using the pre-set breadcrumb temptation value, the expected probability threshold of introducing traps, and the probability of the deployment point node being discovered by the attacker on the path subset.

7. The method for minimum deployment of breadcrumb deception resources in an information network according to claim 6, characterized in that: The formula for calculating the number of breadcrumbs required for each node in the minimum key set is: Among them, P sweetness represents the breadcrumb temptation value, ξ represents the expected probability threshold of introducing a trap, P find It represents the probability that the deployment point node is discovered by the attacker on the path subset, and h represents the number of breadcrumbs required for each node in the minimum critical set.

8. A system for minimizing the deployment of breadcrumb deception resources in an information network, for quantifying and deploying decoy breadcrumb resources for deception defense in cyberspace, characterized in that: The system implements the method for minimum deployment of breadcrumb deception resources in an information network as described in any one of claims 1 to 7, comprising: a path acquisition module, a node evaluation module and a node deployment module, wherein: The path acquisition module is used to generate an uncertain attack graph based on the dependency relationship between vulnerabilities in the information network, the network connectivity probability, and the illegal external connection probability, and to construct a set of possible attack paths based on the uncertain attack graph; The node evaluation module is used to use the degree of node connection as the importance of each node in the attack path. Based on the importance of each node, the minimum key set used as breadcrumb deployment points on the attack path set is determined. The minimum number of breadcrumbs at each deployment point is determined based on the preset expected probability threshold of the attacker introducing a trap. The node deployment module is used to deploy the number of breadcrumbs on the corresponding node based on the minimum number of breadcrumbs at each deployment point.

Images