A multi-stage attack defense graph evolution method, system, device and medium

Abstract

A method, system, device and medium for evolving a defense graph for multi-stage attacks, the method comprising: constructing an attack graph for the current cloud environment based on the vulnerability and vulnerability information contained therein according to the current cloud environment asset information; constructing a corresponding set of defense measures for the vulnerability and vulnerability information corresponding to the necessary conditions for achieving each attack step in the attack graph in combination with the ATT&CK knowledge graph; updating the node attributes and connection relationships on the attack graph based on the service paralysis information caused by the attack; updating the node attributes and connection relationships on the attack graph based on the information on the repair of the vulnerabilities and vulnerabilities caused by the deployment of defense measures; updating the defense measure set for each attack step based on the updated attack graph in combination with the ATT&CK knowledge graph; the system, device and medium are used to realize the evolution of the defense graph for multi-stage attacks; providing methodological guidance and support for attack-defense intelligent games, which is more conducive to explainable attack-defense intelligent games.

Description

Technical Field

[0001] The present invention relates to the field of intrusion detection technology in the field of network security, and in particular to a defense graph evolution method, system, device and medium for multi-stage attacks. Background Art

[0002] With the development of cloud computing technology, more and more services are being deployed in the cloud. Besides the stable and efficient operation of business services, the security of the entire business system is also crucial. Compared with traditional static defense methods, intelligent defense can integrate cloud environment information and dynamically update the cloud environment defense map, which is of great significance to the research and application of intelligent defense.

[0003] Existing technologies tend to rely on fixed defense strategies, detecting a specific attack and implementing targeted defenses. While attack graphs constructed based on network asset information, vulnerabilities, and vulnerability information have been used for attack path analysis and prediction, these are static attack graphs and fail to account for changes in the graph during the attack and defense processes. This can lead to the analyzed attack paths being inconsistent with the real-time network environment, impacting the recommendation and deployment of defense measures.

[0004] CN111245828A discloses a method for generating a defense strategy based on a three-party dynamic game, which belongs to the field of network security. This method takes internal and external threats into consideration and instantiates internal threats during the strategy generation process. During the node value measurement process in the initialization phase, the influence of multiple targets on this node is balanced to reduce the bias problem in the node value calculation. In the sequential game process, the defender uses a heuristic method to obtain the path with the greatest threat among multiple attack paths and blocks it; the user side uses a mixed strategy game model to model the user's strategy, thereby increasing the coupling between stealth attacks and internal threats; for the attacker, the uncertainty of its behavior is increased, and three attack strategies are used to simulate the attack behaviors of different attackers respectively. Finally, the defense strategies of each time period are merged to generate the final protection strategy set.

[0005] CN110602047B discloses a multi-step attack dynamic defense decision selection method and system for network attack and defense. The method includes: generating a network attribute attack graph by analyzing network security element information; constructing a network survivability game model based on the attack graph, wherein the model uses an attack and defense strategy matrix to represent the attack and defense strategy and path, and quantifies the attack and defense intensity and network survivability; predicting the attacker's next attack behavior based on the attack strategy matrix in the model, and selecting the optimal multi-step attack and defense strategy based on the attack and defense strategy cost.

[0006] The game process in existing technologies is based on a pre-constructed attack graph, without considering the changes in the attack graph caused by the attack and defense process. There is a lack of real-time updating of the attack and defense graph according to the dynamic attack and defense process, and the support provided for real-time attack and defense games is insufficient. Summary of the Invention

[0007] In order to overcome the defects of the above-mentioned prior art, the purpose of the present invention is to propose a defense graph evolution method for multi-stage attacks, which uses the consequences of attacks and the deployment of defense measures to update the attack graph and further realize the evolution of the defense graph.

[0008] To achieve the above object, the present invention provides the following technical solutions:

[0009] A method for evolving a defense graph against multi-stage attacks, comprising the following steps:

[0010] 1) Based on the asset information of the current cloud environment and the vulnerability and vulnerability information contained in the known cloud environment, an attack graph for the current cloud environment is constructed;

[0011] 2) Based on the ATT&CK knowledge graph, we build a corresponding set of defense measures based on the vulnerabilities and vulnerability information corresponding to the necessary conditions for each attack step in the attack graph in step 1);

[0012] 3) Based on the service paralysis information caused by the attack, delete the subgraphs on the attack graph in step 1) whose attack conditions can no longer be met simultaneously;

[0013] 4) Based on the information about vulnerabilities and vulnerability repairs caused by the deployment of defense measures, delete the subgraphs on the attack graph in step 1) whose attack conditions can no longer be met simultaneously;

[0014] 5) Based on the updated attack graph from steps 3) and 4), combined with the ATT&CK knowledge graph, the set of defense measures for each attack step is updated to achieve the evolution of the defense graph.

[0015] In step 1), based on the asset information of the cloud environment obtained from the network administrator and the vulnerability and vulnerability information obtained through the existing scanning tool Nessus, the permission relationship, connection relationship, vulnerability and vulnerability information, importance and other information of each node in the cloud environment are generated, and a .P file is generated based on the syntax of the MulVal software. The MulVal command is used to generate an attack graph. The subgraph consisting of attack conditions, attack rules and attack results on the attack graph is an attack step.

[0016] In step 2), the necessary conditions for achieving the attack step include vulnerabilities, service provision, network connectivity, and access rights. For each necessary condition, measures related to the current cloud environment are manually selected from the defense measures for vulnerabilities or vulnerabilities defined by ATT&CK to construct a set of defense measures for the attack step as supplementary information for the attack step node in the attack graph.

[0017] In step 3), when a server is paralyzed by an attack and stops serving, the subgraph consisting of attack conditions, attack rules, and attack results on the attack graph corresponding to the server is deleted from the attack graph, so that the updated attack graph correctly represents the current cloud environment.

[0018] In step 4), after the network security personnel deploys a certain defense measure, if the defense measure results in the repair of a vulnerability, suspension of service, disconnection, or deactivation of permissions, and thus causes several attack conditions that need to be met simultaneously in certain attack subgraphs to no longer be met simultaneously, the subgraph is deleted so that the updated attack graph correctly represents the current cloud environment.

[0019] In step 5), after steps 3) and 4) are updated, the change in the attack graph causes the defense measures for the vulnerabilities and vulnerabilities corresponding to the necessary conditions for achieving each attack step to change. Based on the ATT&CK knowledge graph, the set of defense measures for each attack step is updated to achieve the evolution of the defense graph.

[0020] A multi-stage attack defense graph evolution system, including:

[0021] The attack and defense graph generation module is used to generate an attack graph based on the asset information, vulnerabilities, and vulnerability information of the current cloud environment, and then build a defense graph based on the attack graph and the ATT&CK knowledge graph;

[0022] The attack graph update module is used to delete subgraphs on the attack graph whose attack conditions can no longer be met simultaneously based on information such as service paralysis caused by the attack and vulnerability and vulnerability repair caused by the deployment of defense measures;

[0023] The defense graph evolution module is used to update the set of defense measures for each attack step based on the updated attack graph and combined with the ATT&CK knowledge graph, thereby evolving the defense graph.

[0024] A defense graph evolution device for multi-stage attacks, comprising:

[0025] memory for storing computer programs;

[0026] A processor is configured to implement the multi-stage attack defense graph evolution method described in steps 1 to 5 when executing the computer program.

[0027] A computer-readable storage medium stores a computer program, which, when executed by a processor, is capable of evolving a defense graph for a multi-stage attack.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. Compared with the traditional method of constructing a static attack and defense graph based solely on the initial state of the network, during the attack and defense process, the present invention dynamically deletes attack subgraphs on the original attack graph whose attack conditions can no longer be met simultaneously, based on the service paralysis caused by the attack and the repair of vulnerabilities and vulnerabilities caused by the defense. This guides the defender to focus on defending the remaining attack paths, avoiding the situation where the defense measures selected by the defender from the perspective of optimizing the attack and defense benefits are no longer suitable for the current network environment.

[0030] 2. This invention does not directly recommend the optimal defense measure, but rather constrains all possible defense measures in the attack-defense game within a dynamic and effective range. The selection of the specific optimal defense measure is further comprehensively selected by the defender based on the defense cost and benefits.

[0031] 3. The updated attack and defense graph of the present invention can be easily applied to the existing attack and defense game method based on the attack and defense graph, making it easy to integrate the method of the present invention into the existing game model.

[0032] This method dynamically updates the attack and defense graph during the attack and defense process, providing guidance for intelligent game play. While this method doesn't directly recommend specific defense measures based on attack and defense costs and benefits, it does provide a defense template within the context of attack analysis for intelligent game play, further facilitating the selection of optimal defense measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in one or more embodiments of the present disclosure or related technologies, the following briefly introduces the drawings required for use in the description of the embodiments or related technologies. Obviously, the drawings described below are only some of the embodiments described in one or more embodiments of the present disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without inventive work. Other features, purposes, and advantages of the present disclosure will become more apparent by reading the detailed description of the non-limiting embodiments made with reference to the following drawings.

[0034] Figure 1 It is the workflow diagram of the present invention.

[0035] Figure 2 An attack graph for a cloud environment.

[0036] Figure 3 This is the attack graph of the cloud environment after relevant defense measures are deployed. DETAILED DESCRIPTION

[0037] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0038] In the description of the embodiments of the present invention, unless otherwise specified, “a plurality of” means two or more.

[0039] A defense graph evolution method for multi-stage attacks, see Figure 1 , specifically including the following steps:

[0040] 1) Based on the asset information of the current cloud environment and the vulnerability and vulnerability information contained in the known cloud environment, an attack graph for the current cloud environment is constructed: Based on the asset information of the cloud environment obtained from the network administrator and the vulnerability and vulnerability information obtained through the existing scanning tool Nessus, the permission relationship, connection relationship, vulnerability and vulnerability information, importance and other information of each node in the cloud environment are generated. Based on the syntax of the MulVal software, a .P file is generated, and the MulVal command is used to generate an attack graph. The subgraph consisting of attack conditions, attack rules and attack results on the attack graph is an attack step.

[0041] 2) In combination with the ATT&CK knowledge graph, a corresponding set of defense measures is constructed for the vulnerabilities and vulnerability information corresponding to the necessary conditions for each attack step in the attack graph in step 1): the necessary conditions for the attack step include vulnerabilities, service provision, network connection, and access rights. For each necessary condition, measures related to the current cloud environment are manually selected from the defense measures for vulnerabilities or vulnerabilities defined by ATT&CK to construct a set of defense measures for the attack step as supplementary information for the attack step node in the attack graph.

[0042] 3) Based on the service paralysis information caused by the attack, update the node attributes and connection relationships on the attack graph in step 1): When a server is paralyzed by an attack and stops serving, delete the subgraph consisting of the attack conditions, attack rules, and attack results on the attack graph corresponding to the server, so that the updated attack graph correctly represents the current cloud environment.

[0043] 4) Update the node attributes and connection relationships on the attack graph in step 1) based on the information about vulnerabilities and vulnerability repairs caused by the deployment of defense measures: After the network security personnel deploy a certain defense measure, if the defense measure leads to the repair of vulnerabilities, the suspension of services, the disconnection of connections, or the deactivation of permissions, which will cause several attack conditions that need to be met simultaneously in certain attack subgraphs to no longer be met simultaneously, then delete the subgraph so that the updated attack graph correctly represents the current cloud environment.

[0044] 5) After steps 3) and 4) are updated, the change in the attack graph causes changes in the defense measures for the vulnerabilities and vulnerabilities corresponding to the necessary conditions for achieving each attack step. Based on the ATT&CK knowledge graph, the set of defense measures for each attack step is updated to achieve the evolution of the defense graph.

[0045] Example 1

[0046] Figure 2 This example illustrates an attack graph constructed under existing conditions for a cloud environment consisting of three virtual machines (vm1, vm2, and vm3). Based on this attack graph and combined with the ATT&CK knowledge graph, effective defense measures can be recommended for each attack step. Figure 3 This example shows the updated attack graph of the cloud environment after different defense measures are deployed. Based on this attack graph, the scope of effective defense measures can be dynamically updated.

[0047] Figure 2 and Figure 3 The middle rectangle represents the existing conditions, such as a virtual machine providing a certain service, a service having a certain vulnerability, a virtual machine having a network connection, etc.; the oval represents the rule, that is, when multiple conditions are met at the same time, the next state can be reached according to the rule; the diamond represents the state reached by the attack, which generally refers to obtaining the execution permission of a user of a certain virtual machine. After obtaining the execution permission, subsequent attack operations can be performed or related data can be stolen. The conditions represented by the rectangles pointing to the same oval must be met at the same time, and the staged attack target represented by the diamond can be achieved according to the rules represented by the oval. To achieve a staged attack target represented by a diamond, there is often more than one way. For example, Figure 2 When reaching the attack target represented by diamond 3 according to the rule of ellipse 4, the conditions represented by rectangles 5 and 6 must be met at the same time; when reaching the attack target represented by diamond 1 according to the rule of ellipse 2, the attack target represented by diamond 3 must be achieved first, and the conditions represented by rectangles 7 and 8 must also be met; to reach the attack target represented by diamond 9, it can be achieved according to the rule represented by ellipse 10 when conditions 15, 14, and 11 are met, or it can be achieved according to the rule represented by ellipse 16 when conditions 11, 18, and 17 are met.

[0048] Figure 2 The attack graph shown contains the attack paths to reach each attack target, and correspondingly, it also contains the defense measures for the necessary attack conditions in the corresponding rectangles: (1) If the rectangular node represents a software or service containing an exploitable vulnerability, defense can be achieved by fixing the vulnerability, which can be done by software upgrades or patches. (2) If the rectangular node represents a virtual machine providing a service, on the one hand, the service can be suspended to interrupt the attack path, but this defense measure will also cause the service to be abnormal. It can also be done by making other conditions that must be met at the same time unsatisfied, such as fixing the vulnerabilities in the service software. (3) If the rectangular node represents a network connection, the necessary attack conditions can be broken by disconnecting the connection or restricting the network access services between network nodes. Furthermore, in order to achieve all-round defense against a certain stage attack target, it is necessary to defend against all attack paths that can reach the attack target.

[0049] Figure 3 The following shows the changes in the attack graph caused by fixing the weak password vulnerability of the SSH service of vm2. For comparison, Figure 3 The attack paths represented by nodes 15, 14, and 10 are not deleted. Instead, they are separated from the accessible attack paths by a dashed background color, making it easier for network security personnel to reconstruct the attack and defense evolution process. This vulnerability fix only disconnects one attack path to target 9; another attack path still exists. This provides network security personnel with sufficient information to quickly fix the vulnerability contained in rectangle 18. Figure 3 The defense of the attack path to attack target 21 is also demonstrated: although attack target 21 is only an intermediate target to attack target 19, breaking this target disconnects all subsequent attack paths passing through it. However, it also causes the network disconnection between vm2 and vm3, and the resulting cost depends on the type of business between vm2 and vm3. In this case, when optimizing the specific defense measures, not only the benefits of defense but also the cost of defense should be considered. However, the present invention can clearly demonstrate the defense measures for attack targets at each stage. As for the optimal choice during the attack and defense game, it is necessary to analyze the specific situation. The present invention only provides a set of defense measures.

[0050] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

[0051] In addition, it should be understood that although this specification is described in terms of implementation methods, not every implementation method contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

Claims

1. A defense graph evolution method for multi-stage attacks, characterized in that: The specific steps include: 1) Based on the asset information of the current cloud environment and the vulnerability and vulnerability information contained in the known cloud environment, an attack graph for the current cloud environment is constructed; 2) Based on the ATT&CK knowledge graph, we build a corresponding set of defense measures based on the vulnerabilities and vulnerability information corresponding to the necessary conditions for each attack step in the attack graph in step 1); 3) Based on the service paralysis information caused by the attack, delete the subgraphs on the attack graph in step 1) whose attack conditions can no longer be met simultaneously; 4) Based on the information about vulnerabilities and vulnerability repairs caused by the deployment of defense measures, delete the subgraphs on the attack graph in step 1) whose attack conditions can no longer be met simultaneously; 5) Based on the updated attack graph from steps 3) and 4), combined with the ATT&CK knowledge graph, the set of defense measures for each attack step is updated to achieve the evolution of the defense graph.

2. The method for evolving a defense graph against a multi-stage attack according to claim 1, wherein: In step 1), based on the asset information of the cloud environment obtained from the network administrator and the vulnerability and vulnerability information obtained through the existing scanning tool Nessus, the permission relationship, connection relationship, vulnerability and vulnerability information and importance information of each node in the cloud environment are generated, and a .P file is generated based on the syntax of the MulVal software. The MulVal command is used to generate an attack graph. The subgraph consisting of attack conditions, attack rules and attack results on the attack graph is an attack step.

3. The method for evolving a defense graph for a multi-stage attack according to claim 1, wherein: In step 2), the necessary conditions for achieving the attack step include vulnerabilities, service provision, network connectivity, and access rights. For each necessary condition, measures related to the current cloud environment are manually selected from the defense measures for vulnerabilities or vulnerabilities defined by ATT&CK to construct a set of defense measures for the attack step, which serves as supplementary information for the attack step node in the attack graph.

4. The method for evolving a defense graph for a multi-stage attack according to claim 1, wherein: In step 3), when a server is paralyzed by an attack and stops serving, the subgraph consisting of attack conditions, attack rules, and attack results on the attack graph corresponding to the server is deleted from the attack graph, so that the updated attack graph correctly represents the current cloud environment.

5. The method for evolving a defense graph for a multi-stage attack according to claim 1, wherein: In step 4), after the network security personnel deploys a certain defense measure, if the defense measure results in the repair of a vulnerability, the suspension of service, the disconnection of a connection, or the deactivation of permissions, thereby causing several attack conditions that need to be met simultaneously in certain attack subgraphs to no longer be met simultaneously, the subgraph is deleted so that the updated attack graph correctly represents the current cloud environment.

6. The method for evolving a defense graph for a multi-stage attack according to claim 1, wherein: In step 5), after steps 3) and 4) are updated, the change in the attack graph causes the defense measures for the vulnerabilities and vulnerabilities corresponding to the necessary conditions for achieving each attack step to change. Based on the ATT&CK knowledge graph, the set of defense measures for each attack step is updated to achieve the evolution of the defense graph.

7. An evolution system based on the multi-stage attack defense graph evolution method according to any one of claims 1 to 6, characterized in that: include: The attack and defense graph generation module is used to generate an attack graph based on the asset information, vulnerabilities, and vulnerability information of the current cloud environment, and then build a defense graph based on the attack graph and the ATT&CK knowledge graph; The attack graph update module is used to delete subgraphs on the attack graph whose attack conditions can no longer be met simultaneously based on the information about service paralysis caused by the attack and the vulnerability and vulnerability repair caused by the deployment of defense measures; The defense graph evolution module is used to update the set of defense measures for each attack step based on the updated attack graph and combined with the ATT&CK knowledge graph, thereby evolving the defense graph.

8. An evolution device based on the multi-stage attack defense graph evolution method according to any one of claims 1 to 6, characterized in that: include: memory for storing computer programs; A processor, configured to implement the method for evolving a defense graph for a multi-stage attack according to any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it is capable of evolving a defense graph for a multi-stage attack according to the method according to any one of claims 1 to 6.

Images