A vulnerability exploit chain construction method based on attack and defense combination

Abstract

The application relates to the technical field of vulnerability analysis and utilization, and discloses a vulnerability exploitation chain construction technology based on attack and defense combination, which comprises the following steps: S1: establishing a traceability graph database: after APT attack simulation experiment, system-related log information is collected, including process starting, file operation, and meanwhile, a cause-effect relationship rule between different system entities is set to capture a complete rule composed of Action, Type and Port; all system logs are parsed into a graph structure of the traceability graph; vertices are divided into process vertex types and object vertex types; edges represent specific cause-effect relationships by means of time stamps and event types of event occurrence; S2: attack traceability analysis; according to original traceability graph information, an initial infection point is found, and then a path of an infected node is searched from the initial infection point to generate a subgraph and form an attack chain graph. The application has strong scene adaptability, can meet typical asset penetration requirements, and can also provide attack suggestions for specific scenes.

Description

Technical Field

[0001] This invention relates to the field of vulnerability analysis and exploitation technology, specifically a vulnerability exploitation chain construction technology based on a combination of attack and defense. Background Technology

[0002] With the rapid development of the information age, computer network technology has been widely applied to various industries. However, as networks grow larger and more complex, the frequency and severity of cyberattacks are also rapidly increasing. Among these attacks, vulnerabilities have always been the core root cause of cybersecurity problems. In recent years, the number of vulnerabilities has shown a significant upward trend, and attacks exploiting these vulnerabilities have become increasingly frequent, with the risk of vulnerability exploitation chains increasing year by year.

[0003] The annual cybersecurity work report of the National Computer Network Emergency Response Technical Team / Coordination Center (CNCERT / CC) statistically analyzed vulnerability attacks by type. The results showed that most attacks, especially those with significant damage, were multi-step attacks. This means attackers exploit existing security vulnerabilities in the target system, employing deliberate, multi-step attack behaviors to achieve their ultimate goal of devastating the target. The "2021 Attack Technology Development Trend Report" released by NSFOCUS also proposed the concept of a combined exploit chain. For example, in October 2020, a WebLogic patch fixed the console component command execution vulnerability CVE-2020-14883. However, this console component vulnerability requires login authentication to be exploited. Remote attackers could combine this vulnerability with CVE-2020-14882 to bypass authentication in the console component and ultimately execute commands to take over the WebLogic server.

[0004] To ensure the normal operation of businesses in cyberspace, it is necessary to rely on threat assessment by defenders and penetration testing by attackers to discover risks. Traditional threat assessment and penetration testing methods often only consider the vulnerabilities or attack behaviors themselves, ignoring the correlations and failing to construct effective vulnerability exploitation chains. Therefore, it is crucial to analyze complete vulnerability exploitation chains and discover and organize the potential and valuable relationships between behaviors in cyberspace, which is a key topic in the field of cyberspace security research. In actual attack and defense scenarios, the complex, redundant, scattered, and delayed security information is difficult to analyze directly and requires comprehensive processing to uncover hidden logic and discover the attacker's true intentions. To achieve effective monitoring of the entire network security posture, researchers have gathered advanced threat attack tactics and techniques based on historical combat experience from the global security community, forming a common language for describing hacker behavior and a knowledge base framework for abstracting hacker attacks, namely the ATT&CK (Adversary Tactics and Techniques & Common Knowledge) model, for network attack detection, defense, and response. Existing vulnerability exploitation chain analysis construction methods are based on ATT&CK and are mainly divided into attack extraction and vulnerability analysis from different perspectives.

[0005] Traditional vulnerability analysis techniques are divided into three main categories: dynamic analysis, static analysis, and a combination of both. Dynamic analysis involves recording the execution trajectory of a target program and further analyzing information such as memory read / write operations, function call relationships, and memory allocation / release during runtime. The primary technique is fuzzing. Ardilla employs dynamic taint tracing to detect two-step exploit chains, such as second-order SQL injection and second-order XSS. Waler uses dynamic analysis to infer normal behavior patterns and combines this with symbolic execution to detect logic-based vulnerability exploit chains. Pellegrino et al., based on black-box testing techniques, construct navigation graphs through model inference, extract attack patterns of behaviors and common logic vulnerabilities, generate potential vulnerability test cases, and detect business logic-based vulnerability exploit chains with fixed attack patterns. Three years later, Pellegrino's team developed the Deemon system, which, by constructing attribute graphs for target web applications, can detect Cross-Site Request Forgery (CSRF) exploit chains. SrFuzzer is an automated fuzzing framework for testing home router devices. It utilizes two input semantic models (i.e., the KEY-VALUE data model and the CONF-READ communication model) to generate request sequences with specific semantic relationships, and then performs fuzz testing on the generated request sequences. This method can discover two-step triggering exploit chains with relatively fixed triggering patterns.

[0006] Currently, there is relatively little research on vulnerability exploitation chain analysis. From the perspective of the defender, the focus is mainly on extracting attack knowledge of vulnerability exploitation chains from publicly available threat intelligence or real APT attack data, while from the perspective of the attacker, the focus is mainly on vulnerability exploitation chain analysis targeting specific target systems or specific triggering patterns. Summary of the Invention

[0007] The purpose of this invention is to provide a vulnerability exploitation chain construction technology based on a combination of offense and defense, which solves the problems mentioned in the background above.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a vulnerability exploitation chain construction technology based on a combination of attack and defense, comprising the following steps: S1: Establish a source map database After conducting APT attack simulation experiments, system-related log information was collected, including process startup and file operations. At the same time, causal relationship rules between different system entities were set for capture. A complete rule consists of Action, Type, and Port. All system logs were parsed into a graph structure of a source graph. The vertices are divided into process vertex types and object vertex types. The timestamp of the event and the event type are used to represent the specific causal relationship. S2: Attack Origin Analysis Based on the original source map information, the initial infection point is found, and then the path to the infected node is searched from the initial infection point to generate a subgraph and form an attack chain graph. S3: Threat Score Assessment First, the attack chain graph is split, with each path divided into subgraphs. Then, the threat score of each node in the attack chain subgraph is calculated. Based on the attack type enumeration and classification dataset, two risk assessment indicators are adopted: "attack probability" and "typical severity". After calculating the score of independent nodes, the weights of corresponding edges are set according to the ordered stages of the tactical kill chain. The transitions between nodes are multiplied by the coefficient of the weights to obtain the threat value of the attack unfolding. Then, all the steps of the attack unfolding are combined, and the numerical differences between different attack chains are amplified by cumulative multiplication. A score threshold is set according to the real attack chain of the simulated APT experiment. Attack chains that exceed the threshold are recorded as valid attack chains. Then, the valid attack chains are fully restored, restoring the normal business operations and other behaviors that were deleted, and constructing the vulnerability exploitation chain as the original attack sample. S4: Sequence splitting The complete exploit chain is broken down into a single-step attack pattern, with nodes between steps treated as different objects and edges as different behaviors. This allows for the construction of a malicious behavior sequence that initially involves an attack exploit and a benign behavior sequence that initially involves normal business operations. S5: Sequence Lexical Restoration The behavior sequence is restored based on the original source graph information, nodes are restored to process vertices or object vertices, and edges are restored to specific operation behaviors, such as open, execute, connect, etc. Emmatization is used to convert the sequence into general text representing sequence patterns for semantic interpretation. A vocabulary is constructed, and words are divided into four different types according to fine-grained semantics: process, file, network, and action. All nodes are found and each of them is mapped to the corresponding vocabulary. S6: Balanced Sequence Generation The extreme imbalance between the number of malicious and benign behaviors can cause the mapping results to favor the majority class or fail to utilize the minority class. To balance the training dataset, benign behaviors with a certain similarity threshold are first undersampled. Then, an oversampling mechanism is used to randomly mutate malicious behaviors until their total number reaches the same level. Undersampling is defined as reducing the number of benign behaviors by Levenshtein distance to calculate the similarity between lexical sequences. Then, when their similarity exceeds a certain threshold, the results are filtered out. Oversampling is defined as using a mutation-based oversampling mechanism to include more types of malicious behaviors in the set of atomic behaviors. S7: Tactical Mapping The final set of behaviors is mapped based on the ATT&CK framework, and specific atomic behaviors are mapped to technical and tactical categories; S8: Deep Learning Model Training Using real vulnerability exploit chains as raw samples, the corresponding technical and tactical mapping relationships are set as rules, and deep learning models are used to model high-level summaries of the data to uncover more hidden patterns in the data. S9: Tactical Matrix Illuminated The discovered correlation patterns are mapped to the tactical matrix corresponding to ATT&CK, and the corresponding categories are lit up. The relationship between the categories is based on the rules, and the specific operation content comes from the behavior sequence of the atoms. S10: Intelligent Deduction and Construction of Vulnerability Exploitation Chain The final illuminated tactical matrix is ​​assembled and reconstructed by progressive steps and scenario requirements, and a mutation algorithm is used to enhance attack diversity, ultimately forming a set of vulnerability exploit chains. Preliminary chain verification is performed, and usable vulnerability exploit chains are extracted from the set based on the results as new attack methods.

[0009] Preferably, step S2 includes the following specific steps: S21: Generate initial infection point map The initial infection point is defined as the process corresponding to the generation of an alarm event E. Tracing backward from E, the source graph does not contain other alarm events. The initial infection point graph is defined as follows: given a source graph G...<V,E> Alarm event E occurred on IIP node V, the initial infection point graph G'<V’,E’> It is a graph rooted at V, where e∈E'. If e has a causal relationship with E, and e is an alarm event or an event that triggers an alarm event, the system first locates the initial infection point in the original source graph according to the above rules, and then deletes the nodes and edges before the initial infection point to simplify the relationship. S22: Starting from the initial infection point, search backwards through the initial infection point graph, marking the found warning events as infection points. Each attack chain ends at the last infection point, connecting the initial infection point and the infection points, simplifying the edges and nodes. The edges only need to satisfy one condition. The nodes in the final attack chain graph represent alarm events, and the edges represent the time sequence and causal relationship of the attacks.

[0010] Preferably, the condition to be satisfied in step S22 is: (1) ea and eb are alarms on the same host and the same tracing path, and ea is a forward causal relationship of eb.

[0011] (2) ea and eb are alarms on the same host, and the timestamp of vertex ea is less than that of eb.

[0012] (3) ea has an outgoing connection event edge on a host, and eb has a responding receive event edge.

[0013] This invention provides a vulnerability exploitation chain construction technique based on a combination of attack and defense. This technique offers the following advantages: (1) This invention generates new attack patterns by analyzing attack samples, thereby increasing the diversity of attack methods.

[0014] (2) The vulnerability exploitation chain constructed by the present invention is more complete and longer.

[0015] (3) The present invention has strong scene adaptability, which can meet the typical asset penetration needs and provide attack suggestions for specific scenarios.

[0016] (4) The invention has a higher level of intelligence, reduces redundant operations in automatic penetration testing, and improves efficiency. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the vulnerability exploitation chain construction technology based on the combination of offense and defense of the present invention; Figure 2This is a schematic diagram of the attack detection structure based on the source graph method of the present invention from a defensive perspective; Figure 3 This is a schematic diagram of the behavior extraction and atomic sequence mapping technology of the present invention; Figure 4 This is a schematic diagram of the intelligent deduction and construction technology for vulnerability exploitation chains in this invention. Detailed Implementation

[0018] like Figure 1-4 As shown, this invention provides a technical solution: a vulnerability exploitation chain construction technology based on a combination of attack and defense, comprising the following steps: S1: Establish a source map database After conducting APT attack simulation experiments, system-related log information was collected, including process startup and file operations. At the same time, causal relationship rules between different system entities were set for capture. A complete rule consists of Action, Type, and Port. All system logs were parsed into a graph structure of a source graph. The vertices are divided into process vertex types and object vertex types. The timestamp of the event and the event type are used to represent the specific causal relationship. S2: Attack Origin Analysis Based on the original source map information, the initial infection point is found, and then the path to the infected node is searched from the initial infection point to generate a subgraph and form an attack chain graph. Step S2 includes the following specific steps: S21: Generate initial infection point map The initial infection point is defined as the process corresponding to the generation of an alarm event E. Tracing backward from E, the source graph does not contain other alarm events. The initial infection point graph is defined as follows: given a source graph G...<V,E> Alarm event E occurred on IIP node V, the initial infection point graph G'<V’,E’> It is a graph rooted at V, where e∈E'. If e has a causal relationship with E, and e is an alarm event or an event that triggers an alarm event, the system first locates the initial infection point in the original source graph according to the above rules, and then deletes the nodes and edges before the initial infection point to simplify the relationship. S22: Starting from the initial infection point, search the graph backwards from the initial infection point. Mark the warning events found as infection points. Each attack chain ends at the last infection point. Connect the initial infection point and the infection points, simplifying the edges and nodes. The edges connecting the nodes only need to satisfy any of the following conditions: (1) ea and eb are alarms on the same host and the same tracing path, and ea is a forward causal relationship of eb.

[0019] (2) ea and eb are alarms on the same host, and the timestamp of vertex ea is less than that of eb.

[0020] (3) ea has an outgoing connection event edge on a host, and eb has a responding receive event edge; The nodes in the final attack chain graph represent alarm events, and the edges represent the temporal sequence and causal relationship of the attacks; S3: Threat Score Assessment First, the attack chain graph is split, with each path divided into subgraphs. Then, the threat score of each node in the attack chain subgraph is calculated. Based on the attack type enumeration and classification dataset, two risk assessment indicators are adopted: "attack probability" and "typical severity". After calculating the score of independent nodes, the weights of corresponding edges are set according to the ordered stages of the tactical kill chain. The transitions between nodes are multiplied by the coefficient of the weights to obtain the threat value of the attack unfolding. Then, all the steps of the attack unfolding are combined, and the numerical differences between different attack chains are amplified by cumulative multiplication. A score threshold is set according to the real attack chain of the simulated APT experiment. Attack chains that exceed the threshold are recorded as valid attack chains. Then, the valid attack chains are fully restored, restoring the normal business operations and other behaviors that were deleted, and constructing the vulnerability exploitation chain as the original attack sample. S4: Sequence splitting The complete exploit chain is broken down into a single-step attack pattern, with nodes between steps treated as different objects and edges as different behaviors. This allows for the construction of a malicious behavior sequence that initially involves an attack exploit and a benign behavior sequence that initially involves normal business operations. S5: Sequence Lexical Restoration The behavior sequence is restored based on the original source graph information, nodes are restored to process vertices or object vertices, and edges are restored to specific operation behaviors, such as open, execute, connect, etc. Emmatization is used to convert the sequence into general text representing sequence patterns for semantic interpretation. A vocabulary is constructed, and words are divided into four different types according to fine-grained semantics: process, file, network, and action. All nodes are found and each of them is mapped to the corresponding vocabulary. S6: Balanced Sequence Generation The extreme imbalance between the number of malicious and benign behaviors can cause the mapping results to favor the majority class or fail to utilize the minority class. To balance the training dataset, benign behaviors with a certain similarity threshold are first undersampled. Then, an oversampling mechanism is used to randomly mutate malicious behaviors until their total number reaches the same level. Undersampling is defined as reducing the number of benign behaviors by Levenshtein distance to calculate the similarity between lexical sequences. Then, when their similarity exceeds a certain threshold, the results are filtered out. Oversampling is defined as using a mutation-based oversampling mechanism to include more types of malicious behaviors in the set of atomic behaviors. S7: Tactical Mapping The final set of behaviors is mapped based on the ATT&CK framework, and specific atomic behaviors are mapped to technical and tactical categories; S8: Deep Learning Model Training Using real vulnerability exploit chains as raw samples, the corresponding technical and tactical mapping relationships are set as rules, and a deep learning model is used to model a high-level summary of the data to uncover more hidden patterns in the data. S9: Tactical Matrix Illuminated The discovered correlation patterns are mapped to the tactical matrix corresponding to ATT&CK, and the corresponding categories are lit up. The relationship between the categories is based on the rules, and the specific operation content comes from the behavior sequence of the atoms. S10: Intelligent Deduction and Construction of Vulnerability Exploitation Chain The final illuminated tactical matrix is ​​assembled and reconstructed by progressive steps and scenario requirements, and a mutation algorithm is used to enhance attack diversity, ultimately forming a set of vulnerability exploitation chains. Preliminary chain verification is performed, and usable vulnerability exploitation chains are extracted from the set based on the results as new attack methods.

[0021] In summary, this invention utilizes source-tracing graph-based attack detection technology to extract attack sequence knowledge from real APT events, encompassing both benign normal business operations and malicious exploitation operations. Through ATT&CK matrix mapping techniques, it combines atomic attack behaviors into sequences, clarifying the logical relationships between various vulnerability exploitation methods and attack behaviors, thereby constructing vulnerability exploitation chains and enhancing the attack intensity against targets. After constructing original attack samples, a model is trained using reinforcement learning and other methods to achieve automatic reasoning and genetic mutation of vulnerability exploitation chain rules, enabling intelligent attacks for automated penetration testing.

Claims

1. A method for constructing a vulnerability exploitation chain based on a combination of offense and defense, applied in penetration testing, characterized by: Includes the following steps: S1: Establish a source map database After conducting APT attack simulation experiments, system-related log information is collected, including process startup and file operations. At the same time, causal relationship rules between different system entities are set for capture. All system logs are parsed into a source graph structure, with vertices divided into process vertex types and object vertex types. The timestamps and event types of the events are used to represent specific causal relationships. S2: Attack Origin Analysis Based on the original source map information, the initial infection point is found, and then the path to the infected node is searched from the initial infection point to generate a subgraph and form an attack chain graph. S3: Threat Score Assessment First, the attack chain graph is split, with each path divided into subgraphs. Then, the threat score of each node in the attack chain subgraph is calculated. Based on the attack type enumeration and classification dataset, two risk assessment indicators are adopted: "attack probability" and "typical severity". After calculating the score of independent nodes, the weights of corresponding edges are set according to the ordered stages of the tactical kill chain. The transitions between nodes are multiplied by the coefficient of the weights to obtain the threat value of the attack unfolding. Then, all the steps of the attack unfolding are combined, and the numerical differences between different attack chains are amplified by cumulative multiplication. A score threshold is set according to the real attack chain of the simulated APT experiment. Attack chains that exceed the threshold are recorded as valid attack chains. Then, the valid attack chains are fully restored, restoring the normal business operations and other behaviors that were deleted, and constructing the vulnerability exploitation chain as the original attack sample. S4: Sequence splitting The complete exploit chain is broken down into a single-step attack pattern, with nodes between steps treated as different objects and edges as different behaviors. This allows for the construction of a malicious behavior sequence that initially involves an attack exploit and a benign behavior sequence that initially involves normal business operations. S5: Sequence Lexical Restoration The behavior sequence is restored based on the original source graph information, nodes are restored to process vertices or object vertices, and edges are restored to specific operation behaviors, including open, execute, and connect. Lexical restoration is used to convert the sequence into a general text representing the sequence pattern for semantic interpretation. A vocabulary is constructed and the words are divided into four different types according to fine-grained semantics: process, file, network, and action. All nodes are found and each of them is mapped to the corresponding vocabulary. S6: Balanced Sequence Generation The extreme imbalance between the number of malicious and benign behaviors can cause the mapping results to favor the majority class or fail to utilize the minority class. To balance the training dataset, benign behaviors with a certain similarity threshold are first undersampled. Then, an oversampling mechanism is used to randomly mutate malicious behaviors until their total number reaches the same level. Undersampling is defined as reducing the number of benign behaviors by Levenshtein distance to calculate the similarity between lexical sequences. Then, when their similarity exceeds a certain threshold, the results are filtered out. Oversampling is defined as using a mutation-based oversampling mechanism to include more types of malicious behaviors in the set of atomic behaviors. S7: Tactical Mapping The final set of behaviors is mapped based on the ATT&CK framework, and specific atomic behaviors are mapped to technical and tactical categories; S8: Deep Learning Model Training Using real vulnerability exploit chains as raw samples, the corresponding technical and tactical mapping relationships are set as rules, and deep learning models are used to model high-level summaries of the data to uncover more hidden patterns in the data. S9: Tactical Matrix Illuminated The discovered correlation patterns are mapped to the technical and tactical matrix corresponding to ATT&CK, and the corresponding categories are lit up. The relationship between the categories is based on the rules, and the specific operation content comes from the behavior sequence of the atoms. S10: Intelligent Deduction and Construction of Vulnerability Exploitation Chain The final illuminated tactical matrix is ​​assembled and reconstructed by progressive steps and scenario requirements, and a mutation algorithm is used to enhance attack diversity, ultimately forming a set of vulnerability exploitation chains. Preliminary chain verification is performed, and usable vulnerability exploitation chains are extracted from the set as new attack methods.

Images