Vulnerability correlation analysis method, system, device and storage medium

Abstract

The application discloses a vulnerability correlation analysis method, system and device and a storage medium, and relates to the technical field of computers. The vulnerability correlation analysis method comprises the following steps: acquiring a system vulnerability list of a target system; classifying vulnerabilities in the system vulnerability list into corresponding privilege escalation categories based on a privilege escalation theory, wherein the privilege escalation categories comprise prerequisite privileges and result privileges; combining vulnerabilities in multiple privilege escalation categories to obtain multiple vulnerability attack chains; determining the scores of the vulnerability attack chains according to the influence degree quantitative values, the exploitability quantitative values and the privilege escalation span quantitative values of the vulnerability attack chains, and selecting an optimal vulnerability attack chain according to the scores of the vulnerability attack chains. The application can mine the privilege correlation between system vulnerabilities, select the optimal vulnerability attack chain based on the scores of the vulnerability attack chains, and is helpful to efficiently repairing system vulnerabilities.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a vulnerability correlation analysis method, system, device, and storage medium. Background Technology

[0002] In recent years, with the rapid development of the information age, network technology has been widely applied to various industries. However, as network information systems become increasingly large and complex, the frequency of network attacks exploiting vulnerabilities and the resulting damage are also rapidly increasing. Research on security vulnerabilities has always been a key issue in the field of cybersecurity. However, traditional vulnerability analysis methods often focus only on single, highly dangerous vulnerabilities, ignoring the correlation between vulnerabilities and severely reducing the exploit potential. Research shows that most attacks, especially those with significant damage, are multi-step attacks. That is, attackers exploit existing security vulnerabilities in the target, combining multiple vulnerabilities to launch a multi-step attack that harms the target's network.

[0003] Vulnerability combination exploitation is a widely used attack method. Vulnerability combination exploitation refers to the need for one vulnerability to be exploited before another can be exploited to create the conditions for its exploitation. For example, in 2022, Google's Project Zero released an analysis of in-the-wild vulnerability exploitation. The analysis indicated that an attacker used a vulnerability (CVE-2021-25337) to obtain the private data files of a regular system app as an untrusted_app. Then, by exploiting the ability of the Samsung TTS vulnerability to load arbitrary dynamic link libraries from its own configuration file, the attacker transformed the first vulnerability into a system app privilege escalation vulnerability. After gaining code execution capabilities with system app privileges, the attacker successively used vulnerabilities (CVE-2021-25369) and (CVE-2021-25370) to obtain the highest system privileges. This demonstrates that attackers targeting network information systems often tend to exploit isolated, potentially overlooked vulnerabilities to gain initial privileges. Most attacks, especially those with significant damage, are multi-step attacks formed by combining vulnerabilities. Network security defense methods targeting single network nodes are insufficient to defend against such vulnerability combination attacks. Therefore, by exploring the correlations between vulnerabilities, conducting correlation analysis, and constructing vulnerability attack chains, we can analyze the system's security from the attacker's perspective, better identify the system's vulnerabilities, and thus fix system vulnerabilities. Summary of the Invention

[0004] This invention aims to address at least one of the technical problems existing in the prior art. To this end, this invention proposes a vulnerability correlation analysis method, system, device, and storage medium, which can uncover the permission correlations between system vulnerabilities and select the optimal vulnerability attack chain based on a vulnerability attack chain score, thus facilitating efficient system vulnerability remediation.

[0005] On one hand, embodiments of the present invention provide a vulnerability correlation analysis method, including the following steps:

[0006] Obtain the list of system vulnerabilities of the target system;

[0007] Based on the theory of privilege escalation, the vulnerabilities in the system vulnerability list are classified into corresponding privilege escalation categories, wherein the privilege escalation categories include prerequisite privileges and result privileges;

[0008] Multiple vulnerability attack chains are obtained by combining vulnerabilities of the aforementioned privilege escalation categories.

[0009] The score of the vulnerability attack chain is determined based on the quantitative values ​​of the impact, exploitability, and privilege escalation span of the vulnerability attack chain, and the optimal vulnerability attack chain is selected based on the score of the vulnerability attack chain.

[0010] According to some embodiments of the present invention, obtaining the system vulnerability list of the target system includes the following steps:

[0011] Obtain all vulnerabilities of the target system and retrieve the description information of each vulnerability from the vulnerability database. The description information of the vulnerability includes vulnerability number, vulnerability description text, vulnerability attack vector, vulnerability attack complexity, vulnerability authentication level, vulnerability confidentiality, vulnerability integrity, and vulnerability availability.

[0012] A vulnerability scoring dataset is determined based on the description information of each vulnerability;

[0013] The system vulnerability list is determined based on the vulnerability score dataset of all vulnerabilities in the target system.

[0014] According to some embodiments of the present invention, classifying vulnerabilities in the system vulnerability list into corresponding privilege escalation categories based on privilege escalation theory includes the following steps:

[0015] Retrieve vulnerability description text from the vulnerability scoring dataset in the system vulnerability list;

[0016] The prerequisite permissions and result permissions of the vulnerability are determined based on the vulnerability description text. The prerequisite permissions are one of the following: guest permissions, user permissions, or administrator permissions. The result permissions are one of the following: user permissions, administrator permissions, or super administrator permissions.

[0017] Based on the prerequisite permissions and result permissions of the vulnerability, the vulnerability is classified into the corresponding privilege escalation category, wherein the privilege escalation category includes escalating visitor permissions to user permissions, escalating visitor permissions to administrator permissions, escalating visitor permissions to super administrator permissions, escalating user permissions to administrator permissions, escalating user permissions to super administrator permissions, and escalating administrator permissions to super administrator permissions.

[0018] The vulnerability scoring dataset is updated according to the privilege escalation category to which the vulnerability belongs. The updated vulnerability scoring dataset includes the vulnerability description information, including vulnerability number, vulnerability attack vector, vulnerability attack complexity, vulnerability authentication level, vulnerability confidentiality, vulnerability integrity and vulnerability availability, vulnerability prerequisite privileges, vulnerability result privileges, and vulnerability category score of the privilege escalation category of the vulnerability.

[0019] According to some embodiments of the present invention, combining multiple vulnerabilities of the various privilege escalation categories to obtain multiple vulnerability attack chains includes the following steps:

[0020] Treat all vulnerabilities in the target system as nodes in the attack graph;

[0021] Determine the edges between nodes in the attack graph based on the privilege escalation category to which the vulnerability belongs;

[0022] Traverse the attack graph to identify the first node whose prerequisite permissions are the same as the attacker's permissions and identify all second nodes with an out-degree of zero.

[0023] Multiple vulnerability attack chains are constructed, with the first node as the starting node and the second node as the ending node.

[0024] According to some embodiments of the present invention, constructing multiple vulnerability attack chains with the first node as the start node and the second node as the end node includes the following steps:

[0025] Use a depth-first search algorithm to determine all paths between the start and end nodes;

[0026] Multiple shortest paths are determined based on the number of nodes in all paths, and these shortest paths are identified as vulnerability attack chains.

[0027] According to some embodiments of the present invention, the vulnerability correlation analysis method further includes the following steps:

[0028] An attack chain score dataset is determined based on the vulnerability score dataset of all vulnerabilities in the attack chain. The attack chain score dataset includes attack chain attack vector, attack chain complexity, attack chain authentication level, attack chain confidentiality, attack chain integrity, attack chain availability, and privilege escalation span quantification value. The privilege escalation span quantification value is the sum of the vulnerability category scores of all vulnerabilities.

[0029] According to some embodiments of the present invention, the vulnerability correlation analysis method further includes the following steps:

[0030] The impact of the vulnerability attack chain is quantified based on the attack chain confidentiality, attack chain integrity, and attack chain availability in the attack chain scoring dataset.

[0031] The exploitability quantification value of the vulnerability attack chain is determined based on the attack chain attack vector, attack chain complexity, and attack chain authentication level in the attack chain scoring dataset.

[0032] On the other hand, embodiments of the present invention also provide a vulnerability correlation analysis system, including:

[0033] The first module is used to obtain a list of system vulnerabilities;

[0034] The second module is used to classify the vulnerabilities in the system vulnerability list into corresponding privilege escalation categories based on the privilege escalation theory, wherein the privilege escalation categories include prerequisite privileges and result privileges;

[0035] The third module is used to combine multiple vulnerabilities of the aforementioned privilege escalation categories to obtain multiple vulnerability attack chains;

[0036] The fourth module is used to determine the score of the vulnerability attack chain based on the quantitative values ​​of the impact degree, exploitability, and privilege escalation span of the vulnerability attack chain, and to select the optimal vulnerability attack chain based on the score of the vulnerability attack chain.

[0037] On the other hand, embodiments of the present invention also provide a vulnerability correlation analysis device, comprising:

[0038] At least one processor;

[0039] At least one memory for storing at least one program;

[0040] When the at least one program is executed by the at least one processor, the at least one processor implements the vulnerability correlation analysis method as described above.

[0041] On the other hand, embodiments of the present invention also provide a computer-readable storage medium storing computer-executable instructions for causing a computer to perform the vulnerability correlation analysis method as described above.

[0042] The technical solution described above has at least one of the following advantages or beneficial effects: After obtaining the list of system vulnerabilities in the target system, based on the privilege escalation theory, the vulnerabilities in the list are classified into corresponding privilege escalation categories to determine the degree of privilege escalation. Then, vulnerabilities in multiple privilege escalation categories are combined to obtain multiple vulnerability attack chains to explore the privilege correlation between system vulnerabilities. The score of the vulnerability attack chain is determined based on the quantitative values ​​of the impact degree, the exploitability, and the privilege escalation span. The optimal vulnerability attack chain is selected based on the score of the vulnerability attack chain, which helps to efficiently repair system vulnerabilities. Attached Figure Description

[0043] Figure 1 This is a flowchart of the vulnerability correlation analysis method provided in the embodiments of the present invention;

[0044] Figure 2 This is a schematic diagram of the vulnerability correlation analysis device provided in an embodiment of the present invention. Detailed Implementation

[0045] The embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar originals or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0046] In the description of this invention, it should be understood that the orientation descriptions, such as up, down, left, right, etc., are based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention.

[0047] In the description of this invention, the use of terms such as "first," "second," etc., is for the purpose of distinguishing technical features only and should not be construed as indicating or implying relative importance, or implicitly indicating the number of technical features indicated, or implicitly indicating the order of the technical features indicated.

[0048] This invention provides a vulnerability correlation analysis method. This method can be applied to terminals, servers, or software running on either terminal or server. Terminals can be tablets, laptops, desktop computers, etc., but are not limited to these. Servers can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0049] Reference Figure 1 The vulnerability correlation analysis method of this invention includes, but is not limited to, the following steps:

[0050] Step S110: Obtain the list of system vulnerabilities of the target system;

[0051] Step S120: Based on the privilege escalation theory, classify the vulnerabilities in the system vulnerability list into the corresponding privilege escalation categories, where the privilege escalation categories include prerequisite privileges and result privileges;

[0052] Step S130: Combine multiple privilege escalation category vulnerabilities to obtain multiple vulnerability attack chains;

[0053] Step S140: Determine the score of the vulnerability attack chain based on the impact quantification value, exploitability quantification value, and privilege escalation span quantification value of the vulnerability attack chain, and select the optimal vulnerability attack chain based on the score of the vulnerability attack chain.

[0054] In some embodiments of step S110, the system vulnerability list includes multiple vulnerabilities existing in the target system and vulnerability-related information. System vulnerabilities can be obtained through security scanning tools. Vulnerability-related information may include scores for various parameters such as vulnerability attack vectors, attack complexity, authentication level, confidentiality, integrity, and availability, as well as information such as attacker privileges before and after the vulnerability is attacked.

[0055] In some embodiments of step S120, after an attacker successfully exploits a vulnerability, their privileges are escalated. Through continuous attacks and privilege escalations, the attacker can access data belonging to a higher-privilege user. For example, if an attacker with the identity of a system user escalates their privileges to administrator through a system vulnerability, then the prerequisite privilege for the vulnerability exploited by the attacker is user, and the resulting privilege is administrator. The privilege escalation category is used to mark the prerequisite and resulting privileges of a vulnerability. For example, the privilege escalation category can be marked with text, such as "Access Guest, User," or it can be marked with numbers, such as "00010010," where "0001" represents access guest and "0010" represents user. If the privilege escalation category of a vulnerability is "Access Guest, User," it indicates that the prerequisite privilege of the vulnerability is access guest, and the resulting privilege is user. Based on the privilege information of all vulnerabilities in the system, the privilege escalation categories include, but are not limited to, {Access Guest, User}, {Access Guest, Administrator}, {Access Guest, Super Administrator}, {User, Administrator}, {User, Super Administrator}, and {Administrator, Super Administrator}.

[0056] In some embodiments of step S130, based on the attacker's initial privileges, multiple first vulnerabilities are identified from the privilege escalation categories with initial privileges as prerequisites. Then, a first result privilege is determined based on the privilege escalation category where the first vulnerabilities are located. Next, multiple second vulnerabilities are identified from the privilege escalation categories with first end privileges as prerequisites. Then, a second result privilege is determined based on the privilege escalation category where the second vulnerabilities are located. Next, multiple third vulnerabilities are identified from the privilege escalation categories with second end privileges as prerequisites. This process continues until the highest privilege is reached. In this way, the first vulnerabilities, second vulnerabilities, and third vulnerabilities are connected to obtain multiple different vulnerability attack chains.

[0057] In some embodiments of step S140, the impact quantification value is used to characterize the comprehensive score of the confidentiality, integrity, and availability of the vulnerability attack chain; the exploitability quantification value is used to characterize the comprehensive score of the attack vector, attack complexity, and authentication level of the vulnerability attack chain; and the privilege escalation span quantification value is used to characterize the size of the privilege escalation span of the vulnerability attack chain. After determining the score of the vulnerability attack chain based on the impact quantification value, exploitability quantification value, and privilege escalation span quantification value, the vulnerability attack chains can be sorted from largest to smallest according to their corresponding score values, and the vulnerability attack chain with the highest score is selected as the optimal vulnerability attack chain.

[0058] According to some embodiments of the present invention, step S110, the step of obtaining the system vulnerability list, includes, but is not limited to, the following steps:

[0059] Step S210: Obtain all vulnerabilities of the target system and retrieve the description information of each vulnerability from the vulnerability database. The vulnerability description information includes vulnerability number, vulnerability description text, vulnerability attack vector, vulnerability attack complexity, vulnerability authentication level, vulnerability confidentiality, vulnerability integrity, and vulnerability availability.

[0060] Step S220: Determine the vulnerability scoring dataset based on the description information of each vulnerability;

[0061] Step S230: Determine the system vulnerability list based on the vulnerability score dataset of all vulnerabilities in the target system.

[0062] In this embodiment, multiple vulnerability scanning tools are used to scan the target system to obtain basic information about all vulnerabilities in the target system, such as vulnerability CVE numbers. After obtaining the basic information about all vulnerabilities in the target system, the vulnerability database NVD is used as the data source to obtain the vulnerability description information. The description information includes vulnerability number, vulnerability description text, vulnerability attack vector, vulnerability attack complexity, vulnerability authentication level, vulnerability confidentiality, vulnerability integrity, and vulnerability availability. The vulnerability number can be the vulnerability CVE number. A vulnerability scoring dataset is determined based on the various description information of the vulnerability. For example, the vulnerability scoring dataset can be represented as {CVE_ID, Description, AccessVector, AccessComplexity, Authentication, ConfImpact, IntegImpact, AvailImpact}. The vulnerability scoring datasets of all vulnerabilities in the target system are integrated to obtain a system vulnerability list.

[0063] It should be noted that the vulnerability evaluation indicators in the vulnerability scoring dataset, including vulnerability attack vector, vulnerability attack complexity, vulnerability authentication level, vulnerability confidentiality, vulnerability integrity, and vulnerability availability, are all quantitative values. For example, the assignment criteria for the vulnerability evaluation indicators are shown in Table 1:

[0064] Table 1. Value Assignment Standards for Vulnerability Evaluation Indicators

[0065]

[0066] According to some embodiments of the present invention, step S120, which involves classifying vulnerabilities in the system vulnerability list into corresponding privilege escalation categories based on privilege escalation theory, includes, but is not limited to, the following steps:

[0067] Step S310: Obtain the vulnerability description text from the vulnerability scoring dataset in the system vulnerability list;

[0068] Step S320: Determine the prerequisite permissions and result permissions of the vulnerability based on the vulnerability description text. The prerequisite permissions are one of the following: guest permissions, user permissions, or administrator permissions. The result permissions are one of the following: user permissions, administrator permissions, or super administrator permissions.

[0069] Step S330: Classify the vulnerability into the corresponding privilege escalation category based on the prerequisite privileges and result privileges of the vulnerability. The privilege escalation categories include escalating guest privileges to user privileges, escalating guest privileges to administrator privileges, escalating guest privileges to super administrator privileges, escalating user privileges to administrator privileges, escalating user privileges to super administrator privileges, and escalating administrator privileges to super administrator privileges.

[0070] Step S340: Update the vulnerability scoring dataset according to the privilege escalation category to which the vulnerability belongs. The updated vulnerability scoring dataset includes vulnerability description information, including vulnerability number, vulnerability attack vector, vulnerability attack complexity, vulnerability authentication level, vulnerability confidentiality, vulnerability integrity and vulnerability availability, vulnerability prerequisite privileges, vulnerability result privileges, and vulnerability category score of the privilege escalation category to which the vulnerability belongs.

[0071] In this embodiment, prerequisite permissions represent the preconditions for a vulnerability to be successfully exploited or the permissions required of an attacker, while result permissions represent the permissions an attacker gains after a successful exploit. Prerequisite permissions include: visitor permissions, user permissions, and administrator permissions. Result permission categories include: user permissions, administrator permissions, and super administrator permissions. Specifically, visitor permissions grant only basic interactive capabilities; user permissions grant independent private storage space and the ability to perform operations such as adding, deleting, modifying, and querying data—permissions expected of ordinary users; administrator permissions grant partial system permissions; and super administrator permissions grant all system permissions.

[0072] After determining the prerequisite and result permissions for each vulnerability, the vulnerabilities in the vulnerability information list and their vulnerability score datasets are marked with the corresponding privilege escalation categories, namely {Guest, User}, {Guest, Administrator}, {Guest, Super Administrator}, {User, Administrator}, {User, Super Administrator}, and {Administrator, Super Administrator}. These privilege escalation categories respectively represent the elevation of guest privileges to user privileges, guest privileges to administrator privileges, guest privileges to super administrator privileges, user privileges to administrator privileges, user privileges to super administrator privileges, and administrator privileges to super administrator privileges. Furthermore, the vulnerability scoring dataset is updated according to the privilege escalation category to which the vulnerability belongs. The updated vulnerability scoring dataset can be represented as {CVE_ID,AccessVector,AccessComplexity,Authentication,ConfImpact,IntegImpact,AvailImpact,PRE,RES,PrivilegeScore}, where PRE represents the prerequisite privileges of the vulnerability, RES represents the resulting privileges of the vulnerability, and PrivilegeScore represents the score of the privilege escalation category to which the model belongs. The score of the privilege escalation category is used to characterize the correlation index of the vulnerability. The scores of the privilege escalation category are shown in Table 2.

[0073]

[0074]

[0075] According to some embodiments of the present invention, step S130, which involves combining vulnerabilities of multiple privilege escalation categories to obtain multiple vulnerability attack chains, includes, but is not limited to, the following steps:

[0076] Step S410: Treat all vulnerabilities of the target system as nodes in the attack graph.

[0077] Step S420: Determine the edges between nodes in the attack graph based on the privilege escalation category to which the vulnerability belongs;

[0078] Step S430: Traverse the attack graph to determine the first node whose prerequisite permissions are the same as the attacker's permissions and determine all second nodes with an out-degree of zero;

[0079] Step S440: Construct multiple vulnerability attack chains with the first node as the starting node and the second node as the ending node.

[0080] According to some embodiments of the present invention, step S440, which involves constructing multiple vulnerability attack chains with the first node as the start node and the second node as the end node, includes, but is not limited to, the following steps:

[0081] Step S510: Use the depth-first search algorithm to determine all paths between the start node and the end node;

[0082] Step S520: Determine multiple shortest paths based on the number of nodes in all paths, and identify the shortest paths as vulnerability attack chains.

[0083] In this embodiment, all vulnerabilities in the target system are treated as nodes in the attack graph. Prerequisite and result permissions for vulnerabilities are used to generate edges in the attack graph. This involves traversing all nodes in the attack graph; if the result permission of node A is the prerequisite permission of node B, a directed edge is generated from A to B. All nodes in the attack graph are traversed to find all first nodes whose prerequisite permissions are the same as the attacker's permissions, and all second nodes with an out-degree of zero. Using the first nodes as start nodes and the second nodes as end nodes, multiple vulnerability attack chains are matched in the attack graph. These multiple vulnerability attack chains include multiple vulnerability attack chains with the same start and end nodes but different paths, and multiple vulnerability attack chains with at least one different start or end node. A depth-first search algorithm is used to calculate multiple shortest paths between the start and end nodes of the vulnerability attack chains. These multiple shortest paths are the multiple vulnerability attack chains used for subsequent calculations.

[0084] As you can understand, Depth-First Search (DFS) is an algorithm used to traverse or search a tree or graph. It traverses the tree's nodes along its depth, searching the branches as deeply as possible. When all edges containing node v have been explored, the search backtracks to the starting node of the edge that discovered node v. This process continues until all nodes reachable from the source node have been found. If any undiscovered nodes exist, one of them is selected as the source node, and the above process is repeated until all nodes have been visited.

[0085] Understandably, various web crawling tools can be used to collect information about the target system to obtain the attacker's current privileges.

[0086] According to some embodiments of the present invention, the vulnerability correlation analysis method of the present invention further includes, but is not limited to, the following steps:

[0087] Step S610: Determine the attack chain score dataset based on the vulnerability score dataset of all vulnerabilities in the vulnerability attack chain. The attack chain score dataset includes attack chain attack vector, attack chain complexity, attack chain authentication level, attack chain confidentiality, attack chain integrity, attack chain availability, and privilege escalation span quantification value. The privilege escalation span quantification value is the sum of the vulnerability category scores of all vulnerabilities.

[0088] In this embodiment, the attack chain scoring dataset includes the attack chain attack vector AV, attack chain complexity AC, attack chain authentication level Au, attack chain confidentiality C, attack chain integrity I, attack chain availability A, and privilege escalation span quantification value PS. The attack chain scoring dataset can be represented as {AV, AC, Au, C, I, A, PS}. The attack chain attack vector is the average of the vulnerability attack vectors of all vulnerabilities in the vulnerability attack chain; the attack chain complexity is the average of the vulnerability attack complexity of all vulnerabilities in the vulnerability attack chain; the attack chain authentication level is the average of the vulnerability authentication levels of all vulnerabilities in the vulnerability attack chain; the attack chain confidentiality is the average of the vulnerability confidentiality of all vulnerabilities in the vulnerability attack chain; the attack chain integrity is the average of the vulnerability integrity of all vulnerabilities in the vulnerability attack chain; the attack chain availability is the average of the vulnerability integrity of all vulnerabilities in the vulnerability attack chain; and the privilege escalation span quantification value is the sum of the scores of all vulnerabilities in the vulnerability attack chain belonging to their respective privilege escalation categories.

[0089] For example, if the vulnerability scoring dataset α = {AccessVector:0.395,AccessComplexity:0.61,Authentication:0.45,ConfImpact:0.275,IntegImpact:0,AvailImpact:0.66,PrivilegeScore:0.9} and the vulnerability scoring dataset β = {AccessVector:0.646,AccessComplexity:0.36,Authentication:0.56,ConfImpact:0,IntegImpact:0.275,AvailImpact:0.66,PrivilegeScore:3.9}, then the attack chain scoring dataset = {AV:0.5205,AC:0.485,Au:0.505,C:0.275,I:0.1375,A:0.66,PS:4.8}.

[0090] According to some embodiments of the present invention, the vulnerability correlation analysis method of the present invention further includes, but is not limited to, the following steps:

[0091] Step S710: Determine the quantitative value of the impact of the vulnerability attack chain based on the attack chain score dataset, which includes attack chain confidentiality, attack chain integrity, and attack chain availability.

[0092] Step S720: Determine the exploitability quantification value of the vulnerability attack chain based on the attack chain attack vector, attack chain complexity, and attack chain authentication level in the attack chain score dataset of the vulnerability attack chain.

[0093] In this embodiment, the impact quantification value is calculated as shown in formula (1):

[0094] Impact=e*(1-(1-C*(1-I*(1-A)))); (1)

[0095] Where e is a calculation coefficient, and in this embodiment of the invention, e can be 10.41.

[0096] The exploitability quantification value is calculated as shown in formula (2):

[0097] Exploitability=20*AV*AC*Au; (2)

[0098] Where k is a calculation coefficient, and in this embodiment of the invention, k can be 20.

[0099] Furthermore, the final score of the vulnerability attack chain is shown in formula (3):

[0100] Score=((a*Impact)+(b*Exploitability)-c)*f(Impact)+PS;

[0101] Where a, b, and c are all calculation coefficients. In this embodiment of the invention, a can be 0.6, b can be 0.4, and c can be 1.5. f(Impact) is a correction value. When Impact is 0, f(Impact) is also 0; otherwise, f(Impact) is equal to the preset correction coefficient, which can be 1.176.

[0102] This invention also provides a vulnerability correlation analysis system, comprising:

[0103] The first module is used to obtain a list of system vulnerabilities;

[0104] The second module is used to classify vulnerabilities in the system vulnerability list into corresponding privilege escalation categories based on privilege escalation theory. The privilege escalation categories include prerequisite privileges and result privileges.

[0105] The third module is used to combine vulnerabilities of multiple privilege escalation categories to obtain multiple vulnerability attack chains;

[0106] The fourth module is used to determine the score of the vulnerability attack chain based on the quantitative values ​​of the impact, exploitability, and privilege escalation span of the vulnerability attack chain, and to select the optimal vulnerability attack chain based on the score of the vulnerability attack chain.

[0107] It is understood that the content of the above-described vulnerability correlation analysis method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above-described vulnerability correlation analysis method embodiments, and the beneficial effects achieved are also the same as those achieved in the above-described vulnerability correlation analysis method embodiments.

[0108] Reference Figure 2 , Figure 2 This is a schematic diagram of a vulnerability correlation analysis device provided in one embodiment of the present invention. The vulnerability correlation analysis device of this embodiment includes one or more control processors and a memory. Figure 2 The example consists of a control processor and a memory.

[0109] The control processor and memory can be connected via a bus or other means. Figure 2 Taking the example of a connection between China and Israel via a bus.

[0110] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the control processor, and these remote memories can be connected to the vulnerability correlation analysis device via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0111] Those skilled in the art will understand that Figure 2 The device structure shown does not constitute a limitation on the vulnerability correlation analysis device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0112] The non-transient software program and instructions required to implement the vulnerability correlation analysis method applied to the vulnerability correlation analysis device in the above embodiments are stored in the memory. When executed by the controlled processor, the vulnerability correlation analysis method applied to the vulnerability correlation analysis device in the above embodiments is executed.

[0113] Furthermore, one embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions that are executed by one or more control processors, causing the one or more control processors to perform the vulnerability correlation analysis method in the above method embodiment.

[0114] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0115] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A vulnerability correlation analysis method, characterized in that, Includes the following steps: Obtain the list of system vulnerabilities in the target system; Based on the privilege escalation theory, the vulnerabilities in the system vulnerability list are classified into corresponding privilege escalation categories, wherein the privilege escalation categories are used to mark the prerequisite privileges and result privileges of the vulnerability; Multiple vulnerability attack chains are obtained by combining vulnerabilities of the aforementioned privilege escalation categories. The score of the vulnerability attack chain is determined based on the quantitative values ​​of the impact, exploitability, and privilege escalation span of the vulnerability attack chain, and the optimal vulnerability attack chain is selected based on the score of the vulnerability attack chain. The impact quantification value is used to characterize the comprehensive score of the confidentiality, integrity and availability of the vulnerability attack chain. The exploitability quantification value is used to characterize the comprehensive score of the attack vector, attack complexity and authentication level of the vulnerability attack chain. The privilege escalation span quantification value is used to characterize the size of the privilege escalation span of the vulnerability attack chain.

2. The vulnerability correlation analysis method according to claim 1, characterized in that, The process of obtaining the system vulnerability list of the target system includes the following steps: Obtain all vulnerabilities of the target system and retrieve the description information of each vulnerability from the vulnerability database. The description information of the vulnerability includes vulnerability number, vulnerability description text, vulnerability attack vector, vulnerability attack complexity, vulnerability authentication level, vulnerability confidentiality, vulnerability integrity, and vulnerability availability. A vulnerability scoring dataset is determined based on the description information of each vulnerability; The system vulnerability list is determined based on the vulnerability score dataset of all vulnerabilities in the target system.

3. The vulnerability correlation analysis method according to claim 2, characterized in that, The process of classifying vulnerabilities in the system vulnerability list into corresponding privilege escalation categories based on privilege escalation theory includes the following steps: Retrieve vulnerability description text from the vulnerability scoring dataset in the system vulnerability list; The prerequisite permissions and result permissions of the vulnerability are determined based on the vulnerability description text. The prerequisite permissions are one of the following: guest permissions, user permissions, or administrator permissions. The result permissions are one of the following: user permissions, administrator permissions, or super administrator permissions. Based on the prerequisite permissions and result permissions of the vulnerability, the vulnerability is classified into the corresponding privilege escalation category, wherein the privilege escalation category includes escalating visitor permissions to user permissions, escalating visitor permissions to administrator permissions, escalating visitor permissions to super administrator permissions, escalating user permissions to administrator permissions, escalating user permissions to super administrator permissions, and escalating administrator permissions to super administrator permissions. The vulnerability scoring dataset is updated according to the privilege escalation category to which the vulnerability belongs. The updated vulnerability scoring dataset includes the vulnerability description information, including vulnerability number, vulnerability attack vector, vulnerability attack complexity, vulnerability authentication level, vulnerability confidentiality, vulnerability integrity and vulnerability availability, vulnerability prerequisite privileges, vulnerability result privileges, and vulnerability category score of the privilege escalation category to which the vulnerability belongs.

4. The vulnerability correlation analysis method according to claim 2, characterized in that, The process of combining multiple vulnerabilities of the aforementioned privilege escalation categories to obtain multiple vulnerability attack chains includes the following steps: Treat all vulnerabilities in the target system as nodes in the attack graph; Determine the edges between nodes in the attack graph based on the privilege escalation category to which the vulnerability belongs; Traverse the attack graph to identify the first node whose prerequisite permissions are the same as the attacker's permissions and identify all second nodes with an out-degree of zero. Multiple vulnerability attack chains are constructed, with the first node as the starting node and the second node as the ending node.

5. The vulnerability correlation analysis method according to claim 4, characterized in that, The process of constructing multiple vulnerability attack chains with the first node as the starting node and the second node as the ending node includes the following steps: Use a depth-first search algorithm to determine all paths between the start and end nodes; Multiple shortest paths are determined based on the number of nodes in all paths, and these shortest paths are identified as vulnerability attack chains.

6. The vulnerability correlation analysis method according to claim 3, characterized in that, The vulnerability correlation analysis method also includes the following steps: An attack chain score dataset is determined based on the vulnerability score dataset of all vulnerabilities in the attack chain. The attack chain score dataset includes attack chain attack vector, attack chain complexity, attack chain authentication level, attack chain confidentiality, attack chain integrity, attack chain availability, and privilege escalation span quantification value. The privilege escalation span quantification value is the sum of the vulnerability category scores of all vulnerabilities.

7. The vulnerability correlation analysis method according to claim 6, characterized in that, The vulnerability correlation analysis method also includes the following steps: The impact of the vulnerability attack chain is quantified based on the attack chain confidentiality, attack chain integrity, and attack chain availability in the attack chain scoring dataset. The exploitability quantification value of the vulnerability attack chain is determined based on the attack chain attack vector, attack chain complexity, and attack chain authentication level in the attack chain scoring dataset.

8. A vulnerability correlation analysis system, characterized in that, include: The first module is used to obtain a list of system vulnerabilities; The second module is used to classify the vulnerabilities in the system vulnerability list into corresponding privilege escalation categories based on the privilege escalation theory. The privilege escalation categories are used to mark the prerequisite privileges and result privileges of the vulnerabilities. The third module is used to combine multiple vulnerabilities of the aforementioned privilege escalation categories to obtain multiple vulnerability attack chains; The fourth module is used to determine the score of the vulnerability attack chain based on the quantitative values ​​of the impact degree, the exploitability, and the privilege escalation span of the vulnerability attack chain, and to select the optimal vulnerability attack chain based on the score of the vulnerability attack chain. The impact quantification value is used to characterize the comprehensive score of the confidentiality, integrity and availability of the vulnerability attack chain. The exploitability quantification value is used to characterize the comprehensive score of the attack vector, attack complexity and authentication level of the vulnerability attack chain. The privilege escalation span quantification value is used to characterize the size of the privilege escalation span of the vulnerability attack chain.

9. A vulnerability correlation analysis device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the vulnerability correlation analysis method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a processor-executable program, characterized in that, When the processor executes the program, it is used to implement the vulnerability correlation analysis method as described in any one of claims 1 to 7.

Images