Knowledge graph-based network attack security risk assessment system and method

Abstract

The application provides a network attack security risk assessment system and method based on a knowledge graph, and the system comprises: a network space security knowledge graph module; the alarm information of an intrusion detection system is input into the knowledge graph, and the alarm information is generated after the intrusion detection system detects a network attack; an inference engine module; according to a preset rule and the knowledge graph, attack results caused by network attacks on specific assets are obtained, and the attack results and corresponding inference paths are sent to a result display module; and the result display module; the attack results and inference paths are visually displayed.Compared with the prior art, the application introduces the knowledge graph into the correlation identification field of complex network attacks, infers the consequences that may be caused by complex network attacks according to the knowledge graph, system structure and real-time alarm information, and solves the problem that the intrusion detection system lacks correlation analysis of long-term, cross-asset complex network attacks.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, and more specifically, to a network attack security risk assessment system and method based on knowledge graphs. Background Technology

[0002] Complex cyberattacks refer to network attacks that occur over a relatively long period and involve multiple attack steps. They target a wide range of objects, ranging from attacks on servers aimed at data theft, similar to traditional cyberattacks, to attacks on industrial control networks aimed at gaining control of the target system. Although modern enterprises deploy Intrusion Detection Systems (IDS) to detect cyberattacks in real time, IDS systems generate a large number of threat alerts daily, requiring security experts to analyze whether these alerts are part of a complex cyberattack. Furthermore, the large number of IDS alerts and the presence of false positives make them difficult for security experts to handle, often causing genuine attacks to go undetected by being buried in the sea of ​​alerts. Additionally, IDS systems are often designed to detect individual cyberattacks and cannot determine the progress of complex cyberattacks or predict their potential consequences, information crucial for system protection and mitigating attack damage.

[0003] For the detection of complex network attacks, relying solely on IDS alerts is insufficient. The detection system should be able to determine whether a complex network attack has occurred, the progress of the complex network attack, the potential consequences of the complex network attack at this stage, and the likelihood of its occurrence.

[0004] Patent document CN109347801B discloses a vulnerability exploitation risk assessment method based on multi-source word embedding and knowledge graph. It constructs a network security-related data source ontology based on an information security knowledge graph, then obtains the latest online information from different online data sources; preprocesses the data and performs word vectorization using word embedding; maps the word vectorized data into a relationship graph between entities based on the knowledge graph; combines historical data sets and the knowledge graph to construct a vulnerability exploitation risk assessment model, performs vulnerability exploitation risk assessment, and provides the assessment basis for vulnerability exploitation risk. However, this method does not solve the problem of determining the consequences of complex network attacks. Summary of the Invention

[0005] In view of the shortcomings of the existing technology, the purpose of this invention is to provide a network attack security risk assessment method and system based on knowledge graph.

[0006] A network attack security risk assessment system based on knowledge graphs provided by the present invention includes:

[0007] Cybersecurity Knowledge Graph Module: Input the alarm information from the intrusion detection system into the knowledge graph. The alarm information is generated after the intrusion detection system detects a network attack.

[0008] Inference Engine Module: Based on preset rules and knowledge graphs, it obtains the attack results of network attacks on specific assets and sends the attack results and corresponding inference paths to the results display module.

[0009] Results display module: Visualizes the attack results and inference path.

[0010] Preferably, the cyberspace security knowledge graph module includes:

[0011] Knowledge Subgraph Construction Submodule: Based on the network vulnerability database, construct a knowledge subgraph by using network security concepts as nodes and the relationships between network security concepts as edges;

[0012] Asset Information Subgraph Construction Submodule: Constructs an asset information subgraph based on the asset topology of the system to be deployed and the CVE vulnerabilities contained in each asset. The asset information subgraph is interconnected with the knowledge subgraph.

[0013] Attack Information Subgraph Construction Submodule: The attack information subgraph contains attack event nodes, which are interconnected with the knowledge subgraph and the asset information subgraph, respectively.

[0014] A knowledge graph consists of a knowledge subgraph, an asset information subgraph, and an attack information subgraph.

[0015] Preferably, the inference engine module includes:

[0016] The inference engine submodule: Based on preset rules and knowledge graphs, it sorts the paths to obtain the attack results of network attacks on specific assets, and sends the attack results and the corresponding inference paths to the results display module.

[0017] Preferably, the preset rules include at least one of the following:

[0018] The first sub-result of an attack caused by a CVE vulnerability inherent in a specific asset;

[0019] A secondary attack consequence resulting from a cyberattack on a specific asset;

[0020] A third attack sub-result on a specific asset after a CVE vulnerability in other assets topologically connected to that specific asset is exploited or subjected to a cyberattack.

[0021] The attack result is obtained based on the first attack sub-result, the second attack sub-result, and the third attack sub-result.

[0022] Preferably, the result display module includes:

[0023] Results Display Submodule: By selecting a date, you can view the attack results and inference paths at different points in time.

[0024] A network attack security risk assessment method based on knowledge graphs provided by the present invention includes: employing the aforementioned network attack security risk assessment system based on knowledge graphs, and performing the following steps:

[0025] Step 1: Input the alarm information obtained from the intrusion detection system into the knowledge graph. The alarm information is generated after the intrusion detection system detects a network attack.

[0026] Step 2: Based on preset rules and knowledge graphs, obtain the attack results of the network attack on specific assets;

[0027] Step 3: Visualize the attack results and inference path.

[0028] Preferably, step 1 includes:

[0029] Step 101: Based on the network vulnerability database, construct a knowledge subgraph by using network security concepts as nodes and the relationships between network security concepts as edges;

[0030] Step 102: Construct an asset information subgraph based on the asset topology of the system to be deployed and the CVE vulnerabilities contained in each asset. The asset information subgraph is interconnected with the knowledge subgraph.

[0031] Step 103: The attack information subgraph contains attack event nodes, which are interconnected with the knowledge subgraph and the asset information subgraph respectively. The knowledge graph includes the knowledge subgraph, the asset information subgraph and the attack information subgraph.

[0032] Preferably, step 101 includes:

[0033] Step 1011: Obtain the network vulnerability database and parse the data in the network vulnerability database to obtain the network space security concept and the relationship between the network space security concepts;

[0034] Step 1012: Construct a knowledge subgraph by using cyberspace security concepts as nodes and the relationships between them as edges.

[0035] Preferably, step 2 includes:

[0036] Step 201: At preset intervals, based on the knowledge graph and preset rules, use a path sorting algorithm to obtain the attack results and corresponding inference paths caused by network attacks on specific assets.

[0037] Preferably, the preset rules include at least one of the following:

[0038] The first sub-result of an attack caused by a CVE vulnerability inherent in a specific asset;

[0039] A secondary attack consequence resulting from a cyberattack on a specific asset;

[0040] A third attack sub-result on a specific asset after a CVE vulnerability in other assets topologically connected to that specific asset is exploited or subjected to a cyberattack.

[0041] Step 201 includes:

[0042] Step 2011: Obtain the attack result based on the first attack sub-result, the second attack sub-result, and the third attack sub-result.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] 1. This invention constructs an inference engine to receive and filter alarm information from IDS. Even with long-term operation, the amount of data in the graph database will not be too large, eliminating the need for periodic deletion of the graph database. Necessary information can be stored for a sufficiently long time for correlation analysis.

[0045] 2. This invention adopts a modular design, the knowledge graph can be updated as needed, and the reasoning rules and risk thresholds can be set by the user. It is flexible in deployment and suitable for enterprise users. Attached Figure Description

[0046] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0047] Figure 1 This is a schematic diagram of the structure of the cyberspace security knowledge graph module of the present invention;

[0048] Figure 2 This is a schematic diagram of the process of the present invention;

[0049] Figure 3 This is a schematic diagram illustrating an application scenario of the present invention;

[0050] Figure 4 These are the five lines of reasoning presented in the results display module of this invention. Detailed Implementation

[0051] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0052] This invention provides a network attack security risk assessment system based on knowledge graphs, including: a network space security knowledge graph module, an inference engine module, and a result display module.

[0053] Cybersecurity Knowledge Graph Module: Input the alarm information from the intrusion detection system into the knowledge graph. The alarm information is generated after the intrusion detection system detects a network attack.

[0054] Preferably, the cyberspace security knowledge graph module includes: a knowledge subgraph construction submodule: constructing a knowledge subgraph based on a network vulnerability database, using cyberspace security concepts as nodes and the relationships between cyberspace security concepts as edges; an asset information subgraph construction submodule: constructing an asset information subgraph based on the asset topology of the system to be deployed and the CVE vulnerabilities contained in each asset, with the asset information subgraph interconnected with the knowledge subgraph; and an attack information subgraph construction submodule: the attack information subgraph contains attack event nodes, which are interconnected with both the knowledge subgraph and the asset information subgraph; the knowledge graph includes the knowledge subgraph, the asset information subgraph, and the attack information subgraph.

[0055] Specifically, Figure 1 This is a schematic diagram of the structure of the cyberspace security knowledge graph module of the present invention, as shown below. Figure 1As shown, the cyberspace security knowledge graph ontology includes a knowledge subgraph, an asset information subgraph, and an attack information subgraph. The knowledge subgraph is constructed using a network vulnerability database, storing nodes for Common Weakness Enumeration (CWE), Common Attack Pattern Enumeration and Classification (CAPEC), technology nodes, and attack nodes, as well as the relationships between these nodes. The asset information subgraph is constructed from the asset topology of the system to be deployed and the Common Vulnerabilities & Exposures (CVEs) contained in each asset. It stores asset nodes (ASSET) and CVE nodes, as well as the relationships between them. The asset information subgraph is interconnected with the knowledge subgraph through the relationship between CVEs and CWEs. The attack information subgraph contains attack event nodes (INSTANCE). INSTANCE nodes are interconnected with the knowledge subgraph through their relationship with technology nodes, and with the asset information subgraph through their relationship with ASSET nodes.

[0056] This invention does not limit the network vulnerability information database. For example, it can be the National Vulnerability Database (National Institute of Standards and Technology) (NVD), Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK).

[0057] Among them, CVE is an internationally renowned public vulnerability and exposure information database containing unified names and standardized descriptions of vulnerabilities; CWE is a list of common flaws that can discover and identify vulnerabilities and attack points; CAPEC provides a directory of common attack patterns related to vulnerabilities; NVD is a repository of standards-based vulnerability management data represented by the Security Content Automation Protocol (SCAP) used by the US government; ATT&CK is an attack model framework developed by MITRE, an open adversarial tactical and technical knowledge base based on attack vectors observed in the real world, which can be used by private organizations, government departments, and the cybersecurity product and service community as a basis for developing specific threat models and methods.

[0058] Specifically, the construction method of the cybersecurity knowledge graph module is as follows: First, based on information from network vulnerability databases such as NVD and MITRE ATT&CK, obtain TECHNIQUE nodes, CAPEC nodes, CWE nodes, and IMPACT nodes, as well as the relationships between nodes, and store them in the graph database to construct a knowledge subgraph; then, obtain the topology of the system assets to be deployed, scan the CVE vulnerabilities contained in each asset, obtain the relationships between CVE nodes and CWE nodes through the network vulnerability database, and store them in the graph database to construct an asset information subgraph; finally, after deployment, receive alarm information from IDS. If an alarm is unique, that is, the alarm type on the corresponding ASSET node has not occurred before, then create an INSTANCE node for the alarm in the attack information subgraph, and establish connections between the INSTANCE node, ASSET node, and TECHNIQUE node based on the alarm information; if a similar INSTANCE node exists in the graph database for a certain alarm, then update the timestamp information of the similar INSTANCE node, without creating a new INSTANCE node.

[0059] Inference Engine Module: Based on preset rules and knowledge graphs, it obtains the attack results caused by network attacks on specific assets and sends the attack results and corresponding inference paths to the results display module.

[0060] Preferably, the inference engine module includes: an inference engine submodule: based on preset rules and knowledge graphs, it obtains the attack results caused by the network attack on a specific asset through path sorting, and sends the attack results and the corresponding inference path to the result display module.

[0061] Preferably, the preset rules include at least one of the following: a first attack sub-result caused by a CVE vulnerability contained in the specific asset itself; a second attack sub-result caused by a network attack encountered by the specific asset; a third attack sub-result caused to the specific asset by the exploitation of CVE vulnerabilities in other assets that are topologically connected to the specific asset or by a network attack; and an attack result is obtained based on the first attack sub-result, the second attack sub-result, and the third attack sub-result.

[0062] Specifically, the inference engine module takes a cyberspace security knowledge graph and preset rules as input and outputs the probability of complex network attacks and the reasoning basis.

[0063] This invention uses the Path Ranking Algorithm (PRA) for inference. The PRA method involves inputting one or more query entities, then performing a random walk across the knowledge graph, leading to multiple results based on different paths, with each result reached via multiple paths. To evaluate the reliability of each result, each path is assigned a weight and an allocation value. The score of a reasoning result is the sum of the products of the weights and allocation values ​​of all paths leading to that result. After inference, the inference engine module outputs the risk faced by the specific asset, its score, and the most important inference criteria—the paths in the knowledge graph—and displays this information in the results module. As the network attack progresses, the inference engine module dynamically and in real-time reflects the security risks faced by a specific asset, allowing security management experts to react promptly and grasp the full picture of the attack's development.

[0064] Specifically, the logical steps of the inference engine are as follows: First, security experts provide preset rules to define the inference path pattern of the inference engine module and reduce inference noise; then, at preset intervals, the cyberspace security knowledge graph is read, and the PRA algorithm is used to infer the risks that specific assets may face and their scores, i.e., the attack results; finally, the attack results are pushed to the results display module.

[0065] For example, security experts can construct inference rules from three perspectives: the potential consequences of CVE vulnerabilities contained in a specific asset itself; the potential consequences of attacks on a specific asset; and the potential consequences for the specific asset if CVE vulnerabilities in other assets topologically connected to the specific asset are exploited or attacked.

[0066] Results display module: Visualizes the attack results and inference path.

[0067] Preferably, the results display module includes: a results display submodule: by selecting a date, users can view the attack results and inference paths at different time points.

[0068] Specifically, the results display interface uses charts to visualize attack results and reasoning paths, providing a list of risks currently faced by specific assets and their probability scores. Furthermore, by selecting a date, users can view attack results at different points in time, helping cybersecurity auditors understand the development process of complex cyberattacks.

[0069] This invention aims to solve the problem of difficulty in detecting complex network attacks. It receives security alert events from systems such as IDS, structures and processes the alert event information and stores it in a knowledge graph. It uses an inference engine module to infer the possible consequences of network attacks. Finally, it displays the possible consequences of complex network attacks and the basis for inference on the administrator review interface for security audit experts to review.

[0070] It is understood that this application does not limit the types of cyberattacks. For example, it can be a complex cyberattack.

[0071] This invention introduces knowledge graphs (KG) into the field of association identification for complex network attacks. It represents entities such as attack instances, attack techniques, CVE vulnerabilities, and assets as nodes in the graph, and represents the conceptual connections between knowledge, the exploitation of asset vulnerabilities, and the relationship between attack techniques and targets as edges in the graph. Furthermore, based on the knowledge graph, system structure, real-time alarms, and other information, it infers the possible consequences of complex network attacks.

[0072] Figure 2 This is a schematic diagram of the process of the present invention, such as Figure 2 As shown, this invention provides a network attack security risk assessment method based on knowledge graphs, comprising: using the aforementioned network attack security risk assessment system based on knowledge graphs, performing the following steps:

[0073] Step 1: Input the alarm information obtained from the intrusion detection system into the knowledge graph. The alarm information is generated after the intrusion detection system detects a network attack.

[0074] Preferably, step 1 includes: Step 101: Based on the network vulnerability database, construct a knowledge subgraph by using network security concepts as nodes and the relationships between network security concepts as edges; Step 102: Construct an asset information subgraph based on the asset topology of the system to be deployed and the CVE vulnerabilities contained in each asset, and interconnect the asset information subgraph with the knowledge subgraph; Step 103: The attack information subgraph contains attack event nodes, which are interconnected with the knowledge subgraph and the asset information subgraph respectively. The knowledge graph includes the knowledge subgraph, the asset information subgraph, and the attack information subgraph.

[0075] Further, step 101 includes: step 1011: obtaining a network vulnerability database and parsing the network vulnerability database to obtain network security concepts and the relationships between network security concepts; step 1012: constructing a knowledge subgraph by using network security concepts as nodes and the relationships between network security concepts as edges.

[0076] The following section explains how to construct the knowledge subgraph, asset information subgraph, and attack information subgraph in a knowledge graph.

[0077] For example, the knowledge subgraph includes nodes such as ATT&CK, CAPEC, and CWE. This invention obtains and parses data from a network vulnerability database website, transforms the parsed cybersecurity concepts into nodes, and transforms the relationships between cybersecurity concepts into edges, thereby forming a knowledge subgraph. Table 1 shows the node type names and corresponding number of nodes in the knowledge subgraph provided by this invention. In this embodiment, the knowledge subgraph information is shown in Table 1:

[0078] Table 1

[0079] Node type name Number of nodes TECHNIQUE 545 CAPEC 522 CWE 939 IMPACT 19

[0080] The asset information subgraph comprises two parts: the topological connections between assets and the CVE vulnerability information contained in each asset. By receiving the asset topology of the cluster to be deployed, this invention converts assets into nodes and the connections between assets into edges, establishing connections between assets. For example, the IP address of an asset can be converted into a node. This invention also converts the CVE vulnerability information contained in each asset into nodes, establishing connections between CVE nodes and assets containing CVE vulnerabilities. Finally, this invention organizes the relationships between CVE nodes and CVE nodes obtained from network vulnerability database websites and adds them to the knowledge graph in the form of edges, enabling the asset information subgraph to... Figure 1 The path “ASSET-CVE-CWE” is connected to the knowledge subgraph.

[0081] In this invention, the initial state of the attack information subgraph is empty. As the system to be deployed runs, this invention will receive and parse alarm information generated from alarm events or attack reports from the IDS, and automatically perform parsing, adding each unique alarm as an INSTANCE node to the attack information subgraph. Simultaneously, by analyzing the alarm information generated from alarm events or attack reports, this invention will map the attack techniques used by the attacker in the alarm or attack to the TECHNIQUE node of the knowledge subgraph, map the attack targets to the corresponding ASSET nodes in the asset information subgraph, and connect them to the corresponding INSTANCE nodes. In this way, the attack information subgraph can... Figure 1 The "INSTANCE-TECHNIQUE" subgraph is connected to the knowledge subgraph, and also to the asset information subgraph via "INSTANCE-ASSET". As the system to be deployed continues to operate, the content of the attack information subgraph will continue to expand.

[0082] In this invention, the input to the graph database is unprocessed alarm information, which often contains redundant alarms. For example, if an attacker performs a brute-force password attack on the login interface of a sensitive asset and makes 1000 attempts, the upper-level alarm system may issue 1000 security alarms accordingly. If all this redundant information is added to the graph database, it will affect the stability of the graph database after long-term operation. Therefore, the graph database needs to filter alarm events. Each time an alarm event is input, the graph database will determine whether each attack alarm is "unique" and create an INSTANCE class node only for "unique" attack alarms. The method for determining whether an attack alert is "unique" is as follows: Each attack alert establishes a connection with TECHNIQUE and ASSET type nodes. If the connection relationship between an attack alert and TECHNIQUE and ASSET type nodes is different from all other INSTANCE type nodes in the graph database, then the alert event is considered "unique," and the graph database will create a separate node for it. If an alert is not "unique," then the graph database will match it to an existing INSTANCE node in the graph database and only update the timestamp and other information of that node.

[0083] Step 2: Based on preset rules and knowledge graphs, obtain the attack results of network attacks on specific assets.

[0084] Preferably, step 2 includes: step 201: every preset time interval, according to the knowledge graph and preset rules, using a path sorting algorithm, to obtain the attack results and corresponding inference paths caused by network attacks on specific assets.

[0085] In this invention, the preset rules include at least one of the following: a first attack sub-result caused by a CVE vulnerability contained in the specific asset itself; a second attack sub-result caused by a network attack encountered by the specific asset; a third attack sub-result caused to the specific asset after a CVE vulnerability in other assets topologically connected to the specific asset is exploited or after a network attack is encountered; step 201 includes: step 2011: obtaining the attack result based on the first attack sub-result, the second attack sub-result, and the third attack sub-result.

[0086] Specifically, the inference engine module receives preset rules set by security experts and uses a path ranking algorithm to perform inference on the cyberspace security knowledge graph. Each time inference is initiated, the inference engine first checks whether there are any new alarm events (i.e., new INSTANCE nodes) in the graph database during the interval between two inference attempts. If so, the inference engine uses the PRA algorithm to calculate the potential consequences of a single alarm event on a specific asset according to preset rules and stores this value in the graph database. After the inference engine completes the risk analysis of all new INSTANCE nodes added during the interval between two inference attempts, it uses the PRA algorithm to infer the potential consequences of all alarm events on specific assets and scores the severity of each consequence.

[0087] The implementation method of the PRA algorithm in this embodiment is briefly described below.

[0088] In a cybersecurity knowledge graph, given a query request (i.e., given the constraints of the starting node and the target node), multiple different paths can lead to multiple different answers. The PRA algorithm calculates the reliability of each obtained answer by setting a scoring function: Suppose there exists a... q Starting with a query request, the result node e is reached through paths P1, P2, ..., Pn in the knowledge graph. The score of this result can be expressed by formula (1):

[0089]

[0090] Where n represents the number of paths, which is a positive integer; θ i This represents the weight corresponding to path Pi; The path is indicated by E q Let be the allocation value corresponding to the path Pi with as the starting point and e as the ending point. Formula (1) shows that the score of a query result is determined by the weight and allocation value of the path that leads to it. The calculation methods of weight and allocation value are introduced below.

[0091] Specifically, the path weight is an indicator reflecting the logical reliability of a path in the knowledge graph, and is given by security experts. Starting from a certain asset node, there are multiple reasoning path patterns when reasoning about the possible consequences of an attack on that node. Different path patterns have varying degrees of logical consistency, and therefore each path contributes differently to the final result. Higher weights are assigned to more logically consistent reasoning patterns. Table 2 shows the path patterns and their weights provided by this invention.

[0092] Table 2

[0093]

[0094] As shown in Table 2, 12 inference paths are set up in the complex network attack scenario of this embodiment, and they are assigned different weights according to their reasonableness. The inference logic of path mode 1-2 is: inferring the possible consequences based on the attack techniques used in the attack on a specific asset. The inference logic of path mode 3-4 is: inferring the possible consequences when the CVE vulnerabilities of a specific asset are exploited based on the CVE vulnerabilities that exist in the asset. Since path mode 1-2 infers based on established facts, that is, attack instances that have already occurred, while path mode 3-4 infers based on knowledge that has not yet occurred and only exists as possibilities, the results obtained by path mode 1-2 are more credible and should be assigned a greater weight. Path patterns 5-6 and 9-10 correspond to path pattern 1-2, respectively. The difference lies in the addition of one or two extra "ASSET" items at the beginning of the path pattern. In this case, the path pattern reflects the potential consequences for a specific asset if other assets connected to it in the topology are attacked. While attacking assets connected in the topology certainly poses a threat to the specific asset, it is less so than a direct attack. Therefore, paths 5-6 and 9-10 are assigned lower weights than path patterns 1-2. Path patterns 7-8 and 11-12 correspond to path 3-4, respectively. They reflect the potential threat posed to the specific asset by CVE vulnerabilities contained in assets connected to it in the topology. Compared to CVE vulnerabilities in the specific asset itself, the threat is lower, therefore they are assigned lower weights than path patterns 3-4.

[0095] The assignment value hi of path Pi is determined by the topology of the knowledge graph and can be obtained recursively. Let R be a relation in the knowledge graph, i.e., an edge, where R(e,e′) represents the connection between the head entity e and the tail entity e′ through relation R. A reasoning path P can be written as a sequence of relations, such as P = R1R2…R l-1 R l For any reasoning path P = R1R2…R l-1 R l Given query request E q The reasoning result e, when P is an empty path, the path assignment value can be defined by formula (2):

[0096]

[0097] When path P is not an empty path, let P = R1R2…R l-1 R l P′=R1R2…R l-1 Define Range(P′) as the set of all tail entities connected to path P′. In this case, the assignment value of path P will be calculated recursively, specifically, it can be calculated using formula (3):

[0098]

[0099] Where, I(R) l (e′,e) represents the activation function, when node e′ and node e pass through R. l If the elements are connected, take 1; otherwise, take 0.

[0100] Figure 3 This is a schematic diagram illustrating an application scenario of the present invention, such as... Figure 3 As shown, this embodiment includes three hosts: a peripheral host (H1), a middle host (H2), and a sensitive host (H3). Their importance increases sequentially. Topologically, the peripheral host is connected to the middle host, and the middle host is connected to both the peripheral host and the sensitive host. The peripheral host is known to have a remote desktop service vulnerability (CVE-2019-0708), while the middle host has a command injection vulnerability (CVE-2017-14480) and a privilege escalation vulnerability (CVE-2018-17160). In this constructed scenario, assuming a complex network attack targeting the theft of sensitive files from the sensitive host, the attack scenario consists of nine steps. Table 3 shows the nine steps of the attack scenario provided by this invention.

[0101] Table 3

[0102]

[0103] The attack is reasoned through in the nine steps shown in Table 3. After the result calculation is completed, the inference engine outputs the score s corresponding to each result and summarizes them in a table. The contents of the table are then passed to the result display module. Table 4 is an example of the inference result provided by this invention. As shown in Table 4, the "Result Name" column in Table 4 represents the risks that a specific asset may face, and the "Score" column indicates the relative probability of each possible risk. The higher the score, the greater the probability that the risk will occur.

[0104] Table 4

[0105] ID Result Name Rating 1 Rating 2 1 Read Application Data 9.45 42.65 2 Modify Application Data 2.59 13.13 3 Gain Privileges or Assume Identity 7.49 25.56 4 Read Files or Directories 0.25 4.38 5 Varies by Context 1.37 4.25 6 Read Memory 0.05 2.10 7 Bypass Protection Mechanism 4.11 11.56 8 Modify Memory 0.79 2.49 9 Hide Activities 0.08 0.55 10 Execute Unauthorized Code or Commands 2.06 3.49 11 Reduce Reliability 0.64 0.51 12 Other 2.67 1.06 13 Unexpected State 0 0.03 14 DoS 0.88 0.68 15 Alter Execution Logic 0.01 0.01

[0106] In Table 4, score 1 represents the score given by the inference system when the attack reaches step 3 of the attack scenario in Table 3, and score 2 represents the score given by the inference system when the attack reaches step 8. According to the data in Table 4, the inference engine determines that the attacker's purpose is "Read Application Data," which is consistent with the assumption in the embodiment that the attacker is carrying out a data theft attack, indicating that the system can determine the attacker's purpose. Simultaneously, from a time perspective, as the attack progresses, the various risk scores faced by the specific asset increase, indicating that the threat to the specific asset gradually increases. This indicator suggests an increased likelihood of complex network attacks, and the "Read Application Data" score shows the largest increase, further indicating that the greatest risk faced by this asset is data theft.

[0107] Step 3: Visualize the attack results and inference path.

[0108] Specifically, after the reasoning process is completed, the reasoning engine module sends the reasoning results to the result display module. The result display module of this invention displays the most likely attack consequences and some reasoning basis; the result display module of this invention visualizes the reasoning basis, which refers to the specific existing path found by the graph reasoning engine in the knowledge graph according to the pre-set reasoning rules, i.e., the reasoning path. Figure 4 The five lines of reasoning presented in the results display module of this invention are as follows: Figure 4 As shown, taking the first path as an example, it means that the asset node "sensitive_host", i.e., H3 in the example, suffered an attack with ID "7ATTACK7", which is the 8th step of the attack in the example. The attack event with ID "7ATTACK7" used the tactic "T1005", which can be mapped to "CAPEC-117" in the CAPEC type, and this CAPEC type will result in the consequence "READ APPLICATION DATA". This path explains the basis for the inference engine module to determine that the asset "sensitive_host" faces the risk of "READ APPLICATION DATA". By analogy, it can be used to determine the risk of "READ APPLICATION DATA" for the asset node "sensitive_host". Figure 4 All paths within the data are explained. Furthermore, the results display module supports historical log functionality, allowing users to switch dates to view the threats faced by a specific asset at different points in time, along with its rating and the reasoning behind those judgments.

[0109] The technical problem solved by this invention is:

[0110] 1. Intrusion Detection Systems (IDS) detect network attack behavior in real time, but IDS systems generate a large number of threat alerts every day, requiring security experts to analyze whether the alert events are part of a complex network attack.

[0111] 2. The large number of IDS alerts, including false alarms, makes them difficult for security experts to handle, often causing real attacks to go undetected as they are buried in a sea of ​​alerts.

[0112] 3. IDS systems are often designed to detect single network attacks and cannot determine the progress of complex network attacks, nor can they predict the possible consequences of an attack. This information is crucial for system protection and reducing the damage caused by attacks.

[0113] The technical principle of this invention is:

[0114] It receives security alerts from systems such as IDS, structures and stores the alert information in a knowledge graph, uses an inference engine to infer the possible consequences of attacks, and finally displays the possible consequences of complex network attacks and the basis for inference on the administrator review interface for security audit experts to review.

[0115] Compared with the prior art, the present invention has the following beneficial effects:

[0116] 1. This invention constructs an inference engine to receive and filter alarm information from IDS. Even with long-term operation, the amount of data in the graph database will not be too large, eliminating the need for periodic deletion of the graph database. Necessary information can be stored for a sufficiently long time for correlation analysis.

[0117] 2. This invention adopts a modular design, the knowledge graph can be updated as needed, and the reasoning rules and risk thresholds can be set by the user. It is flexible in deployment and suitable for enterprise users.

[0118] Those skilled in the art will understand that, besides implementing the system, apparatus, and their modules provided by this invention in purely computer-readable program code, the same program can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method submodule M. Therefore, the system, apparatus, and their modules provided by this invention can be considered a hardware component, and the modules included therein for implementing various programs can also be considered structures within the hardware component; alternatively, modules for implementing various functions can be considered both software programs implementing the method and structures within the hardware component.

[0119] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A network attack security risk assessment system based on knowledge graphs, characterized in that, include: Cyberspace security knowledge graph module: Input the alarm information obtained from the intrusion detection system into the knowledge graph. The alarm information is generated by the intrusion detection system after detecting a network attack. Inference engine module: Based on preset rules and the knowledge graph, obtain the attack results of the network attack on a specific asset, and send the attack results and the corresponding inference path to the result display module; Results display module: Visualizes the attack results and the inference path; The cyberspace security knowledge graph module includes: Knowledge Subgraph Construction Submodule: Based on the network vulnerability database, network security concepts are used as nodes, and the relationships between these network security concepts are used as edges to construct a knowledge subgraph; Asset Information Subgraph Construction Submodule: Constructs an asset information subgraph based on the asset topology of the system to be deployed and the CVE vulnerabilities contained in each asset. The asset information subgraph is interconnected with the knowledge subgraph. Attack Information Subgraph Construction Submodule: The attack information subgraph contains attack event nodes, which are interconnected with the knowledge subgraph and the asset information subgraph, respectively. The knowledge graph includes the knowledge subgraph, the asset information subgraph, and the attack information subgraph; The construction method of the cyberspace security knowledge graph is as follows: First, based on information from the NVD and MITRE ATT&CK network vulnerability databases, obtain TECHNIQUE nodes, CAPEC nodes, CWE nodes, and IMPACT nodes, as well as the relationships between nodes, and store them in the graph database to construct a knowledge subgraph. Then, obtain the topology of the assets of the system to be deployed, scan for CVE vulnerabilities in each asset, obtain the relationships between CVE nodes and CWE nodes through the network vulnerability database, and store them in the graph database to construct an asset information subgraph. Finally, after deployment, receive alert information from the IDS. If an alert is unique, i.e., the alert type on the corresponding ASSET node is unprecedented, then create an INSTANCE node for the alert in the attack information subgraph, and establish connections between the INSTANCE node and the ASSET and TECHNIQUE nodes based on the alert information. If a similar INSTANCE node exists in the graph database for a certain alert, then update the timestamp information of the similar INSTANCE node without creating a new INSTANCE node.

2. The network attack security risk assessment system based on knowledge graphs according to claim 1, characterized in that, The inference engine module includes: Inference Engine Submodule: Based on the preset rules and the knowledge graph, the module sorts the paths to obtain the attack results caused by the network attack on a specific asset, and sends the attack results and the corresponding inference paths to the result display module.

3. The network attack security risk assessment system based on knowledge graphs according to claim 1, characterized in that, The preset rules include at least one of the following: The first attack sub-result caused by the CVE vulnerability contained in the specific asset itself; The second sub-result of the cyberattack suffered by the specific asset; A third attack sub-result on the specific asset after the CVE vulnerability existing in other assets topologically connected to the specific asset is exploited or the network attack occurs; The attack result is obtained based on the first attack sub-result, the second attack sub-result, and the third attack sub-result.

4. The network attack security risk assessment system based on knowledge graphs according to claim 1, characterized in that, The results display module includes: Results Display Submodule: By selecting a date, you can view the attack results and inference paths at different time points.

5. A network attack security risk assessment method based on knowledge graphs, characterized in that, Including the following steps: Step 1: Input the alarm information obtained from the intrusion detection system into the knowledge graph. The alarm information is generated by the intrusion detection system after detecting a network attack. Step 2: Based on the preset rules and the knowledge graph, obtain the attack results of the network attack on a specific asset; Step 3: Visualize the attack results and reasoning path; Step 1 includes: Step 101: Based on the network vulnerability database, construct a knowledge subgraph by using network security concepts as nodes and the relationships between these concepts as edges. Step 102: Construct an asset information subgraph based on the asset topology of the system to be deployed and the CVE vulnerabilities contained in each asset, wherein the asset information subgraph is interconnected with the knowledge subgraph; Step 103: The attack information subgraph contains attack event nodes, which are interconnected with the knowledge subgraph and the asset information subgraph respectively. The knowledge graph includes the knowledge subgraph, the asset information subgraph and the attack information subgraph. The construction method of the cyberspace security knowledge graph is as follows: First, based on information from the NVD and MITRE ATT&CK network vulnerability databases, obtain TECHNIQUE nodes, CAPEC nodes, CWE nodes, and IMPACT nodes, as well as the relationships between nodes, and store them in the graph database to construct a knowledge subgraph; then, obtain the topology of the assets of the system to be deployed, scan the CVE vulnerabilities contained in each asset, obtain the relationships between CVE nodes and CWE nodes through the network vulnerability database, and store them in the graph database to construct an asset information subgraph; finally, after deployment, receive alarm information from IDS. If an alarm is unique, that is, the alarm type on the ASSET node corresponding to the alarm is unprecedented, then create an INSTANCE node for the alarm in the attack information subgraph, and establish connections between the INSTANCE node, ASSET node, and TECHNIQUE node based on the alarm information; If a certain alarm message already exists in the graph database as a similar INSTANCE node, then update the timestamp information of the similar INSTANCE node instead of creating a new INSTANCE node.

6. The network attack security risk assessment method based on knowledge graphs according to claim 5, characterized in that, Step 101 includes: Step 1011: Obtain the network vulnerability database and parse the data in the network vulnerability database to obtain the network space security concept and the relationship between the network space security concept; Step 1012: Construct the knowledge subgraph by using the cyberspace security concept as nodes and the relationships between the cyberspace security concepts as edges.

7. The network attack security risk assessment method based on knowledge graphs according to claim 5, characterized in that, Step 2 includes: Step 201: Every preset time interval, based on the knowledge graph and the preset rules, use the path sorting algorithm to obtain the attack results and corresponding inference paths caused by network attacks on specific assets.

8. The network attack security risk assessment method based on knowledge graphs according to claim 7, characterized in that, The preset rules include at least one of the following: The first attack sub-result caused by the CVE vulnerability contained in the specific asset itself; The second sub-result of the cyberattack suffered by the specific asset; A third attack sub-result on the specific asset after the CVE vulnerability existing in other assets topologically connected to the specific asset is exploited or the network attack occurs; Step 201 includes: Step 2011: Obtain the attack result based on the first attack sub-result, the second attack sub-result, and the third attack sub-result.

Images