APT attack prediction method based on Bayesian attack graph and factor graph

Abstract

The present invention proposes an APT attack prediction method based on Bayesian attack graph and factor graph, which mainly solves the problem that existing prediction methods have poor universality and poor effect in medium and large networks. The solution includes: 1) collecting vulnerability information, network node configuration information, host interconnection information and attack scenario information under the target network, generating an attack graph and performing loop elimination and other processing on it; 2) using improved Bayesian dynamic reasoning technology to quickly evaluate risk probability; 3) extracting attack paths and marking high-risk paths based on risk probability; 4) extracting APT events, defining factor functions and capturing the relationship between defined variables, and constructing factor graphs; 5) judging the stage of the user based on the joint probability distribution of the factor graph; 6) constructing a decision-making action model based on the user's behavior and the stage they are in, performing preemptive defense, and realizing attack prediction. The present invention can effectively reduce defense costs, improve attack detection efficiency, and has universal applicability.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology and further relates to an attack prediction method, specifically an advanced persistent threat (APT) attack prediction method based on a Bayesian attack graph and a factor graph, which can be used for security situation detection in medium and large networks and early prediction of APT attacks. Background Art

[0002] Advanced persistent threats (APTs) are persistent, effective attacks launched by an organization against a specific target. These attacks are highly covert, targeted, and destructive, and are one of the most serious threats currently facing businesses and governments. These increasingly rampant cyberattacks require proactive prediction and preemptive defense.

[0003] Current methods for detecting and defending against APT attacks still have many shortcomings. Traditional network prediction methods typically collect attacker behavior through logs or attack detection systems. By the time the attacker's key behaviors are captured, the attacker's objectives have often been achieved. Predicting some attack behaviors requires a certain level of prior knowledge, which is prohibitively labor-intensive for long-term attacks like APT attacks. Furthermore, in medium- to large-scale networks, conventional prediction methods are too expensive, and the time and financial costs of defense outweigh the benefits. Existing APT defense methods struggle to defend against all attack vectors. If they do, the cost of defense is too high, making them unsuitable for real-time network defense. Therefore, APT attack prediction technology suitable for real-time network defense has become a hot topic of research for scholars both domestically and internationally.

[0004] In this context, an APT attack prediction method is needed that can automatically predict and preemptively defend against APT attacks without requiring extensive prior knowledge. Currently, relevant research is relatively limited. Some studies have proposed using dynamic game theory to simulate the behavior of both parties, employing an iterative algorithm to calculate a perfect Bayesian Nash equilibrium, and proactively defending against the outcome of the game. However, this method cannot predict the attacker's complete attack path and can only select the optimal strategy for the current stage. Furthermore, while attack graph technology, a popular technique for attack prediction, can achieve visualization, there are currently no good examples combining attack graphs with risk level reasoning. These methods are limited by the cost of inference, making real-time attack prediction prohibitively expensive and difficult to widely apply. Summary of the Invention

[0005] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and propose an attack prediction method based on Bayesian attack graph and factor graph. First, by collecting vulnerability information, network node configuration information, host interconnection information and attack scenario information under the target network, an attack graph is generated to visualize the possible risk nodes under the network; secondly, the risk level of the attack graph is calculated and the high-risk paths therein are extracted, eliminating unnecessary loops, and realizing fast and low-cost high-risk path prediction. Secondly, factor graph technology is used to analyze large-scale logs and attack records to realize the prediction of APT attack stage, and the maliciousness of node behavior is judged in combination with the characteristics of the attacker, helping defenders to prevent attacks more accurately.

[0006] To achieve the above object, the technical solution adopted by the present invention includes the following steps:

[0007] (1) using a vulnerability scanner to obtain an input file, where the input file includes at least vulnerability information of the target network, network node configuration information, host interconnection information, and attack scenario information;

[0008] (2) Generate an attack graph based on the input file, and perform loop elimination, attack graph pruning, and attack path extraction on the attack graph;

[0009] (3) Using the junction tree algorithm in the Bayesian inference algorithm, calculate the risk probability of each node in the attack graph:

[0010] (3.1) Select the attack starting point and set the attacker's initial state, and define the cluster node X according to the connection tree algorithm. s and its adjacent factor nodes f j , and generate a cluster graph;

[0011] (3.2) Based on the generated cluster graph, calculate the messages from all cluster nodes to their adjacent factor nodes, as well as the messages from all factor nodes to cluster nodes. Then, use the messages to calculate the risk probability of the cluster nodes, and further obtain the risk probability of the target node.

[0012] (3.3) Change the structure of the attack graph, cluster the attack graph with pseudo-random structure, change the number of clusters for the attack graph with cluster structure, repeat (3.1)-(3.2) to calculate the risk probabilities of cluster nodes and target nodes again until the inference speed is the fastest, obtain the optimal inference graph structure, and use this structure to calculate the risk probabilities of each node in the attack graph;

[0013] (4) Starting from the attack starting point, traverse all nodes of the attack graph in a depth-first manner, store the attack paths from the leaf nodes to the target node, and calculate the risk probability of each path based on the risk probability of each node obtained in step (3). Compare the probabilities of the attack paths with the same target node, and mark the path with the highest probability as a high-risk path;

[0014] (5) Extract advanced persistent threat (APT) events from events occurring in nodes on high-risk paths; collect sensitive events related to APT, i.e., target attack events;

[0015] (6) With the four variables of user information, events occurring on the user's node, the attack stage the user is in, and the attack node the user is in as input variables, the following four factor functions are defined to capture the relationship between these input variables:

[0016] The first type: APT attack phase s at time t t Events with the user in the current information t The relationship between e (e t ,s t ); if event e t If it occurs, it is considered that APT currently exists in s t This stage;

[0017] The second type: APT attack phase s at time t t With current events t , attack phase s at time t-1 t-1 、Attack event t-1 The relationship between the three s (e t-1 ,s t-1 ,e t ,s t ); if event e t occurs, and an attack event e occurs at time t-1 t-1 , and at time t-1 it is located at s t-1 stage, it is believed that APT currently exists in s t This stage;

[0018] The third type: APT attack phase s at time t t With user attributes U, current event e t The relationship between the two u (U,e t ,s t ); if event e t occurs, and the user has attribute U, then it is considered that APT currently exists in s t This stage;

[0019] The fourth type: APT attack phase s at time t t The attack node Node where the user is located and the current event e t The relationship between the two n (Node,e t,s t ); if event e t If it happens and the user is at the attack node Node, it is considered that the APT currently exists in s t This stage;

[0020] (7) For the APT high-risk path extracted in step (4), at the initial state, the user is at the initial node of the attack path. The attacker's attack events at this time are collected, and event and user information are constructed. At the same time, the factor function at this time is defined according to step (6); as time t increases, the node information, event information, and user information are continuously expanded, and the factor function at the corresponding moment is defined until the attack path traversal is completed and a complete factor graph is constructed;

[0021] (8) Combine all factor functions in the complete factor graph into a set F = {F e ,F s ,F u ,F n}, where F e 、F s 、F u 、F n They represent the factor graph f e (e t ,s t ),f s (e t-1 ,s t-1 ,e t ,s t ),f u (U,e t ,s t ) and f n (Node,e t ,s t ) set; let the input of each factor function be X={e t ,U,Node}、Y={S t}, output 1 when X and Y meet the correlation relationship, otherwise output 0; obtain the joint probability distribution of the factor graph and determine the stage the user is in;

[0022] (9) Based on the user’s behavior and stage, the following decision-making action model is constructed:

[0023] (9.1) Define four decision actions, a1-a4: a1 represents the event being considered as correct user behavior, and the system does not take any action; a2 represents the event being considered as suspicious user behavior, and the system assigns a special mark and continuously observes it; a3 represents the event being considered as suspected malicious user behavior, and the system reports it to the administrator, taking action based on the administrator's advice; a4 represents the event being considered as a malicious attack, and the system preemptively terminates the malicious user's related actions;

[0024] (9.2) The events in each attack phase are assigned different weights to represent the decision recommendations taken by the system;

[0025] (10) Use decision-making action models to conduct preemptive defense before malicious behavior occurs and achieve attack prediction.

[0026] Compared with the prior art, the present invention has the following advantages:

[0027] First, the present invention adopts a dynamic structure recognition algorithm. By clustering attack graphs with pseudo-random structures or few-cluster structures, the number of clusters is reduced for attack graphs with multiple clusters, so that the connection tree algorithm can always maintain a good inference rate, making the network risk probability assessment universal for any attack graph and more effective.

[0028] Second, this invention extracts high-risk paths and eliminates loops. By clustering, comparing, and labeling attack paths with the same attack target, it eliminates unrealistic and unnecessary attack paths. This not only makes the overall attack graph more reasonable, but also allows network security defenders without prior knowledge to easily identify high-risk paths and implement timely defenses. For loop elimination, a minimum probability elimination method is proposed to maintain consistent results while minimizing the impact of node deletion.

[0029] Third, by combining high-risk paths with stage division, the present invention only focuses on events and related log information occurring on high-risk paths, effectively reducing defense costs. In addition, through stage division, it is possible to more clearly identify the stage an attacker may be in, and to implement detailed stage-by-stage defense actions based on the decision-making model, effectively reducing the probability of over-defense and under-defense.

[0030] Fourth, the present invention uses multi-indicator evaluation for risk probability scoring and factor function calculation, which is not only more accurate but also highly scalable. The model can be improved by adding indicators, changing indicators, and other operations, and personalized models that best suit the target system can be customized. The extremely high scalability improves the accuracy of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 Flowchart for realizing the method of the present invention;

[0032] Figure 2 This is a flow chart of the algorithm of the minimum probability elimination method of the present invention;

[0033] Figure 3 Example of a cluster graph generated for the junction tree algorithm;

[0034] Figure 4 Schematic diagram of a factor graph generated by a factor function in the present invention;

[0035] Figure 5 This is a graph showing how the inference time of static analysis in the dynamic inference algorithm changes with the attack graph structure;

[0036] Figure 6 This is a curve chart showing how the inference time of dynamic analysis in the dynamic inference algorithm changes with the attack graph structure.

[0037] Specific implementation method

[0038] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0039] Example 1: Reference Figure 1 The present invention proposes an APT attack prediction method based on Bayesian attack graph and factor graph, which specifically includes the following steps:

[0040] Step 1: Use a vulnerability scanner to obtain an input file, which includes at least vulnerability information, network node configuration information, host interconnection information, and attack scenario information under the target network; the vulnerability scanner includes Nessus, OVAL, etc.

[0041] Step 2. Generate an attack graph based on the input file and perform loop elimination, attack graph pruning, and attack path extraction on the attack graph. This is done by comparing the input file with the National Vulnerability Database (NVD) to obtain vulnerability information, scoring it using the Common Vulnerability Scoring System (CVSS), and using a network vulnerability scan report to generate the attack graph using an attack graph generation tool.

[0042] Use the attack graph generation tool Mulval to generate the attack graph and eliminate the loop in the attack graph. The main idea is to use depth-first traversal to find the loop and delete the node with the lowest attack probability, which is usually the node that the attacker is least willing to attack. This process refers to Figure 2 , the algorithm flow chart of the minimum probability elimination method in the present invention;

[0043] The specific method is as follows: First, for an attack graph containing a loop, the leaf nodes of the attack graph are input into an array of root nodes. These root nodes usually represent the starting points of the attacker. Then, a stack is initialized to store the loops in a depth-first traversal. Then, a depth-first traversal is performed from a leaf node, and the child nodes visited are pushed onto the stack and marked. If a marked node appears during the downward traversal, it indicates that there is a loop in the attack graph. The node stored in the stack at this time is the node in the loop. The minimum probability node elimination method is adopted to eliminate the loop. Bayesian probabilistic inference is performed on the nodes currently stored in the stack to calculate the node probability. The node with the smallest probability value is found and eliminated. This node is usually the node that the attacker is least willing to attack. This node and its outgoing and incoming edges are deleted, and the parent node of the deleted node is connected to the child nodes to complete the loop elimination. If the child node does not exist during the downward traversal of the depth-first traversal but the stack is not empty, the node is backtracked, the node is popped off the stack, and the unvisited child nodes are revisited and the depth-first traversal process is repeated. When the backtracking stack is empty, it means that all attack paths starting from this node have been traversed, and the above process is repeated from other leaf nodes until all attack paths are visited.

[0044] Step 3. Use the junction tree algorithm in the Bayesian inference algorithm to calculate the risk probability of each node in the attack graph:

[0045] (3.1) Select the attack starting point and set the attacker's initial state, and define the cluster node X according to the connection tree algorithm. s and its adjacent factor nodes f j , and generate a cluster graph;

[0046] (3.2) Based on the generated cluster graph, calculate the messages from all cluster nodes to their adjacent factor nodes, and all factor nodes to cluster nodes. Then, use the messages to calculate the risk probability of the cluster nodes, and further obtain the risk probability of the target node. The risk probability of the cluster nodes is calculated according to the following steps:

[0047] (3.2.1) According to the following formula, we can calculate the value of the node X from any cluster node X. s To a factor node f adjacent to it j News

[0048]

[0049] Among them, F s 'Indicates cluster node X s All adjacent neighbor nodes, f k Indicates F s 'Except fj Other neighbor factor nodes other than ;

[0050] (3.2.2) Calculate any factor node f according to the following formula i To a cluster node X adjacent to it j News

[0051]

[0052] Among them, X n Indicates the removal of cluster node X j Other than i Other neighbor cluster nodes, X k Represents X n Any cluster of nodes in Represents X k to f j Message, and when X k When it is a leaf node, the message is 1;

[0053] (3.2.3) Calculate the target cluster node X according to the following formula tar Risk probability:

[0054]

[0055] Among them, F sn Indicates the target cluster node X tar All neighbor factor nodes of .

[0056] (3.3) Change the structure of the attack graph, cluster the attack graph with pseudo-random structure, change the number of clusters for the attack graph with cluster structure, repeat (3.1)-(3.2) to calculate the risk probability of cluster nodes and target nodes again until the inference speed is the fastest, obtain the optimal inference graph structure, and use this structure to calculate the risk probability of each node in the attack graph.

[0057] The attack graph with cluster structure changes the number of clusters, specifically by merging clusters to reduce the number of clusters of the attack graph with more than a preset number, and by clustering the attack graph with only two clusters to increase the number of clusters.

[0058] Step 4. Starting from the attack starting point, perform a depth-first traversal of all nodes in the attack graph, store the attack paths from the leaf nodes to the target node, and calculate the risk probability of each path based on the risk probability of each node obtained in step (3). Compare the probabilities of the attack paths to the same target node, and mark the path with the highest probability as a high-risk path.

[0059] The risk probability of each path is calculated based on the risk probability of each node obtained in step (3), specifically: starting from each leaf node, depth-first traversal is performed downward to visit the child nodes. If a target node appears during the downward visit, it is the target attack path, and the risk probability of the target node calculated in step (3) is used as the risk path of the target attack path.

[0060] In the extraction and marking of high-risk paths, high-risk paths are extracted through a depth-first traversal, which must be performed after loop elimination. The specific algorithm steps are: first input the attack graph after loop elimination, leaf nodes, and target nodes. The attack graph is the graph to be searched, and the leaf nodes and target nodes correspond to the starting and ending points of the attack path, respectively. Then, a stack is initialized to store the attack paths through a depth-first traversal. Next, a depth-first traversal is performed from a leaf node, visiting child nodes downwards, pushing the visited child nodes onto the stack until there are no more child nodes. At this point, the top element of the stack is checked to see if it is an attack target. If not, the stack is popped and backtracked, retraversing the child nodes until the top element of the stack is found to be an attack target. The node stored in the stack at this time is a node on the attack path, and the entire node element constitutes the attack path. Repeating this step stores all attack paths. Then, among the paths that have the same attack target, the path with the highest probability of success is found and marked as a high-risk path. This path is the path that defenders need to focus on in the future.

[0061] Step 5. Extract advanced persistent threat (APT) events from events occurring at nodes on high-risk paths; collect sensitive events related to APT, i.e., target attack events;

[0062] Based on previous work, we've identified the most likely attack paths taken by attackers. Therefore, we only need to focus on events occurring at all nodes along these high-risk paths to reduce workload and improve prediction accuracy. In this framework, the target of event collection is sensitive events related to APTs, specifically the methods commonly employed by APT attackers. The classification criteria can be based on APT-related behaviors as defined by MITRE.

[0063] Step 6. Using the four variables of user profile, events occurring on the user's node, the user's attack stage, and the user's attack node as input variables, define the following four factor functions to capture the relationship between these input variables:

[0064] The first type: APT attack phase s at time t t Events with the user in the current information t The relationship between e (e t ,s t ); if event e tIf it occurs, it is considered that APT currently exists in s t This stage;

[0065] The second type: APT attack phase s at time t t With current events t , attack phase s at time t-1 t-1 、Attack event t-1 The relationship between the three s (e t-1 ,s t-1 ,e t ,s t ); if event e t occurs, and an attack event e occurs at time t-1 t-1 , and at time t-1 it is located at s t-1 stage, it is believed that APT currently exists in s t This stage;

[0066] The third type: APT attack phase s at time t t With user attributes U, current event e t The relationship between the two u (U,e t ,s t ); if event e t occurs, and the user has attribute U, then it is considered that APT currently exists in s t This stage;

[0067] The fourth type: APT attack phase s at time t t The attack node Node where the user is located and the current event e t The relationship between the two n (Node,e t ,s t ); if event e t If it happens and the user is at the attack node Node, it is considered that the APT currently exists in s t This stage;

[0068] Step 7. For the APT high-risk path extracted in step (4), at the initial state, the user is at the initial node of the attack path. The attacker's attack events at this time are collected, and event and user information are constructed. At the same time, the factor function at this time is defined according to step (6); as time t increases, the node information, event information, and user information are continuously expanded, and the factor function at the corresponding moment is defined until the attack path traversal is completed and a complete factor graph is constructed.

[0069] For each APT high-risk path that needs to be predicted, collect the events performed by a user on the path, and build a factor graph with the user's information and the defined factor function over time. The factor graph refers to Figure 4 When the user is at the initial node of the attack path, events related to the attacker's permission are collected. The initial stage usually relies on the node factor and event factor at this moment. As time goes by and more evidence is observed, stage evidence and past events in the past stage will also be taken into account to increase the accuracy of the prediction.

[0070] Step 8. Combine all factor functions in the complete factor graph into a set F = {F e ,F s ,F u ,F n}, where F e 、F s 、F u 、F n They represent the factor graph f e (e t ,s t ),f s (e t-1 ,s t-1 ,e t ,s t ),f u (U,e t ,s t ) and f n (Node,e t ,s t ) set; let the input of each factor function be X={e t ,U,Node}、Y={S t}, output 1 when X and Y meet the correlation relationship, otherwise output 0; get the joint probability distribution of the factor graph and judge the stage of the user.

[0071] Based on the joint probability distribution of factor graphs, the user's stage is judged according to the probability of the stage factors of the three types of factor functions probability reasoning: events, users, and nodes. The user's stage specifically includes: scanning and detection stage, tool delivery stage, vulnerability exploitation stage, Trojan implantation stage, remote control stage, lateral penetration stage, and target action stage.

[0072] The joint probability density P(E t ,S t ,U,N), the expression is as follows:

[0073]

[0074] The conditional probability density can be decomposed into the following formula:

[0075]

[0076] Among them, Z represents the normalization factor, which is used to ensure the correctness of the joint probability density; Π represents the cumulative multiplication symbol.

[0077] Step 9. Based on the user's behavior and stage, build the following decision-making action model:

[0078] (9.1) Define four decision actions, a1-a4: a1 represents the event being considered as correct user behavior, and the system does not take any action; a2 represents the event being considered as suspicious user behavior, and the system assigns a special mark and continuously observes it; a3 represents the event being considered as suspected malicious user behavior, and the system reports it to the administrator, taking action based on the administrator's advice; a4 represents the event being considered as a malicious attack, and the system preemptively terminates the malicious user's related actions;

[0079] (9.2) The events in each attack phase are assigned different weights to represent the decision recommendations taken by the system;

[0080] Step 10. Use the decision-action model to conduct preemptive defense before malicious behavior occurs and achieve attack prediction.

[0081] Example 2: Reference Figure 3 The APT attack prediction method proposed in this embodiment has the same overall implementation steps as in the first embodiment. Here, we will further describe how to use the junction tree algorithm in the Bayesian inference algorithm to calculate the risk probability of each node in the attack graph:

[0082] This paper uses Bayesian inference technology to calculate the risk probability of each node and accelerates inference using the junction tree algorithm within the Bayesian inference algorithm. The same inference algorithm can exhibit significant performance differences under different attack graph structures. Therefore, this paper proposes a dynamic structure recognition algorithm to accelerate inference speed and reduce memory requirements.

[0083] 3.1) Select the attack starting point and set the attacker's initial state. The attack starting point can be considered a leaf node in the attack graph. The attacker's initial state is the attacker's authority at the attack starting point. During the Bayesian reasoning process, the starting point can be set to 1, indicating that the attacker has full authority to attack the starting point.

[0084] Define cluster node X according to the junction tree algorithm s and factor node f j , and generate a cluster diagram, refer to Figure 3 . Factor node f jIt refers to the grouping of marginal probabilities involving the same variables during joint probabilistic reasoning. A cluster node refers to the shared variables between two factor nodes that satisfy the transformation relationship.

[0085] The process of building a cluster graph begins by creating factor nodes and establishing edges between factors that satisfy the transformation relationship. Cluster nodes are then added to the graph, and the shared variables between the two factors are added to the cluster nodes. The established cluster graph is then simplified by first removing redundant factor nodes (i.e., factors whose variables already appear in their adjacent factors). Cluster nodes are then updated according to the previous rules, and cluster nodes are added at both ends, provided that the factors at both ends have more variables than the adjacent cluster nodes.

[0086] 3.2) Compute the message from cluster variables to factors Factor messages to cluster nodes The unconditional probability of cluster nodes is obtained by using message calculation. s Passed to factor f j The message is defined as:

[0087]

[0088] where f k Represents X i Except f j Other neighbor factor nodes other than factor f i Passed to the variable cluster X j The message is defined as:

[0089]

[0090] Among them, X s is f i In addition to the cluster variable X j Other neighbor variable nodes other than the variable node, when the variable node X i When it is a leaf node, the message is 1, the unconditional probability calculation formula of the cluster node is:

[0091]

[0092] Among them F s is cluster node X s The sum of the joint probabilities of the cluster nodes is the marginal probability density of a node in the cluster.

[0093] 3.3) Change the structure of the attack graph and repeat (3.1)-(3.2) to cluster the attack graph with pseudo-random structure. For attack graphs with too many clusters, reduce the number of clusters to speed up the inference rate.

[0094] The static analysis of the connection tree algorithm is divided into three steps. The first step is to build a cluster tree, which can be specifically divided into two small parts: finding the elimination order and building the tree. The second step is to calculate all messages, and finally the calculation of unconditional probabilities. Dynamic analysis does not require rebuilding the cluster tree. Through analysis, we verified that the heuristic algorithm for finding the elimination order and the message calculation process are both exponentially complex and occupy the main influence of the entire reasoning time, which are set as T1 and T3 respectively. The time for building the group tree and calculating the unconditional probability can be regarded as linear time and occupy a smaller influence, which are set as T2 and T4 respectively. Let the total time consumption be T jt , then we reach the following conclusion: T jt =T1+T2+T3+T4,T1=ae x1 +b, T2=cx2+d, T4=kx4+h.

[0095] x1 and x2 are related to the number of clusters. The more clusters there are, the larger x1 and x2 will be. x3 is the maximum number of factors, and x4 is related to the number of messages. The time required for static analysis is:

[0096] T static =T1+T2+T3+T4

[0097] The time required for dynamic analysis is:

[0098] T Dynamic =T3+T4

[0099] In a pseudo-random structure, due to the large number of summary points, the number of x3 is large and exponential, so T3 is large and dominates, leading to exponential growth in both static and dynamic analysis. In a cluster structure, while the number of summary points remains constant, increasing the number of clusters decreases the number of nodes within each cluster, resulting in a decrease in the maximum number of factors. Due to the unique properties of cluster structures, the maximum number of factors increases slowly with the number of nodes in the graph. Therefore, T3 is small and barely increases, while T4 is linear. This results in a linear increase in dynamic analysis time for cluster structures, which is generally short. However, while the number of summary points remains constant, increasing the number of clusters increases x1 and x2. At this point, T1 and T2, which previously had a minor influence, become the dominant factors, leading to an exponential increase in static analysis time for cluster structures. However, the underlying causes of this exponential growth are completely different from those for pseudo-random structures. Therefore, in general, increasing the number of clusters increases T1 and T2, while decreasing T3 and T4, leading to a decrease in overall analysis time followed by an increase. Therefore, during inference, we can increase the number of clusters in the attack graph with a pseudo-random structure or a cluster structure with a small number of clusters. The specific method is to classify the hosts under the same subnet into one cluster, or use some clustering algorithms to classify the hosts into clusters, so as to speed up the inference speed.

[0100] Example 3: The APT attack prediction method proposed in this example has the same overall implementation steps as Example 1. The following specifically describes the implementation method of defining a decision-action model, determining decision-actions based on the attacker's behavior and the stage they are in, and performing preemptive defense in a timely manner before malicious behavior occurs:

[0101] This embodiment first defines four decision-making behaviors: Action 1, normal user behavior, the system does not perform any action; Action 2, suspicious user behavior, the system gives a special mark and continuously observes; Action 3, suspected malicious user behavior, the system reports to the administrator and takes action based on the administrator's advice; Action 4, malicious attack behavior, the system preemptively terminates all behaviors related to the malicious user.

[0102] Different decision actions can be defined for behaviors at different stages. The definition of this part of the present invention is open, and decision actions with different response levels can be defined based on the division of stages and the specific security requirements of the system.

[0103] For behaviors on high-risk paths, this embodiment establishes the following criteria: For benign behaviors like Action 1 and clearly malicious behaviors like Action 4, we maintain the original decision actions, as taking additional actions for all benign behaviors would restrict the normal behavior of a large number of ordinary users. However, for the remaining criteria, we increase the risk level of the decision on high-risk paths. This approach is scalable and can increase the accuracy of decision actions and success by enriching decision behaviors, but the decision selection process also requires greater complexity.

[0104] The following is a further explanation of the technical effects of the present invention in conjunction with the simulation results:

[0105] 1. Simulation conditions:

[0106] The simulation experiment of the present invention was carried out in a hardware environment with a CPU main frequency of 3 GHz, a memory of 32 GB, Windows 11, and a Python and Matlab software environment.

[0107] 2. Simulation content:

[0108] The dynamic structure recognition algorithm of the present invention is simulated to compare the effect of changing the number of clusters in the attack graph on the inference time. The results are as follows: Figure 5 、 Figure 6 As shown;

[0109] 3. Analysis of experimental results:

[0110] The results of the experiment are as follows Figure 5 、 Figure 6 As shown. In the attack graph of 100 summary points, taking the static analysis experiment as an example, when the number of clusters is 1, it is a pseudo-random structure. At this time, the overall time complexity is exponentially related to the range of the maximum factor. At this time, T3 occupies the main time influencing factor, making the overall time consumption here 2.73s. When the number of clusters is increased, the result of the attack graph is transformed into a cluster structure. At this time, the maximum factor range is reduced, and the time consumption is exponentially reduced, resulting in a very small time consumption caused by T3. The main time consumption at this time is the time consumption T1 and T2 for establishing the group tree. When the number of clusters is small, the time consumed for tree construction is not large. Therefore, when the number of clusters is between 2 and 14, the overall time consumption is small. When the number of clusters continues to increase, the time T1 for finding the elimination order increases due to the exponential growth, and the total time continues to grow exponentially. The results of dynamic analysis are similar to those of static analysis, except that the curve is more stable and the time consumption is lower when the cluster structure and the number of nodes are not high. This is because in addition to the time change caused by the cluster structure, dynamic analysis will further accelerate time saving. Figure 6 This rule can be found in , so the time consumption here will be further deepened, resulting in a lower and smoother curve.

[0111] The above simulation analysis proves the correctness and effectiveness of the method proposed in the present invention.

[0112] Parts of the present invention that are not described in detail belong to common knowledge among those skilled in the art.

[0113] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Obviously, for professionals in this field, after understanding the content and principles of the present invention, they may make various modifications and changes in form and details without departing from the principles and structure of the present invention. However, these modifications and changes based on the ideas of the present invention are still within the scope of protection of the claims of the present invention.

Claims

1. A method for predicting APT attacks based on Bayesian attack graph and factor graph, characterized in that: The steps include: (1) using a vulnerability scanner to obtain an input file, where the input file includes at least vulnerability information of the target network, network node configuration information, host interconnection information, and attack scenario information; (2) Generate an attack graph based on the input file, and perform loop elimination, attack graph pruning, and attack path extraction on the attack graph; (3) Using the junction tree algorithm in the Bayesian inference algorithm, calculate the risk probability of each node in the attack graph: (3.1) Select the attack starting point and set the attacker's initial state, and define the cluster node X according to the connection tree algorithm. s and its adjacent factor nodes f j , and generate a cluster graph; (3.2) Based on the generated cluster graph, calculate the messages from all cluster nodes to their adjacent factor nodes, as well as the messages from all factor nodes to cluster nodes. Then, use the messages to calculate the risk probability of the cluster nodes, and further obtain the risk probability of the target node. (3.3) Change the structure of the attack graph, cluster the attack graph with pseudo-random structure, change the number of clusters for the attack graph with cluster structure, repeat (3.1)-(3.2) to calculate the risk probabilities of cluster nodes and target nodes again until the inference speed is the fastest, obtain the optimal inference graph structure, and use this structure to calculate the risk probabilities of each node in the attack graph; (4) Starting from the attack starting point, traverse all nodes of the attack graph in a depth-first manner, store the attack paths from the leaf nodes to the target node, and calculate the risk probability of each path based on the risk probability of each node obtained in step (3). Compare the probabilities of the attack paths with the same target node, and mark the path with the highest probability as a high-risk path; (5) Extract advanced persistent threat (APT) events from events occurring in nodes on high-risk paths; collect sensitive events related to APT, i.e., target attack events; (6) With the four variables of user information, events occurring on the user's node, the attack stage the user is in, and the attack node the user is in as input variables, the following four factor functions are defined to capture the relationship between these input variables: The first type: APT attack phase s at time t t Events with the user in the current information t The relationship between e (e t ,s t ); if event e t If it occurs, it is considered that APT currently exists in s t This stage; The second type: APT attack phase s at time t t With current events t , attack phase s at time t-1 t-1 、Attack event t-1 The relationship between the three s (e t-1 ,s t-1 ,e t ,s t ); if event e t occurs, and an attack event e occurs at time t-1 t-1 , and at time t-1 it is located at s t-1 stage, it is believed that APT currently exists in s t This stage; The third type: APT attack phase s at time t t With user attributes U, current event e t The relationship between the two u (U,e t ,s t ); if event e t occurs, and the user has attribute U, then it is considered that APT currently exists in s t This stage; The fourth type: APT attack phase s at time t t The attack node Node where the user is located and the current event e t The relationship between the two n (Node,e t ,s t ); if event e t If it happens and the user is at the attack node Node, it is considered that the APT currently exists in s t This stage; (7) For the APT high-risk path extracted in step (4), at the initial state, the user is at the initial node of the attack path. The attacker's attack events at this time are collected, and event and user information are constructed. At the same time, the factor function at this time is defined according to step (6); as time t increases, the node information, event information, and user information are continuously expanded, and the factor function at the corresponding moment is defined until the attack path traversal is completed and a complete factor graph is constructed; (8) Combine all factor functions in the complete factor graph into a set F = {F e ,F s ,F u ,F n }, where F e 、F s 、F u 、F n They represent the factor graph f e (e t ,s t ),f s (e t-1 ,s t-1 ,e t ,s t ),f u (U,e t ,s t ) and f n (Node,e t ,s t ) set; let the input of each factor function be X={e t ,U,Node}、Y={s t }, output 1 when X and Y meet the correlation relationship, otherwise output 0; obtain the joint probability distribution of the factor graph and determine the stage the user is in; (9) Based on the user’s behavior and stage, the following decision-making action model is constructed: (9.1) Define four decision actions, a1-a4: a1 represents the event being considered as correct user behavior, and the system does not take any action; a2 represents the event being considered as suspicious user behavior, and the system assigns a special mark and continuously observes it; a3 represents the event being considered as suspected malicious user behavior, and the system reports it to the administrator, taking action based on the administrator's advice; a4 represents the event being considered as a malicious attack, and the system preemptively terminates the malicious user's related actions; (9.2) The events in each attack phase are assigned different weights to represent the decision recommendations taken by the system; (10) Use decision-making action models to conduct preemptive defense before malicious behavior occurs and achieve attack prediction.

2. The method according to claim 1, wherein: The vulnerability scanners in step (1) include Nessus and OVAL.

3. The method according to claim 1, wherein: The attack graph is generated according to the input file in step (2) by comparing the input file with the National Vulnerability Database (NVD) to obtain vulnerability-related information, scoring it using the Common Vulnerability Scoring System (CVSS), and using the network vulnerability scan report to generate the attack graph using an attack graph generation tool.

4. The method according to claim 1, wherein: Step (2) of the present invention is to eliminate loops, prune the attack graph, and extract attack paths from the attack graph. Specifically, for an attack graph containing a loop, the leaf nodes of the attack graph are input into the array of the root node, and then a stack is initialized to store the loops in a depth-first traversal. Then, a depth-first traversal is performed from a leaf node, and the child nodes are visited downward, and the visited child nodes are pushed onto the stack and marked. If a marked node appears during the downward visit, it proves that a loop appears in the attack graph. At this time, the nodes stored in the stack are the nodes in the loop, and the minimum probability node elimination method is adopted to eliminate the loop. Specifically, the nodes currently stored in the stack are pushed onto the stack and marked. The stored nodes perform Bayesian probability reasoning to calculate the probability of the nodes, and find the node with the smallest probability value to eliminate, that is, delete this node and its corresponding outgoing and incoming edges, connect the parent node and child nodes of the deleted node, and complete the elimination of the loop; if the child node does not exist but the stack is not empty during the downward visit of the depth-first traversal, backtracking is performed, the node in the stack is popped out, and the unvisited child nodes are visited again to repeat the depth-first traversal process; when the stack is empty after backtracking, it means that all attack paths have been traversed, and the above process is repeated from other leaf nodes until all attack paths are visited, thereby realizing the processing of the attack graph.

5. The method according to claim 1, wherein: The risk probability of the cluster nodes in step (3.2) is calculated according to the following steps: (3.2.1) According to the following formula, we can calculate the value of the node X from any cluster node X. s To a factor node f adjacent to it j News Among them, F s 'Indicates cluster node X s All adjacent neighbor nodes, f k Indicates F s 'Except f j Other neighbor factor nodes other than ; (3.2.2) Calculate any factor node f according to the following formula i To a cluster node X adjacent to it j News Among them, X n Indicates the removal of cluster node X j Other than i Other neighbor cluster nodes, X k Represents X n Any cluster of nodes in Represents X k to f j Message, and when X k When it is a leaf node, the message is 1; (3.2.3) Calculate the target cluster node X according to the following formula tar Risk probability: Among them, F sn Indicates the target cluster node X tar All neighbor factor nodes of .

6. The method according to claim 1, wherein: The attack graph with cluster structure described in step (3.3) changes the number of clusters. Specifically, the attack graph with more clusters than the preset number is reduced by merging clusters, and the attack graph with only two clusters is increased by clustering.

7. The method according to claim 1, wherein: The risk probability of each path is calculated according to the risk probability of each node obtained in step (3) in step (4). Specifically, a depth-first traversal is performed starting from each leaf node, and the child nodes are visited downward. If a target node appears during the downward visit, it is the target attack path, and the risk probability of the target node calculated in step (3) is used as the risk path of the target attack path.

8. The method according to claim 1, wherein: The determination of the user's stage in step (8) is based on the joint probability distribution of the factor graph. The probability of the stage factor is obtained according to the following formula to determine the user's stage: Where Z represents the normalization factor; π represents the multiplication symbol.

9. The method according to claim 8, characterized in that: The stages that the user is in include the scanning and detection stage, the tool delivery stage, the vulnerability exploitation stage, the Trojan horse implantation stage, the remote control stage, the lateral penetration stage, and the target action stage.

Images