Model training method, evaluation method, device, apparatus and medium

Abstract

This application provides a model training method, evaluation method, apparatus, device, and medium. The method determines the attack and defense data in a network testbed, as well as the initial benefit sample labels for each attack and defense data point. From the initial benefit sample labels, it determines the target benefit sample labels and the positive and negative sample data corresponding to the target benefit sample labels in the attack and defense data. Based on the target benefit sample labels and the positive and negative sample data, it trains a decision tree to obtain a target decision tree. Based on the target decision tree, it obtains a network testbed attack impact assessment model. It then acquires the current attack and defense data in the network testbed and inputs this data into the network testbed attack impact assessment model to obtain the benefit assessment result. This application uses benefit type as a quantitative indicator and employs a decision tree to evaluate the benefit results, making the evaluation process traceable and interpretable, thus improving the accuracy and reliability of the evaluation results.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a model training method, evaluation method, apparatus, device, and medium. Background Technology

[0002] With the rapid development and widespread application of the internet, cybersecurity has become a crucial issue. To effectively counter increasingly sophisticated cyberattacks, cyber ranges have become a widely adopted tool for training and evaluating security defense capabilities. A cyber range provides a platform that simulates a real-world network environment, allowing security professionals to conduct attack and defense experiments in a secure and controlled setting.

[0003] However, assessing the benefits and impact of attacks is a critical task when conducting attack and defense experiments in cyber ranges. Traditional assessment methods often rely on human experience and subjective judgment, which suffers from high subjectivity and a lack of quantitative indicators, thus limiting the accuracy and reliability of the assessment results. Summary of the Invention

[0004] This application provides a training and evaluation method and apparatus for assessing the impact of network range attacks, in order to solve the problems of strong subjectivity and lack of quantitative indicators in the prior art.

[0005] Firstly, this application provides a method for training a network range attack impact assessment model, including:

[0006] Determine the attack and defense data in the network range, as well as the initial benefit sample labels for each attack and defense data. The attack and defense data includes attack vector data, attack payload, attack traffic, vulnerability exploitation data, attack indicators, defense tool logs, security policies and configuration information, and response policies.

[0007] Determine the target benefit sample label from the initial benefit sample label, as well as the positive and negative sample data corresponding to the target benefit sample label in the attack and defense data. The target benefit sample label includes any one of the following benefit type data: denial-of-service type data, data leakage type data, remote code execution type data, identity theft type data, data tampering type data, access control bypass type data, service abuse type data, process injection type data, virtual asset loss type data, and privacy violation type data.

[0008] The decision tree is trained based on the target return sample labels and positive and negative sample data to obtain the target decision tree;

[0009] Based on the target decision tree, a network range attack impact assessment model is obtained.

[0010] In this application, a decision tree is trained based on the target return sample labels and positive and negative sample data to obtain a target decision tree, including:

[0011] Determine the feature values ​​of the target type feature in positive and negative sample data;

[0012] Training samples are obtained based on the target profit sample labels and feature values;

[0013] Based on the training samples, the information gain ratio of the target type features is obtained;

[0014] The position of the target type feature in the decision tree is determined based on the information gain ratio of the target type feature.

[0015] The target decision tree is determined based on the target type features and their positions in the decision tree.

[0016] In this application, the information gain ratio of the target type feature is obtained based on the training samples, including:

[0017] Based on the training samples, the target information gain of the target type features is obtained;

[0018] Based on the training samples, target splitting information of target type features is obtained;

[0019] The target information gain ratio is obtained by the ratio of target information gain to target split information.

[0020] In this application, the target information gain of the target type feature is obtained based on the training samples, including:

[0021] The information gain formula is determined as follows:

[0022] Information_gain(X,A i )=H(A i )-H(A i |X);

[0023] Among them, Information_gain(X,A) i Let A be the information gain, X be the target type feature, and A be the information gain. i For the sample corresponding to the label of the i-th target return sample, H(A) i ) is A i Information entropy, H(A) i |X) represents the partition of A by X. i Information entropy afterward;

[0024] The target information gain is obtained based on the training samples and the information gain formula.

[0025] In this application, target splitting information of target type features is obtained based on training samples, including:

[0026] The formula for determining the splitting information is as follows:

[0027]

[0028] Wherein, S(X,A) i ) represents the splitting information, X represents the target type feature, X k Let m be the k-th value of the target type feature X, and m be the total number of values ​​of the target type feature X.

[0029] Based on the training samples and the splitting information formula, the target splitting information is obtained.

[0030] In this application, when there are two or more types of target return sample labels, the method further includes:

[0031] Determine the first training data and the second training data, wherein both the first training data and the second training data include positive and negative sample data and target benefit sample labels, and the target benefit sample labels in the first training data and the target benefit sample labels in the second training data are different.

[0032] Based on the target profit sample labels and positive and negative sample data in the first training data, the first initial decision tree is trained to obtain the first decision tree;

[0033] The second initial decision tree is trained based on the target benefit sample labels and positive and negative sample data in the second training data to obtain the second decision tree;

[0034] Based on the first and second initial decision trees, a network range attack impact assessment model is obtained.

[0035] Secondly, this application provides a method for assessing the impact of cyber range attacks, including:

[0036] Obtain current attack and defense data in the network target range;

[0037] The current attack and defense data are input into the network range attack impact assessment model to obtain the benefit assessment result. The network range attack impact assessment model is obtained according to the network range attack impact assessment model training method provided in this application.

[0038] In this application, current attack and defense data are input into a network range attack impact assessment model to obtain benefit assessment results, including:

[0039] Determine the current feature value of the target type feature in the current attack and defense data;

[0040] Input the current feature value of the target type feature in the current attack and defense data into the network range attack impact assessment model to obtain the initial benefit assessment result;

[0041] Based on the benefit type of the target benefit sample label represented by the first decision tree and the benefit type of the target benefit sample label represented by the second decision tree in the network range attack impact assessment model, the initial benefit assessment results are vector-labeled to obtain vector assessment results.

[0042] Thirdly, this application provides a device for evaluating the gains of cyber range attacks, comprising:

[0043] The first determination module is used to determine the attack and defense data in the network test range, as well as the initial benefit sample labels of each attack and defense data. The attack and defense data includes attack vector data, attack payload, attack traffic, vulnerability exploitation data, attack indicators, defense tool logs, security policies and configuration information, and response policies.

[0044] The second determining module is used to determine the target benefit sample label from the initial benefit sample label, as well as the positive and negative sample data corresponding to the target benefit sample label in the attack and defense data. The target benefit sample label includes any one of the following benefit type data: denial-of-service type data, data leakage type data, remote code execution type data, identity theft type data, data tampering type data, access control bypass type data, service abuse type data, process injection type data, virtual asset loss type data, and privacy violation type data.

[0045] The training module is used to train the decision tree based on the target benefit sample labels and positive and negative sample data to obtain the target decision tree;

[0046] The module is used to obtain a network range attack impact assessment model based on the target decision tree.

[0047] Fourthly, this application provides a device for assessing the impact of cyber range attacks, comprising:

[0048] The acquisition module is used to acquire current attack and defense data in the network test range;

[0049] The evaluation module is used to input the current attack and defense data into the network range attack impact evaluation model to obtain the benefit evaluation result. The network range attack impact evaluation model is obtained according to the network range attack impact evaluation model training method provided in this application.

[0050] Fifthly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0051] The memory stores the instructions that the computer executes;

[0052] The processor executes computer execution instructions stored in memory to implement the method of this application.

[0053] In a sixth aspect, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method of this application.

[0054] This application provides a model training method, evaluation method, apparatus, device, and medium. The method determines attack and defense data in a network testbed, as well as initial benefit sample labels for each attack and defense data point. The attack and defense data includes attack vector data, attack payloads, attack traffic, vulnerability exploitation data, attack indicators, defense tool logs, security policies and configuration information, and response policies. From the initial benefit sample labels, the method determines target benefit sample labels and corresponding positive and negative sample data from the attack and defense data. Target benefit sample labels include any one of the following benefit types: denial-of-service type data, data breach type data, remote code execution type data, identity theft type data, data tampering type data, access control bypass type data, service abuse type data, process injection type data, virtual asset loss type data, and privacy violation type data. Based on the target benefit sample labels and the positive and negative sample data, a decision tree is trained to obtain a target decision tree. Based on the target decision tree, a network testbed attack impact assessment model is obtained. This application acquires current attack and defense data from a network range; inputs this data into a network range attack impact assessment model to obtain a benefit assessment result. The network range attack impact assessment model is obtained using a training method provided in this application. This application trains a decision tree using attack and defense data and corresponding benefit sample labels to obtain decision trees corresponding to different benefit types. Multiple decision trees are combined to obtain the network range attack impact assessment model. The current attack and defense data is then input into the model, and the final assessment result corresponds to the benefit type. This allows multiple assessment results to be obtained from a single model, simplifying the assessment process and improving efficiency. Furthermore, by using benefit type as a quantitative indicator and employing decision trees to assess the benefit results, this application makes the assessment process traceable and interpretable, improving the accuracy and reliability of the assessment results. Attached Figure Description

[0055] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0056] Figure 1 A schematic diagram illustrating a training method for a network range attack impact assessment model provided in this application;

[0057] Figure 2 A flowchart illustrating the training method for a network range attack impact assessment model provided in this application;

[0058] Figure 3 A flowchart illustrating a method for assessing the impact of cyber range attacks provided in this application;

[0059] Figure 4 A flowchart illustrating another method for assessing the impact of cyber range attacks provided in this application;

[0060] Figure 5 A schematic diagram of the structure of a training device for a network range attack impact assessment model provided in this application;

[0061] Figure 6 A schematic diagram of a network range attack impact assessment device provided in this application;

[0062] Figure 7 A schematic diagram of the structure of the electronic device provided in this application.

[0063] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0064] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0065] To clearly understand the technical solution of this application, the solutions of the prior art will be described in detail first.

[0066] With the rapid development and widespread application of the Internet, cybersecurity has become a critical issue. To effectively counter increasingly complex cyberattacks, cyber ranges have become a widely adopted tool for training and evaluating security defense capabilities. A cyber range provides a platform that simulates a real network environment, allowing security professionals to conduct attack and defense experiments in a secure and controlled setting.

[0067] However, assessing the benefits and impact of attacks is a critical task when conducting attack and defense experiments in cyber ranges. Traditional assessment methods often rely on human experience and subjective judgment, which suffers from high subjectivity and a lack of quantitative indicators, thus limiting the accuracy and reliability of the assessment results.

[0068] To address the aforementioned issues of high subjectivity and lack of quantifiable indicators, the inventors discovered in their research that a method can be used to collect and organize important benefit types, resulting in denial-of-service types, data breach types, remote code execution types, identity theft types, data tampering types, access control bypass types, service abuse types, process injection types, virtual asset loss types, and privacy violation types. Then, based on the benefit type, attack and defense data are labeled with benefit sample tags. Using the attack and defense data and their benefit sample tags, a decision tree is trained to obtain decision trees corresponding to the benefit types. These decision trees, together with the benefit type-specific decision trees, form a network range attack impact assessment model. The attack and defense data to be assessed is input into this model to obtain the network range attack impact assessment results. This application achieves the technical effect of traceability and interpretability of the assessment process by using benefit types as quantifiable indicators.

[0069] The following describes the application scenarios of the training method for the named entity recognition model in the named entity recognition method provided in the embodiments of this application.

[0070] Figure 1 A schematic diagram illustrating a training method for a network range attack impact assessment model provided in this application, such as... Figure 1 As shown, the scenario diagram includes a network range, a network range attack impact assessment model, and the network range attack impact assessment results. The network range includes attack and defense data, and the network range attack impact assessment model includes decision trees for denial-of-service attacks, data breaches, remote code execution, identity theft, data tampering, access control bypass, service abuse, process injection, virtual asset loss, and privacy violations. By inputting the attack and defense data from the network range into the network range attack impact assessment model, the network range attack impact assessment results are obtained.

[0071] Among them, a network range can refer to a technology or product based on virtualization technology that simulates and reproduces the operating status and operating environment of network architecture, system equipment, business processes in real cyberspace, so as to more effectively realize learning, research, testing, competition, exercise and other activities related to network security, thereby improving the network security confrontation level of personnel and organizations.

[0072] A decision tree is a decision analysis method that, based on the known probabilities of various scenarios, constructs a decision tree to calculate the probability that the expected net present value is greater than or equal to zero, thereby evaluating project risk and determining its feasibility. It is a graphical method that intuitively applies probability analysis. Because the decision branches, when drawn graphically, resemble the branches of a tree, it is called a decision tree. In this application's embodiment, the decision tree is used for classification. Each sample has a set of attributes and a category, which are predetermined. A classifier is learned, enabling it to correctly classify newly appearing objects. Specifically, the decision tree in this application can refer to an ID4.5 type decision tree.

[0073] Attack and defense data include attack data and defense data. Attack data includes attack vector data, attack payload, attack traffic, vulnerability exploitation data, and attack indicators, while defense data includes defense tool logs, security policies and configuration information, and response strategies.

[0074] Denial of service can refer to a situation where a server is unable to provide services to normal users by sending a large amount of spam or interfering information to the server.

[0075] A data breach can be defined as a security breach in which sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, or used by an unauthorized individual.

[0076] Remote code execution refers to an attacker attacking or controlling a computer device through remote invocation, regardless of the target's location. This vulnerability allows an attacker to execute malicious programs while the user is running an application and take control of the affected system.

[0077] Identity theft can refer to the illegal use of someone's personal information for theft or fraud.

[0078] Data tampering can refer to attackers modifying, adding to, or deleting data, causing data corruption.

[0079] Access control bypass refers to an attacker bypassing access control restrictions to gain access.

[0080] Service abuse can refer to using legitimate network services to launch attacks, concealing malicious behavior within legitimate traffic in order to weaken traditional defense capabilities and increase the efficiency of attack operations.

[0081] Process injection can refer to an attacker forcing a running process to load the DLL (Dynamic Link Library) file that the attacker needs to inject into its own process space, thereby enabling subsequent malicious attack operations.

[0082] Virtual asset loss can refer to an attack that causes the loss of virtual assets.

[0083] Privacy infringement can refer to an attacker intercepting or illegally obtaining another person's personal information without their consent during the dissemination of information, thus constituting an infringement of the other person's right to privacy.

[0084] The technical solutions shown in this application will now be described in detail through specific embodiments. Optionally, the following embodiments may exist alone or in combination with each other. For the same or similar content, the description will not be repeated in different embodiments.

[0085] Figure 2 A flowchart illustrating a training method for a network range attack impact assessment model provided in this application is shown below. Figure 2 As shown, the method includes:

[0086] S201. Determine the attack and defense data in the network test range, as well as the initial benefit sample labels for each attack and defense data. The attack and defense data includes attack vector data, attack payload, attack traffic, vulnerability exploitation data, attack indicators, defense tool logs, security policies and configuration information, and response policies.

[0087] Among them, attack and defense data can refer to a specific piece of data that describes the entire process from attack to defense, including whether the attack was successful or not and whether the defense was successful or not.

[0088] Initial benefit sample label data can refer to all the benefit effects that attack and defense data possess.

[0089] Methods for determining attack and defense data in a network range may include: extracting attack vector data, attack payloads, attack traffic, vulnerability exploitation data, attack indicators, defense tool logs, security policies and configuration information, and response policy-related data from the network range.

[0090] Methods for determining initial benefit sample labels may include: manually summarizing the benefits generated by each piece of attack / defense data to form initial benefit sample labels. A single piece of attack / defense data may yield multiple benefits. Initial benefit sample labels can be direct results, such as having denial-of-service (DoS) benefits or not having DoS benefits. Benefit labels can be represented by codes, for example, 1 for having DoS benefits and 0 for not having DoS benefits.

[0091] S202. Determine the target benefit sample label from the initial benefit sample label, as well as the positive and negative sample data corresponding to the target benefit sample label in the attack and defense data. The target benefit sample label includes any one of the following benefit type data: denial-of-service type data, data leakage type data, remote code execution type data, identity theft type data, data tampering type data, access control bypass type data, service abuse type data, process injection type data, virtual asset loss type data, and privacy violation type data.

[0092] The target revenue sample label can refer to any one of the following revenue type data: denial-of-service type data, data breach type data, remote code execution type data, identity theft type data, data tampering type data, access control bypass type data, service abuse type data, process injection type data, virtual asset loss type data, and privacy violation type data.

[0093] Positive and negative sample data can refer to a balance between the number of samples labeled as positive and the number of samples labeled as negative, so that the model trained later performs better. In this embodiment, the positive and negative sample data corresponding to the target benefit sample label can refer to a balance between the number of data with the target benefit type and the number of data without the target benefit type in the attack and defense data.

[0094] S203. Based on the target return sample labels and positive and negative sample data, train the decision tree to obtain the target decision tree.

[0095] In this embodiment of the application, the decision tree is trained based on the target return sample labels and positive and negative sample data to obtain the target decision tree, including:

[0096] Determine the feature values ​​of the target type feature in positive and negative sample data;

[0097] Training samples are obtained based on the target profit sample labels and feature values;

[0098] Based on the training samples, the information gain ratio of the target type features is obtained;

[0099] The position of the target type feature in the decision tree is determined based on the information gain ratio of the target type feature.

[0100] The target decision tree is determined based on the target type features and their positions in the decision tree.

[0101] Among them, target type features can refer to features used to classify data in attack and defense data. In this embodiment of the application, target feature types may include: attack_ip (attacker's IP address), duration_time (connection duration), protocol_kind (connection type: such as TCP, UDP, etc.), service_kind (target service host's network type: ftp, http, etc.), visit_count (number of times accessing sensitive system files and directories), number_shells (number of times shell commands were used), number_access_files (number of times access control files were accessed), and suroot_attempt (whether su was attempted). The attack parameters include: root command, login_type (user privileges used for login: root, guest, etc.), attack_type (attack type: DDoS, XSS, SQL injection, etc.), attack_time (attack time), defense_time (defense time), defense_level (defense level), defense_type (defense rules: firewall, WAF, antivirus software, etc.), defense_result (defense success: whether the defense was successful), attack_flow (attack traffic), and cve_data (information related to detected CVE vulnerabilities).

[0102] Eigenvalues ​​can refer to the values ​​in attack and defense data that correspond to the characteristics of the target type.

[0103] Training samples can refer to samples used to train the model. In this embodiment, the training samples include multiple sample data, each of which includes the feature value of the target type feature and the target benefit sample label. For example, when the target benefit sample label is denial-of-service type data and the target type feature is atck_ip, the sample data can be: atck_ip (XX.XX.XX.XX) with denial-of-service benefit (or identified as 1).

[0104] Information gain ratio (IGR) refers to the degree to which the uncertainty of information is reduced after knowing a certain feature. Specifically, the importance of a target type feature is determined by the IRG. If the IRG of a target type feature is the largest, it indicates that the target type feature is the most important feature and can be set as the first decision point in the decision tree. In the embodiments of this application, the IRG of the target type feature can refer to the IRG of each type of feature. All target type features are ranked by their IRG to determine the position of the target type feature in the decision tree.

[0105] After determining the target decision tree based on the position of the feature type in the decision tree, the following steps are also taken: Grid tuning of parameters such as max_length (maximum depth of the tree model), max_features (maximum number of features), and min_samples_leaf (minimum number of samples for leaf nodes), as well as parameter tuning of the tree model to avoid overfitting.

[0106] In this embodiment of the application, obtaining the target type feature gain ratio based on the training samples includes:

[0107] Based on the training samples, the target information gain of the target type features is obtained;

[0108] Based on the training samples, target splitting information of target type features is obtained;

[0109] The target information gain ratio is obtained by the ratio of target information gain to target split information.

[0110] Information gain can refer to the degree to which the uncertainty of a random variable is reduced when a certain feature type is known.

[0111] Split information can refer to the fact that the more feature values ​​a feature type has, the greater the split information of that feature type. The feature values ​​under a feature type can refer to the fact that a feature type may have multiple values. The more values ​​there are, the greater the split information of the feature.

[0112] In this embodiment of the application, the target information gain of the target type feature is obtained based on the training samples, including:

[0113] The information gain formula is determined as follows:

[0114] Information_gain(X,A i )=H(A i )-H(A i |X);

[0115] Among them, Information_gain(X,A) i Let A be the information gain, X be the target type feature, and A be the information gain. i For the sample corresponding to the label of the i-th target return sample, H(A) i ) is A i Information entropy, H(A) i |X) represents the partition of A by X. i Information entropy afterward;

[0116] The target information gain is obtained based on the training samples and the information gain formula.

[0117] In this embodiment of the application, the target splitting information of the target type feature is obtained based on the training samples, including:

[0118] The formula for determining the splitting information is as follows:

[0119]

[0120] Wherein, S(X,A) i ) represents the splitting information, X represents the target type feature, X k Let m be the k-th value of the target type feature X, and m be the total number of values ​​of the target type feature X.

[0121] Based on the training samples and the splitting information formula, the target splitting information is obtained.

[0122] S204. Based on the target decision tree, obtain the network range attack impact assessment model.

[0123] One method for obtaining a network range attack impact assessment model based on the target decision tree can include training decision trees corresponding to different benefit types, and then combining the trained decision trees to obtain the network range attack impact assessment model. The network range attack impact assessment model can select two or more benefit types of decision trees to combine according to the assessment requirements to achieve different purposes.

[0124] In this embodiment of the application, when the target return sample label has two or more types, the method further includes:

[0125] Determine the first training data and the second training data, wherein both the first training data and the second training data include positive and negative sample data and target benefit sample labels, and the target benefit sample labels in the first training data and the target benefit sample labels in the second training data are different.

[0126] Based on the target profit sample labels and positive and negative sample data in the first training data, the first initial decision tree is trained to obtain the first decision tree;

[0127] The second initial decision tree is trained based on the target benefit sample labels and positive and negative sample data in the second training data to obtain the second decision tree;

[0128] Based on the first and second initial decision trees, a network range attack impact assessment model is obtained.

[0129] This application provides a method for training a network range attack impact assessment model. The method involves determining attack and defense data in the network range, as well as initial benefit sample labels for each data point. The attack and defense data includes attack vector data, attack payloads, attack traffic, vulnerability exploitation data, attack indicators, defense tool logs, security policies and configuration information, and response policies. From the initial benefit sample labels, a target benefit sample label is determined, along with corresponding positive and negative sample data from the attack and defense data. The target benefit sample label includes any one of the following benefit types: denial-of-service type data, data leakage type data, remote code execution type data, identity theft type data, data tampering type data, access control bypass type data, service abuse type data, process injection type data, virtual asset loss type data, and privacy violation type data. Based on the target benefit sample label and the positive and negative sample data, a decision tree is trained to obtain a target decision tree. Finally, based on the target decision tree, the means of the network range attack impact assessment model are obtained. By collecting and organizing the types of gains and quantifying the gains from attack and defense data, the results can be used for subsequent applications. Training decision trees corresponding to these gain types makes the decision-making process traceable and interpretable, improving the accuracy and reliability of the evaluation results. Combining multiple decision trees into a network range attack impact assessment model allows for the generation of multiple gain results from a single model, avoiding repeated inputs, simplifying the evaluation process, and improving evaluation efficiency.

[0130] Figure 3 A flowchart illustrating a method for assessing the impact of network range attacks provided in this application is shown below. Figure 3 As shown, the method includes:

[0131] S301. Obtain current attack and defense data in the network target range;

[0132] S302. Input the current attack and defense data into the network range attack impact assessment model to obtain the benefit assessment result. The network range attack impact assessment model is obtained by a network range attack impact assessment model training method provided in the embodiments of this application.

[0133] The evaluation results may also include the evaluation process of the decision tree in the network range attack impact evaluation model, which serves as the theoretical basis for the evaluation and facilitates the interpretation of the evaluation results.

[0134] In this embodiment of the application, the current attack and defense data is input into the network range attack impact assessment model to obtain the benefit assessment result, including:

[0135] Determine the current feature value of the target type feature in the current attack and defense data;

[0136] Input the current feature value of the target type feature in the current attack and defense data into the network range attack impact assessment model to obtain the initial benefit assessment result;

[0137] Based on the benefit type of the target benefit sample label represented by the first decision tree and the benefit type of the target benefit sample label represented by the second decision tree in the network range attack impact assessment model, the initial benefit assessment results are vector-labeled to obtain vector assessment results.

[0138] The initial benefit assessment result can refer to the assessment result of the current attack and defense data. For example, a network range attack impact assessment model includes a denial-of-service type decision tree and a data leakage type decision tree. The initial assessment result is either having denial-of-service benefits or not having data leakage benefits. To concisely express the initial benefit assessment result, it can be vector-labeled and expressed numerically for easier subsequent data reading and application. For example, the vector information of the benefit type corresponding to each decision tree can be preset, and the initial assessment result can be represented by a vector based on this vector information. For instance, the initial assessment result of having denial-of-service benefits and not having data leakage benefits can be represented by the vector [1,0].

[0139] When the network range attack impact assessment model includes decision trees for all benefit types, the preset vector information can refer to a 10-dimensional vector, with each dimension corresponding to the benefit result of a benefit type. For example, the vector [a1,a2,a3,a4,a5,a6,a7,a8,a9,a10], where a1,a2,a3,a4,a5,a6,a7,a8,a9,a10 represent the benefit results of denial-of-service, data breach, remote code execution, identity theft, data tampering, access control bypass, service abuse, process injection, virtual asset loss, and privacy violation, respectively. Specifically, when the initial assessment result is denial-of-service benefit or privacy violation benefit, a1 and a10 are set to 1, and the other default values ​​are 0. Then the assessment result vector can be represented as [1,0,0,0,0,0,0,0,0,1].

[0140] This application provides a method for assessing the impact of network range attacks. By acquiring current attack and defense data in the network range and inputting this data into a network range attack impact assessment model, an assessment result can be obtained. The assessment result corresponds to the benefit type, making the assessment result indexed. At the same time, the network range attack impact assessment model makes the assessment process simple and easy to operate. In addition, the assessment result can also record the decision process of each decision tree in the network range attack impact assessment model, which is convenient for timely tracing of the assessment process and facilitates the interpretation of the assessment result.

[0141] Figure 4A flowchart illustrating another method for assessing the impact of cyber range attacks provided in this application is shown below. Figure 4 As shown, the method includes:

[0142] S401. Extract attack and defense data from real attack and defense data in a network range simulation environment.

[0143] Among them, the attack data involves five aspects: attack vector data, attack payload, attack traffic, vulnerability exploitation data, and attack indicators; while the defense data comes from three aspects: defense tool logs, security policies and configuration information, and response policies.

[0144] S402. Perform feature engineering and feature extraction on the attack and defense data, filter out valid data that meets the attack benefits, and splice and aggregate to obtain each connection sample.

[0145] The methods for feature engineering and feature extraction on the attack and defense sides can include: preprocessing the collected data, including data cleaning, outlier removal, and feature selection; merging and integrating the data to obtain the feature data for each attack connection. The data includes fields such as: attack_ip (attacker's IP address), duration_time (connection duration), protocol_kind (connection type: e.g., TCP, UDP), service_kind (target server's network type: FTP, HTTP, etc.), visit_count (number of times accessed sensitive system files and directories), number_shells (number of times shell commands were used), number_access_files (number of times access control files were accessed), and suroot_attempt (whether su was attempted). The data includes root command, login_type (user privileges used for login: root, guest, etc.), attack_type (attack type: DDoS, XSS, SQL injection, etc.), attack_time (attack time), defense_time (defense time), defense_level (defense level), defense_type (defense rules: firewall, WAF, antivirus software, etc.), defense_result (defense success: whether the defense was successful), attack_flow (attack traffic), and cve_data (detected CVE vulnerability information). After preprocessing such as cleaning and deduplication, and simple feature engineering, the data comprises approximately 50 dimensions of feature information.

[0146] S403. Based on each connection sample, evaluate and verify the data using expert experience to obtain its corresponding attack benefits.

[0147] The benefits of these attacks include denial of service, data disclosure, remote code execution, identity theft, data tampering, access control bypass, service abuse, process injection, loss of virtual assets, and privacy violation.

[0148] S404. Perform stratified sampling on the dataset to obtain relatively balanced positive and negative samples for each attack gain, resulting in a total of 10 datasets.

[0149] S405. Based on 10 datasets, train 10 decision trees to obtain 10 decision tree models for attack benefits.

[0150] The purpose of constructing a decision tree is to find the relationship between attributes and categories, and use it to predict the category of records with unknown categories in the future. Using existing data from both the attack and defense sides, a decision tree model is constructed. The child nodes in the model represent different attack or defense features, and the leaf nodes represent the final attack impact. Since there are 10 types of attack impact, 10 decision trees need to be trained. Finally, the results of each decision tree are aggregated to form a specific attack benefit vector.

[0151] S406. Based on the decision tree model of 10 attack benefits, classify the new attack connections to obtain the vector of target range attack benefits, and draw the decision process of each decision tree.

[0152] The process involves evaluating new attack behaviors, outputting specific attack benefit vector metrics, and providing an explanation of the evaluation results (i.e., drawing the theoretical basis for obtaining the attack benefit; since the attack vector is derived from 10 decision trees, this is done by drawing these 10 decision trees), revealing the impact of the attack on the network system and potential risks. Specifically, an attack connection, if its duration lasts for 100 seconds and it attempts to use the `su root` command, can be identified as having a label of 1, which will result in an attack benefit based on the label represented by that decision tree. The explanation is that this is achieved by aggregating 10 decision trees. For example, the final attack benefit vector might be [0,0,1,0,0,0,0,0,0,1], because its corresponding attack benefit dictionary represents attack benefits in dimensions 3 and 10, namely remote code execution and privacy violation.

[0153] This application provides another method for assessing the impact of network range attacks. It extracts attack and defense data from real attack and defense data in a simulated network range environment. Through feature engineering and feature extraction, valid data that matches attack gains is selected and aggregated to obtain feature data for each connection sample. For each connection sample, expert experience is used to evaluate and verify the data, obtaining its corresponding attack gain. Since one connection may cause multiple attack gains, stratified sampling is performed on the datasets to obtain relatively balanced positive and negative samples for each attack gain, resulting in a total of 10 datasets. These 10 datasets are used to train 10 decision trees, obtaining 10 decision tree models for attack gains. When a new attack connection arrives, the 10 decision trees are used to classify the attack connection, obtaining a vector of range attack gains. The decision-making process of each decision tree is plotted to achieve interpretability of the decision-making process. This application embodiment uses decision tree models to quantitatively assess attack behavior in a network range, thereby providing objective and accurate assessment results.

[0154] Figure 5 This application provides a schematic diagram of the structure of a training device for a network range attack impact assessment model, as shown below. Figure 5 As shown, the device 50 includes a first determining module 501, a second determining module 502, a training module 503, and a obtaining module 504, wherein:

[0155] The first determining module 501 is used to determine the attack and defense data in the network test range, as well as the initial benefit sample label of each attack and defense data. The attack and defense data includes attack vector data, attack payload, attack traffic, vulnerability exploitation data, attack indicators, defense tool logs, security policies and configuration information, and response policies.

[0156] The second determining module 502 is used to determine the target benefit sample label from the initial benefit sample label, as well as the positive and negative sample data corresponding to the target benefit sample label in the attack and defense data. The target benefit sample label includes any one of the following benefit type data: denial-of-service type data, data leakage type data, remote code execution type data, identity theft type data, data tampering type data, access control bypass type data, service abuse type data, process injection type data, virtual asset loss type data, and privacy violation type data.

[0157] Training module 503 is used to train the decision tree based on the target benefit sample labels and positive and negative sample data to obtain the target decision tree;

[0158] Module 504 is obtained, which is used to obtain a network range attack impact assessment model based on the target decision tree.

[0159] In this embodiment of the application, the training module 503 is further used for:

[0160] Determine the feature values ​​of the target type feature in positive and negative sample data;

[0161] Training samples are obtained based on the target profit sample labels and feature values;

[0162] Based on the training samples, the information gain ratio of the target type features is obtained;

[0163] The position of the target type feature in the decision tree is determined based on the information gain ratio of the target type feature.

[0164] The target decision tree is determined based on the target type features and their positions in the decision tree.

[0165] In this embodiment of the application, the training module 503 is further used for:

[0166] Based on the training samples, the target information gain of the target type features is obtained;

[0167] Based on the training samples, target splitting information of target type features is obtained;

[0168] The target information gain ratio is obtained by the ratio of target information gain to target split information.

[0169] In this embodiment of the application, the training module 503 is further configured to:

[0170] The information gain formula is determined as follows:

[0171] Information_gain(X,A i )=H(A i )-H(A i|X);

[0172] Among them, Information_gain(X,A) i Let A be the information gain, X be the target type feature, and A be the information gain. i For the sample corresponding to the label of the i-th target return sample, H(A) i ) is A i Information entropy, H(A) i |X) represents the partition of A by X. i Information entropy afterward;

[0173] The target information gain is obtained based on the training samples and the information gain formula.

[0174] In this embodiment of the application, the training module 503 is further used for:

[0175] The formula for determining the splitting information is as follows:

[0176]

[0177] Wherein, S(X,A) i ) represents the splitting information, X represents the target type feature, X k Let m be the k-th value of the target type feature X, and m be the total number of values ​​of the target type feature X.

[0178] Based on the training samples and the splitting information formula, the target splitting information is obtained.

[0179] Figure 6 A schematic diagram of a network range attack impact assessment device provided in this application is shown below. Figure 6 As shown, the device 60 includes an acquisition module 601 and an evaluation module 602, wherein:

[0180] The acquisition module 601 is used to acquire the current attack and defense data in the network test range;

[0181] The evaluation module 602 is used to input the current attack and defense data into the network range attack impact evaluation model to obtain the benefit evaluation result. The network range attack impact evaluation model is obtained by a network range attack impact evaluation model training method provided in the embodiments of this application.

[0182] In this embodiment of the application, the evaluation module 602 is further used for:

[0183] Determine the current feature value of the target type feature in the current attack and defense data;

[0184] Input the current feature value of the target type feature in the current attack and defense data into the network range attack impact assessment model to obtain the initial benefit assessment result;

[0185] Based on the benefit type of the target benefit sample label represented by the first decision tree and the benefit type of the target benefit sample label represented by the second decision tree in the network range attack impact assessment model, the initial benefit assessment results are vector-labeled to obtain vector assessment results.

[0186] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 As shown, the electronic device 70 includes:

[0187] The electronic device 70 may include a processor 701 with one or more processing cores, a memory 702 with one or more computer-readable storage media, a communication component 703, and other components. The processor 701, memory 702, and communication component 703 are connected via a bus 704.

[0188] In the specific implementation process, at least one processor 701 executes computer execution instructions stored in memory 702, causing at least one processor 701 to execute the above-mentioned network range attack impact assessment model training method or network range attack impact assessment method.

[0189] The specific implementation process of processor 701 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0190] In the above Figure 7 In the illustrated embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0191] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0192] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0193] In some embodiments, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the steps in any of the above-described network range attack impact assessment model training methods or network range attack impact assessment methods.

[0194] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0195] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0196] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute steps in any of the network range attack impact assessment model training methods or network range attack impact assessment methods provided in embodiments of this application.

[0197] The storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0198] According to one aspect of this application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium.

[0199] Since the instructions stored in the storage medium can execute the steps in any of the network range attack impact assessment model training methods or network range attack impact assessment methods provided in the embodiments of this application, the beneficial effects that any of the network range attack impact assessment model training methods or network range attack impact assessment methods provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0200] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0201] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A network range attack influence evaluation model training method, characterized in that, The method comprises the steps of: determining attack and defense data in a network target range, and initial benefit sample labels of each of the attack and defense data, wherein the attack and defense data comprises attack vector data, attack payload, attack traffic, exploit data, attack indicators, defense tool logs, security policy and configuration information, and response strategies; determining target benefit sample labels and positive and negative sample data corresponding to the target benefit sample labels in the attack and defense data from the initial benefit sample labels, wherein the target benefit sample labels comprise any one of benefit type data of denial of service type data, data leakage type data, remote code execution type data, identity theft type data, data tampering type data, access control bypass type data, service abuse type data, process injection type data, virtual asset loss type data, and privacy violation type data; training a decision tree according to the target benefit sample labels and the positive and negative sample data to obtain a target decision tree; obtaining a network target range attack influence evaluation model according to the target decision tree.

2. The method of claim 1, wherein, The method comprises the steps of: determining a feature value of a target type feature in the positive and negative sample data; obtaining a training sample according to the target benefit sample labels and the feature value; obtaining an information gain ratio of the target type feature according to the training sample; determining a position of the target type feature in the decision tree according to the information gain ratio of the target type feature; determining a target decision tree according to the target type feature and the position of the target type feature in the decision tree.

3. The method of claim 2, wherein, The method comprises the steps of: obtaining a target information gain of the target type feature according to the training sample; obtaining a target split information of the target type feature according to the training sample; obtaining the target information gain ratio according to a ratio of the target information gain and the target split information.

4. The method of claim 3, wherein, The method comprises the steps of: determining an information gain formula, wherein the information gain formula is: Information_gain(X,A i ) = H(A i ) - H(A i | X); wherein, Information_gain(X, A i ) is information gain, X is a target type feature, A i is a sample corresponding to a label of an i-th target revenue sample, H(A i ) is information entropy of A i , and H(A i |X) is information entropy of A i after being divided by X. obtaining a target information gain according to the training sample and the information gain formula.

5. The method of claim 3, wherein, The method comprises the steps of: determining a split information formula, wherein the split information formula is: Wherein, S(X,A) i ) represents the splitting information, X represents the target type feature, X k Let m be the kth value of the target type feature X, and m be the total number of values ​​of the target type feature X. obtaining a target split information according to the training sample and the split information formula.

6. The method of claim 1, wherein, When the target benefit sample labels have more than two types, the method further comprises the steps of: determining first training data and second training data, wherein the first training data and the second training data both comprise positive and negative sample data and target benefit sample labels, and the target benefit sample labels in the first training data and the target benefit sample labels in the second training data are different; training a first initial decision tree according to the target benefit sample labels and the positive and negative sample data in the first training data to obtain a first decision tree; According to the target benefit sample label and the positive and negative sample data in the second training data, the second initial decision tree is trained to obtain a second decision tree; According to the first initial decision tree and the second initial decision tree, a network target range attack influence evaluation model is obtained.

7. A method for assessing the impact of cyber range attacks, characterized in that, Comprising: Obtaining current attack and defense data in a network target range; Inputting the current attack and defense data into the network target range attack influence evaluation model to obtain a benefit evaluation result, wherein the network target range attack influence evaluation model is any one of the network target range attack influence evaluation models in claims 1-6.

8. The method of claim 7, wherein, The inputting the current attack and defense data into the network target range attack influence evaluation model to obtain a benefit evaluation result comprises: Determining a current feature value of a target type feature in the current attack and defense data; Inputting the current feature value of the target type feature in the current attack and defense data into the network target range attack influence evaluation model to obtain an initial benefit evaluation result; According to the benefit type of the target benefit sample label represented by the first decision tree and the benefit type of the target benefit sample label represented by the second decision tree in the network target range attack influence evaluation model, vector labeling is performed on the initial benefit evaluation result to obtain a vector evaluation result.

9. A network range attack impact assessment model training apparatus, characterized in that, Comprising: A first determination module is configured to determine attack and defense data in a network target range and initial benefit sample labels of each of the attack and defense data, wherein the attack and defense data comprises attack vector data, attack payload, attack traffic, vulnerability exploitation data, attack indicators, defense tool logs, security policy and configuration information, and response strategies; A second determination module is configured to determine a target benefit sample label and positive and negative sample data corresponding to the target benefit sample label in the attack and defense data from the initial benefit sample labels, wherein the target benefit sample label comprises any one of benefit type data of denial of service type data, data leakage type data, remote code execution type data, identity theft type data, data tampering type data, access control bypass type data, service abuse type data, process injection type data, virtual asset loss type data, and privacy violation type data; A training module is configured to train a decision tree according to the target benefit sample label and the positive and negative sample data to obtain a target decision tree; A obtaining module is configured to obtain a network target range attack influence evaluation model according to the target decision tree.

10. A network range attack impact assessment apparatus, characterized by, Comprising: An obtaining module is configured to obtain current attack and defense data in a network target range; An evaluation module is configured to input the current attack and defense data into a network target range attack influence evaluation model to obtain a benefit evaluation result, wherein the network target range attack influence evaluation model is any one of the network target range attack influence evaluation models in claims 1-8.

11. An electronic device, comprising: Comprising: A processor and a memory connected in communication with the processor; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to implement the method in any one of claims 1-8.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the method according to any one of claims 1-8.

Images