Method and device for generating maximum attack path based on attack tree and timing chart clustering

Abstract

The application relates to the technical field of network security, and discloses a maximum attack path generation method and device based on attack tree and timing diagram clustering, which comprises the following steps: obtaining a mapping table of atomic attack behaviors and vulnerabilities, atomic attack nodes, and prerequisite condition sets and subsequent operation sets corresponding to the atomic attack nodes; generating a resource-oriented attack tree according to the atomic attack nodes and the prerequisite condition sets and the subsequent operation sets corresponding to the atomic attack nodes; determining the attack probability of a root node in the resource-oriented attack tree according to the mapping table and a preset attack success probability calculation formula; converting the resource-oriented attack tree into an attack timing diagram according to the mapping table and the attack probability of the root node; and clustering the attack timing diagram by using a self-encoder and a self-organizing mapping algorithm to obtain a maximum attack path. The application solves the problem that the generation of an attack path lacks timing analysis.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a method and apparatus for generating the maximum attack path based on attack tree and time sequence graph clustering. Background Technology

[0002] The development of emerging businesses such as power system generation-grid-load-storage, smart energy service platforms, and virtual power plants has improved the efficiency and sustainability of the power sector, but it has also expanded the cyberattack surface of the power system. Existing technologies, such as attack tree analysis of potential attack paths and clustering and classifying vulnerability information to construct static attack graphs for attack path analysis, do not fully utilize the temporal information of vulnerabilities. The identification of abnormal behavior is somewhat delayed, allowing threats more time to lurk and develop, making it difficult to guarantee the reliable operation of the power system. Therefore, existing technologies suffer from a lack of temporal analysis in attack path generation. Summary of the Invention

[0003] In view of this, the present invention provides a method and apparatus for generating the maximum attack path based on attack tree and temporal graph clustering, so as to solve the problem that the generation of attack paths in the technology lacks temporal analysis.

[0004] In a first aspect, the present invention provides a method for generating the maximum attack path based on attack tree and time sequence graph clustering, comprising: obtaining a mapping table of atomic attack behaviors and vulnerabilities, atomic attack nodes, and a set of prerequisites and subsequent operations corresponding to the atomic attack nodes; generating a resource-oriented attack tree based on the atomic attack nodes and the set of prerequisites and subsequent operations corresponding to the atomic attack nodes; determining the attack probability of the root node in the resource-oriented attack tree based on the mapping table and a preset attack success probability calculation formula; converting the resource-oriented attack tree into an attack time sequence graph based on the mapping table and the attack probability of the root node; and clustering the attack time sequence graph using an autoencoder and a self-organizing map algorithm to obtain the maximum attack path.

[0005] In this embodiment of the invention, a resource-directed attack tree is constructed, and the attack probability of the root node in the resource-directed attack tree is calculated. Based on the attack probability and the mapping table of atomic attack behaviors and vulnerabilities, the resource-directed attack tree is converted into an attack sequence graph. Then, the attack sequence graph is clustered using an autoencoder and a self-organizing map algorithm to obtain the maximum attack path. This achieves the goal of considering the temporal information of atomic attack behaviors and vulnerabilities, and achieves the effect of comprehensively understanding threats and optimizing defense strategies. It solves the problem of lacking temporal analysis in the generation of attack paths, which is conducive to providing better security decision support for network security, reducing the risk of potential attacks, improving network security, and ensuring the continuity and reliability of critical infrastructure.

[0006] In one optional implementation, the atomic attack node, the set of prerequisites, and the set of subsequent operations include resource nodes and atomic attack behavior nodes. The resource nodes and atomic attack behavior nodes are used to distinguish whether the atomic attack involves resource acquisition. The set of prerequisites and the set of subsequent operations include the sequential relationship between the nodes in the set and the atomic attack node. Generating a resource-oriented attack tree based on the atomic attack node and the set of prerequisites and the set of subsequent operations corresponding to the atomic attack node includes: constructing an atomic attack chain based on the atomic attack node and the set of prerequisites and the set of subsequent operations corresponding to the atomic attack node; and generating a resource-oriented attack tree based on the preset resource nodes, the atomic attack chain, and the sequential relationship.

[0007] In this embodiment of the invention, by utilizing atomic attack nodes and their corresponding sets of prerequisites and subsequent operations, a temporal representation of atomic attack behaviors is achieved. Nodes are classified into resource nodes and atomic attack behavior nodes based on whether they involve resource acquisition, thus achieving node classification and achieving the purpose of constructing a resource-oriented attack tree.

[0008] In one optional implementation, the resource-oriented attack tree is converted into an attack sequence diagram based on the mapping table and the attack probability of the root node, including: using a general vulnerability scoring system to determine the attack cost of nodes in the resource-oriented attack tree based on the mapping table; calculating the optimal transition probability of resource nodes in the resource-oriented attack tree based on the attack cost and the attack probability of the root node according to preset optimization objectives and constraints; and converting resource-oriented attack trees with attack probabilities greater than a preset threshold into attack sequence diagrams based on the optimal transition probability and the mapping table.

[0009] In this embodiment of the invention, the resource-oriented attack tree is converted into an attack sequence graph according to the attack probability, thereby enabling the screening of the resource-oriented attack tree and providing a data foundation for subsequent clustering operations.

[0010] In one optional implementation, the attack sequence graph includes nodes and connecting edges. The resource-oriented attack tree with an attack probability greater than a preset threshold is converted into an attack sequence graph based on the optimal transition probability and a mapping table. This includes: obtaining the timing score of the vulnerability in the mapping table; determining the weight of the connecting edges based on the timing score and the optimal transition probability; and generating an adjacency matrix corresponding to the attack sequence graph with an attack probability greater than the preset threshold based on the weight of the connecting edges.

[0011] In this embodiment of the invention, the adjacency matrix of the attack timing graph is determined by using the timing score of the vulnerability and the optimal transition probability, thereby realizing the timing analysis of vulnerability information and improving the accuracy of attack path generation.

[0012] In one optional implementation, the attack sequence graph is clustered using an autoencoder and a self-organizing map algorithm to obtain the maximum attack path. This includes: constructing an autoencoder based on a graph neural network and a long short-term memory network; using the autoencoder to reduce the dimensionality of the adjacency matrix to obtain a low-dimensional vector representation of the nodes in the attack sequence graph; converting the low-dimensional vector representation into temporal triples; using the self-organizing map algorithm to determine the key nodes in the attack sequence graph based on the temporal triples and a preset distance formula, where the preset distance formula is determined by the Canopy clustering algorithm and Jaccard distance; and determining the maximum attack path based on the key nodes and the weights of the connecting edges.

[0013] In this embodiment of the invention, the autoencoder and the improved 3D SOM self-organizing map algorithm are used to achieve the effect of dimensionality reduction and clustering of the adjacency matrix, thereby realizing the purpose of determining key nodes and generating the maximum attack path.

[0014] In one optional implementation, obtaining the time-series score of a vulnerability in the mapping table includes: obtaining the vulnerability disclosure, the vulnerability information flow anomaly score, and the vulnerability base score; and determining the time-series score of the vulnerability based on the product of the vulnerability disclosure, the vulnerability information flow anomaly score, and the vulnerability base score.

[0015] In this embodiment of the invention, the time-series score of a vulnerability is determined from multiple aspects, including vulnerability disclosure, information flow anomaly score, and basic score. This achieves the goal of improving the reliability and accuracy of vulnerability scoring and enhances the timeliness of identifying abnormal behavior.

[0016] In one optional implementation, the vulnerability disclosure degree, vulnerability information flow anomaly score, and vulnerability basic score are obtained, including: obtaining the time interval from vulnerability discovery to disclosure; determining the vulnerability disclosure degree based on the time interval, vulnerability disclosure path influence factor, and vulnerability disclosure detail influence factor; determining the vulnerability information flow anomaly score from multiple feature dimensions using the isolated forest algorithm; and determining the vulnerability basic score based on a general vulnerability scoring system.

[0017] In this embodiment of the invention, the vulnerability disclosure degree, the vulnerability information flow anomaly score, and the vulnerability basic score are jointly determined from the perspective of impact, thereby achieving the effect of further improving the reliability and accuracy of vulnerability time-series scoring.

[0018] Secondly, this invention provides a maximum attack path generation device based on attack tree and time sequence graph clustering, comprising: an acquisition module for acquiring a mapping table of atomic attack behaviors and vulnerabilities, atomic attack nodes, and a set of prerequisites and subsequent operations corresponding to the atomic attack nodes; an attack tree generation module for generating a resource-oriented attack tree based on the atomic attack nodes and the set of prerequisites and subsequent operations corresponding to the atomic attack nodes; an attack probability determination module for determining the attack probability of the root node in the resource-oriented attack tree based on the mapping table and a preset attack success probability calculation formula; a time sequence graph generation module for converting the resource-oriented attack tree into an attack time sequence graph based on the mapping table and the attack probability of the root node; and an attack path acquisition module for clustering the attack time sequence graph using an autoencoder and a self-organizing map algorithm to obtain the maximum attack path.

[0019] In one optional implementation, the atomic attack node, the set of prerequisites, and the set of subsequent operations include resource nodes and atomic attack behavior nodes. The resource nodes and atomic attack behavior nodes are used to distinguish whether the atomic attack involves resource acquisition. The set of prerequisites and the set of subsequent operations include the sequential relationship between the nodes in the set and the atomic attack node. The attack tree generation module includes: an attack chain construction unit, used to construct an atomic attack chain based on the atomic attack node and the set of prerequisites and the set of subsequent operations corresponding to the atomic attack node; and an attack tree generation unit, used to generate a resource-oriented attack tree based on preset resource nodes, the atomic attack chain, and the sequential relationship.

[0020] In one optional implementation, the timing diagram generation module includes: an attack cost determination unit, used to determine the attack cost of nodes in the resource-oriented attack tree according to a mapping table using a general vulnerability scoring system; a transition probability calculation unit, used to calculate the optimal transition probability of resource nodes in the resource-oriented attack tree based on the attack cost and the attack probability of the root node according to a preset optimization objective and constraints; and a conversion unit, used to convert resource-oriented attack trees with attack probabilities greater than a preset threshold into attack timing diagrams according to the optimal transition probability and the mapping table.

[0021] In one optional implementation, the attack sequence graph includes nodes and connecting edges. The transformation unit includes: an acquisition subunit for acquiring the timing score of the vulnerability in the mapping table; a weight determination subunit for determining the weight of the connecting edge based on the timing score and the optimal transition probability; and an adjacency matrix generation subunit for generating an adjacency matrix corresponding to the attack sequence graph with an attack probability greater than a preset threshold based on the weight of the connecting edge.

[0022] In one optional implementation, the attack path acquisition module includes: an autoencoder construction unit for constructing an autoencoder based on a graph neural network and a long short-term memory network; a dimensionality reduction unit for using the autoencoder to reduce the dimensionality of the adjacency matrix to obtain a low-dimensional vector representation of the nodes in the attack time sequence graph; a triplet conversion unit for converting the low-dimensional vector representation into temporal triplets; a key node determination unit for using a self-organizing map algorithm to determine key nodes in the attack time sequence graph based on the temporal triplets and a preset distance formula, wherein the preset distance formula is determined by the Canopy clustering algorithm and Jaccard distance; and an attack path determination unit for determining the maximum attack path based on the key nodes and the weights of the connecting edges.

[0023] In one optional implementation, the acquisition sub-unit includes: a scoring acquisition sub-module, used to acquire vulnerability disclosure, vulnerability information flow anomaly score, and vulnerability basic score; and a time-series scoring determination sub-module, used to determine the time-series score of the vulnerability based on the product of vulnerability disclosure, vulnerability information flow anomaly score, and vulnerability basic score.

[0024] In one optional implementation, the scoring acquisition submodule is specifically used to: acquire the time interval between the discovery and public disclosure of a vulnerability; determine the vulnerability disclosure degree based on the time interval, the vulnerability disclosure path influence factor, and the vulnerability disclosure detail influence factor; determine the vulnerability information flow anomaly score from multiple feature dimensions using the isolated forest algorithm; and determine the vulnerability basic score based on a general vulnerability scoring system.

[0025] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the maximum attack path generation method based on attack tree and timing graph clustering described in the first aspect or any corresponding embodiment thereof.

[0026] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the maximum attack path generation method based on attack tree and timing graph clustering as described in the first aspect or any corresponding embodiment thereof. Attached Figure Description

[0027] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0028] Figure 1This is a flowchart illustrating the maximum attack path generation method based on attack tree and temporal graph clustering according to an embodiment of the present invention.

[0029] Figure 2 This is a flowchart illustrating another method for generating the maximum attack path based on attack tree and temporal graph clustering according to an embodiment of the present invention;

[0030] Figure 3 This is a flowchart illustrating another method for generating the maximum attack path based on attack tree and temporal graph clustering according to an embodiment of the present invention.

[0031] Figure 4 This is a schematic diagram of the overall framework of the maximum attack path generation method based on attack tree and temporal graph clustering according to an embodiment of the present invention.

[0032] Figure 5 This is a structural block diagram of a maximum attack path generation device based on attack tree and temporal graph clustering according to an embodiment of the present invention;

[0033] Figure 6 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0035] It should be noted that in the description of this invention, the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices. The terms "installed," "connected," and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; a mechanical connection or an electrical connection; a direct connection or an indirect connection through an intermediate medium; a connection within two elements; a wireless connection or a wired connection. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0036] Furthermore, if the term "and / or" appears in this invention, it includes three parallel solutions. Taking "A and / or B" as an example, it includes solution A, solution B, or a solution that simultaneously satisfies A and B. Additionally, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0037] The power system is currently undergoing a major transformation, with emerging businesses such as power generation, grid, load, and storage; smart energy service platforms; distributed photovoltaics; marketing load management; and virtual power plants developing rapidly. On the one hand, this improves the efficiency and sustainability of the power sector; on the other hand, these emerging power systems involve more network connections and communications, expanding the network attack surface. The integration of virtual power plants and distributed energy resources increases system complexity, and large-scale data collection and processing raises issues related to data privacy and compliance. Vulnerability information directly impacts the vulnerability and threat exposure of the power system. Temporal analysis of vulnerability information can help monitor vulnerability exploitation and attack trends in real time. Combined with system information flow monitoring and analysis, this allows power system managers to detect threats earlier and take immediate action. Attack trees can provide detailed and comprehensive analysis of potential attack paths; however, static tree structures lack temporal analysis, which may lead to delays in identifying abnormal behavior, giving potential threats more time to lurk and develop.

[0038] One related technology analyzes the cost-benefit of sub-attack paths based on node occupancy in the network node graph, thereby eliminating redundant paths. It applies a precise reasoning-based connection tree algorithm to the temporal network attack graph through reasonable deduction of the attack process, obtaining the node confidence of the attack graph at any given time. This method assumes the attacker's goal is to occupy all resource nodes and does not consider other attack behaviors prior to attacking resource nodes. Another related technology uses only post-stage matching for attack prediction. For attack chains where the tail attack exceeds a preset stage, it calculates a co-occurrence matrix based on the predicted attack chain and matching historical attack chains to mine the most likely next attack. This method heavily relies on the reliability of attack chain construction, is vulnerable to unknown attacks, and does not fully utilize vulnerability information. Yet another related technology constructs attack subtrees based on daily system monitoring behavior and merges them, quantitatively analyzing security threats within the attack tree to derive the shortest path. This method utilizes the attack tree structure for security analysis; however, the static structure of the attack tree can cause delays in identifying abnormal behavior in real-time changing and complex network systems. Another related technology generates vulnerability attack pre-samples based on existing original attack case documents, performs clustering and classification to form attack samples, and constructs a static attack graph based on the monotonicity assumption by combining system component information and state information. Attack paths are then analyzed and evaluated on the attack graph structure. This method reduces the complexity of the attack graph and avoids loops; however, it does not fully utilize system state temporal information, and the vulnerability threat information derived from text-mined vulnerability descriptions has a certain lag. In summary, current technical solutions suffer from a lack of temporal analysis of vulnerability information and the lack of correlation mining of attack methods.

[0039] According to an embodiment of the present invention, a method for generating the maximum attack path based on attack tree and timing graph clustering is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0040] This embodiment provides a method for generating the maximum attack path based on attack tree and time sequence graph clustering, which can be used in the aforementioned mobile terminals, such as central processing units and servers. Figure 1 This is a flowchart illustrating the maximum attack path generation method based on attack tree and temporal graph clustering according to an embodiment of the present invention, as shown below. Figure 1 As shown, the process includes the following steps:

[0041] Step S101: Obtain the mapping table of atomic attack behaviors and vulnerabilities, the atomic attack nodes, and the set of prerequisites and subsequent operations corresponding to the atomic attack nodes. Optionally, any atomic attack node can be represented in the following way. in, These represent the set of prerequisites and the set of subsequent operations corresponding to the atomic attack node, respectively. Relationship-related nodes; a mapping table of atomic attack behaviors and vulnerabilities, i.e., the set of vulnerabilities involved in an atomic attack, including the temporal scores of the vulnerabilities, is denoted as...

[0042] Step S102: Generate a resource-directed attack tree based on the atomic attack nodes and their corresponding sets of prerequisites and subsequent operations. Optionally, all atomic attack nodes can be represented using the representation method in step S101, and the resource-directed attack tree can be generated based on the relationships between the atomic attack nodes.

[0043] Step S103: Determine the attack probability of the root node in the resource-oriented attack tree according to the mapping table and the preset attack success probability calculation formula. Optionally, there are multiple resource-oriented attack trees, and the attack probability of the root node represents, to some extent, the probability of the resource-oriented attack tree being attacked. The attack probability can be calculated using the preset attack success probability calculation formula based on the mapping table in step S101.

[0044] Step S104: Convert the resource-oriented attack tree into an attack sequence graph based on the mapping table and the attack probability of the root node. Optionally, select the resource-oriented attack tree with a high probability of being attacked, and calculate the corresponding adjacency matrix according to the mapping table in step S101. The adjacency matrix represents the adjacency relationship between vertices, thereby converting the resource-oriented attack tree into an attack sequence graph.

[0045] Step S105: Cluster the attack sequence graph using an autoencoder and a self-organizing map algorithm to obtain the maximum attack path. Optionally, the autoencoder consists of a neural network model used to reduce the dimensionality of the sequence graph (adjacency matrix). Then, the self-organizing map algorithm is used to cluster the dimensionality-reduced adjacency matrix to discover key nodes in the sequence graph, thereby determining the maximum attack path.

[0046] In this embodiment of the invention, a resource-directed attack tree is constructed, and the attack probability of the root node in the resource-directed attack tree is calculated. Based on the attack probability and the mapping table of atomic attack behaviors and vulnerabilities, the resource-directed attack tree is converted into an attack sequence graph. Then, the attack sequence graph is clustered using an autoencoder and a self-organizing map algorithm to obtain the maximum attack path. This achieves the goal of considering the temporal information of atomic attack behaviors and vulnerabilities, and achieves the effect of comprehensively understanding threats and optimizing defense strategies. It solves the problem of lacking temporal analysis in the generation of attack paths, which is conducive to providing better security decision support for network security, reducing the risk of potential attacks, improving network security, and ensuring the continuity and reliability of critical infrastructure.

[0047] This embodiment provides a method for generating the maximum attack path based on attack tree and time sequence graph clustering, which can be used in the aforementioned mobile terminals, such as central processing units and servers. Figure 2 This is a flowchart illustrating another method for generating the maximum attack path based on attack tree and temporal graph clustering according to an embodiment of the present invention, as shown below. Figure 2 As shown, the process includes the following steps:

[0048] Step S201: Obtain the mapping table of atomic attack behaviors and vulnerabilities, atomic attack nodes, and the corresponding set of prerequisites and subsequent operations for each atomic attack node. Optionally, the atomic attack nodes, the set of prerequisites, and the set of subsequent operations include resource nodes and atomic attack behavior nodes. Resource nodes and atomic attack behavior nodes are used to distinguish whether an atomic attack involves resource acquisition. The set of prerequisites and the set of subsequent operations include the sequential relationship between nodes in the set and the atomic attack nodes. Specifically, atomic attack nodes... and the set of prerequisites corresponding to atomic attack nodes. and subsequent operation set Based on whether resource acquisition is involved, they are categorized into resource nodes. and atomic attack behavior nodes and It can also include empty nodes. and A single node in a set The representation is as follows: Where Se∈{pre,post}, pre and post respectively represent and The relation between Re and Se is given by Re ∈ {and, or, sand}, where and, or, sand represent the relationships between Re and Se. and The order relationships between nodes can be categorized as follows: "sand" represents the order of AND, meaning that the next node must be accessed from the previous one; "and" represents the AND relationship, where the order of the preceding nodes is not emphasized, but all nodes in the set must exist; and "or" represents the OR relationship, where only one node in the set is required.

[0049] Step S202: Generate a resource-directed attack tree based on the atomic attack node and the corresponding set of prerequisites and subsequent operations. In an optional implementation, step S202 includes:

[0050] Step S2021: Construct an atomic attack chain based on the atomic attack nodes and their corresponding sets of prerequisites and subsequent operations. Optionally, atomic attack nodes are categorized into resource nodes based on whether they involve resource acquisition. And atomic attack behavior nodes (behavior nodes) Resource nodes typically represent attacks that directly result in the access, acquisition, modification, or destruction of actual resources such as databases, servers, and files. Atomic attack behavior nodes represent attack behaviors that do not involve actual resources, such as port scanning or system probing. Based on this, an atomic attack chain (attack chain) is constructed. It should be noted that two resource nodes in the attack chain... There must be at least one node with an atomic attack behavior between them. The attack chain is first constructed according to the chronological order of the attack events, and then the relationships between the nodes need to be sorted out according to the theoretical logic.

[0051] Step S2022: Generate a resource-oriented attack tree based on preset resource nodes according to the atomic attack chain and sequence relationship. Optionally, the sequence relationship refers to Se and Re in step S201. The specific steps for generating the resource-oriented attack tree (attack tree) are as follows: Resource nodes involving key business and sensitive data... As the root node of the resource-oriented attack tree, it retrieves nodes forward in the attack chain where Se = pre and Re = sand until the atomic attack behavior node. The set of prerequisites It is an empty set. It should be noted that consecutive atomic attack nodes do not generate new tree nodes; they only occur when an empty set is encountered. For resource nodes New tree nodes are generated periodically, and a resource-oriented attack tree is constructed based on these nodes.

[0052] Step S203: Determine the attack probability of the root node in the resource-oriented attack tree based on the mapping table and the preset attack success probability calculation formula. Optionally, for the leaf nodes of the resource-oriented attack tree, the following formula (1) is used to calculate the attack success probability corresponding to the leaf node (resource node) based on real-time log alarm historical data analysis.

[0053]

[0054] Where, n sum Let n be the total number of attacks the resource node receives at time t. suc This represents the number of times the resource node was successfully attacked. Since there are only AND and OR relationships between sibling nodes in the attack tree, the preset attack success probability calculation formula includes the attack success probability calculation formula under the AND and OR order relationship. Under the AND relationship, the attack success probability of the parent node of child node i is shown in formula (2):

[0055]

[0056] Under the OR relationship, the probability of a successful attack on the parent node of child node i is shown in formula (3):

[0057]

[0058] Among them, P t (h i -1) represents the probability of a successful attack on the parent node of node i at time t. The superscripts AND and OR represent the corresponding order relationship. This represents a set of nodes at the same depth in the attack tree that share the same parent node. This represents the probability that node k is successfully attacked at time t. The probability that the parent node of node k at time t is successfully attacked needs to be calculated sequentially from the leaf nodes upwards. That is, when the current parent node is calculated upwards, it will become a sibling node. It can be understood that the search starts from the leaf node and moves towards the root node, recording the transition probability of child node i to the parent node in different attack trees. The transition probability of child node i to the parent node in the absence of other sibling nodes is shown in formula (4):

[0059]

[0060] Among them, P t (h i -1) represents the probability of a successful attack on the parent node of node i at time t. This represents the probability that node i is successfully attacked at time t. This represents the probability that the parent node of node i is successfully attacked at time t. It can be understood as the probability of attacking the root node of the resource-oriented attack tree tr at time t. It can be calculated from the child nodes according to the corresponding formula under the AND or OR relationship.

[0061] Step S204: Convert the resource-oriented attack tree into an attack sequence graph based on the mapping table and the attack probability of the root node. Optionally, the attack sequence graph can be converted into a graph model by retaining only the edges with the optimal transition probability according to the edge structure in the resource-oriented attack tree at different times, and the edges between two resource nodes in the graph structure can be expanded into atomic attack behavior nodes, that is, corresponding atomic attack behavior nodes can be added to the edges between two resource nodes. Specifically, the above step S204 includes:

[0062] Step S2041: Utilize a general vulnerability scoring system to determine the attack cost of nodes in the resource-oriented attack tree based on the mapping table. Optionally, a resource node may appear in multiple resource-oriented attack trees, and may also appear in different positions within the same resource-oriented attack tree. Let t be the time interval for the resource node... The set of subsequent operations to the atomic attack behavior node The transition probability of the Re=sand node is The transfer from a child node to a parent node in the attack tree involves an attack sub-chain consisting entirely of nodes performing atomic attack actions, based on the mapping table. The set of vulnerabilities involved in the collected attack subchains is denoted as . The attack cost from resource child node i to resource parent node j is shown in formula (5):

[0063]

[0064] Among them, AV v AC v AU v Vulnerability sets The attack path, attack complexity, and authentication element score of vulnerability v in CVSS (Common Vulnerability Scoring System).

[0065] Step S2042: Based on the preset optimization objective and constraints, calculate the optimal transition probability of resource nodes in the resource-oriented attack tree according to the attack cost and the attack probability of the root node. Optionally, calculate the optimal transition probability of all resource nodes based on the preset optimization objective and constraints shown in formula (6).

[0066]

[0067] Among them, cost i,j Let $\frac{i}{j}$ be the cost of attacking resource child node $i$ from resource parent node $j$. Let ed be the optimal transition probability from resource child node i to resource parent node j. trLet tr represent the set of all edges in the attack tree, where tr is any edge. The probability of attacking the root node of the tree tr at time t. This is the set of subsequent operations for the atomic attack behavior node.

[0068] Step S2043 involves converting resource-oriented attack trees with attack probabilities exceeding a preset threshold into attack sequence graphs based on the optimal transition probability and the mapping table. The attack sequence graph includes nodes and connecting edges; the weights of the edges dynamically change at different times, while the structure of the nodes and edges remains constant. Specifically, step S2043 includes:

[0069] Step a1: Obtain the temporal score of the vulnerability in the mapping table. Specifically, the temporal score of the vulnerability includes multiple aspects such as vulnerability disclosure, vulnerability information flow anomaly score, and vulnerability basic score. Step a1 includes:

[0070] Step a11: Obtain the vulnerability disclosure degree, vulnerability information flow anomaly score, and vulnerability basic score. Obtaining the vulnerability disclosure degree includes: obtaining the time interval from vulnerability discovery to disclosure; determining the vulnerability disclosure degree based on the time interval, vulnerability disclosure path influence factor, and vulnerability disclosure detail level influence factor. As an example, the vulnerability disclosure degree P is calculated using formula (7). t :

[0071] P t =e -β*t° ×c×d (7)

[0072] Where c represents the impact factor of vulnerability disclosure path, d represents the impact factor of vulnerability disclosure detail level, β is a preset parameter, β>0, and t° represents the time interval from vulnerability discovery to disclosure, with 24 hours as the interval unit. When a vulnerability is rapidly disclosed, e -β*t° It approaches 1, and conversely, it approaches 0.

[0073] In one optional implementation, the specific settings for the vulnerability disclosure path impact factor c and the vulnerability disclosure detail impact factor d are shown in Table 1 and Table 2, respectively:

[0074] Table 1. Impact Factors of Vulnerability Disclosure Channels

[0075] Manufacturers proactively disclose 0.8 Security researchers openly 0.6 Community open 0.4

[0076] Table 2. Factors affecting the level of detail in vulnerability disclosure

[0077]

[0078] Obtaining the vulnerability information flow anomaly score involves using the Isolation Forest algorithm to determine the vulnerability information flow anomaly score from multiple feature dimensions. Specifically, it involves calculating the Sys score of each vulnerability in the subsystem at time t based on the Isolation Forest algorithm. i Abnormal scores Sys subsystem was built based on vulnerability scanning tools. i Existing Vulnerability Set For each subsystem Sys i Calculate the time series score of information flow anomaly at time t. It should be noted that, since vulnerabilities in the entire system can be very complex, dividing it into multiple subsystems can reduce the complexity of the problem, making management and anomaly detection easier. This facilitates the detection of specific vulnerabilities in specific contexts, thereby improving detection accuracy. Furthermore, isolated forests require isolating normal data to detect anomalies; dividing the system into subsystems can better isolate noise and improve the efficiency of anomaly detection. Specifically, multiple feature dimensions include: data flow, control flow, interface interaction, and security features. Information from different periods of these feature dimensions is collected. For example, data flow includes, but is not limited to, the number of packets per second, the amount of data transmitted per second, the average packet size, and the standard deviation of packet size in the subsystem; control flow involves the system's control commands and policy configurations, including the sender, receiver, and command type; interface interaction involves the system's interface interactions with other systems, including the number, frequency, and data format of interfaces; security features involve the security attributes of the information flow, such as encryption, authentication, access control, and the transmission mode, latency, and response time of the information flow. These features are used as sample points for scoring. The specific scoring process is as follows:

[0079] First, an isolated forest is established from four aspects: data flow, control flow, interface interaction, and security features. Based on the entropy weight method, feature weights are calculated on the current node dataset (multiple sample points). The feature with the largest weight is selected and a split point on that feature is randomly selected to split the dataset. That is, a value (split point) is randomly selected from all feature values ​​corresponding to the feature as the dividing line to split the dataset.

[0080] Secondly, recursively divide the dataset into two subsets following the steps described above until the dataset cannot be divided further.

[0081] Next, calculate the path length h(x) of the sample point x in the tree.

[0082] From this point on, the subsystem Sys i An outlier point assigned to a leaf node of a tree by the Isolation Forest algorithm can be obtained by calculating the average path length of that subsystem across all trees. The outlier score of a sample point is calculated using the following formula. in, Let E(h(x)) be the anomaly score of sample point i at time t in the k-th feature dimension, E(h(x)) be the average path length of the subsystem in all trees, and c(n) be the average path length for a given number of samples n.

[0083] Finally, the vulnerability set is obtained by weighted aggregation of the anomaly scores of sample point i at time t across multiple feature dimensions. Each vulnerability is in the Sys subsystem. i Abnormal scores Among them, w k The weights corresponding to the k-th feature dimension can be determined based on the actual Sys i Adjustments were made based on information flow characteristics and security protection requirements. Vulnerability set. The information flow anomaly score for each vulnerability is: Where i is the subsystem number.

[0084] Step a12: Determine the timing score of the vulnerability based on the product of the vulnerability disclosure, the vulnerability information flow anomaly score, and the vulnerability base score. Specifically, the timing score of a single vulnerability within the system is calculated using the following formula (8):

[0085] S t =A t ×P t ×BS (8)

[0086] Among them, S t Let A be the time series score of a single vulnerability within the system at time t. t The information flow anomaly score is given for a single vulnerability. BS is the vulnerability baseline score, which can be determined through the CVSS scoring system.

[0087] Step a2: Determine the weights of the connecting edges based on the temporal score and the optimal transition probability. Optionally, an attack chain in the attack temporal graph, consisting of one or more attack behavior nodes plus resource nodes at both ends, is represented as follows:

[0088]

[0089] in, and The resource nodes at both ends are calculated according to formula (9). Towards transition probability

[0090]

[0091] in, yes The sum of the time-series scores of all individual vulnerability nodes in the corresponding vulnerability set in the mapping table at time τ. T is the preset period. It is up to time t. The standard deviation of all time series data (time series scores), For resource nodes For the corresponding optimal transition probability, please refer to the detailed calculation method. Figure 2 Step S2042 of the illustrated embodiment.

[0092] Step a3: Generate an adjacency matrix corresponding to the attack sequence graph where the attack probability is greater than a preset threshold, based on the weights of the connecting edges. Specifically, ... As at time t point to The weight of the corresponding connecting edge (directed edge) will Mapping the nodes to all attack nodes yields N nodes, from which an adjacency matrix of the attack sequence graph is constructed. The weights of edges without connections are set to 0, thus obtaining the adjacency matrix corresponding to attack sequence graphs with attack probabilities exceeding a preset threshold.

[0093] Step S205 involves clustering the attack sequence graph using an autoencoder and self-organizing map algorithm to obtain the maximum attack path. For details, please refer to [link to details]. Figure 1 Step S105 of the illustrated embodiment will not be described again here.

[0094] This embodiment provides a method for generating the maximum attack path based on attack tree and time sequence graph clustering, which can be used in the aforementioned mobile terminals, such as central processing units and servers. Figure 3 This is a flowchart illustrating another method for generating the maximum attack path based on attack tree and temporal graph clustering according to an embodiment of the present invention, as shown below. Figure 3 As shown, the process includes the following steps:

[0095] Step S301: Obtain the mapping table between atomic attack behaviors and vulnerabilities, the atomic attack nodes, and the sets of prerequisites and subsequent operations corresponding to the atomic attack nodes. For details, please refer to [link to relevant documentation]. Figure 2 Step S201 of the illustrated embodiment will not be described again here.

[0096] Step S302: Generate a resource-directed attack tree based on the atomic attack node and its corresponding set of prerequisites and subsequent operations. For details, please refer to [link to relevant documentation]. Figure 2 Step S202 of the illustrated embodiment will not be described again here.

[0097] Step S303: Determine the attack probability of the root node in the resource-oriented attack tree based on the mapping table and the preset attack success probability calculation formula. For details, please refer to [link to relevant documentation]. Figure 2 Step S203 of the illustrated embodiment will not be described again here.

[0098] Step S304: Based on the mapping table and the attack probability of the root node, the resource-guided attack tree is converted into an attack sequence diagram. For details, please refer to [link to relevant documentation]. Figure 2 Step S204 of the illustrated embodiment will not be described again here.

[0099] Step S305 involves clustering the attack sequence graph using an autoencoder and self-organizing map algorithm to obtain the maximum attack path. In an optional implementation, step S305 includes:

[0100] Step S3051 involves constructing an autoencoder based on a graph neural network and a long short-term memory network. Optionally, a GCN-LSTM (Graph Convolution Network-Long Short-Term Memory Network) autoencoder is used to achieve a low-dimensional representation of the adjacency matrix of the attack sequence graph at different time points. Specifically, step S3051 includes:

[0101] Step b1: Design an encoder to obtain the adjacency matrix at different times. Dimensionality reduction coding Represented as:

[0102]

[0103] Where σ(·) is the sigmoid activation function, j is the neighboring node of node i, and Neigh(·) represents calculating the set of neighboring nodes of the input node. D, which is to be learned out ×N-dimensional weight matrix, D out The dimension of the output dimension reduction encoding vector is set.

[0104] Step b2, using LSTM as the decoder, the decoding process is shown in steps b21 to b24:

[0105] Step b21: Initialize the initial hidden state h0 and cell state c0 of the LSTM decoder.

[0106] Step b22, the LSTM forward propagation performs the forget gate f according to the following formula. t Input gate in t Output gate OUT t The calculation of cell state c0 and hidden state h0, and the update of cell state c0:

[0107]

[0108]

[0109]

[0110] Among them, W f W in W out Forget Gate f t Input gate in t Output gate OUT t The corresponding weight matrix to be learned, b f b in b out It is the corresponding bias vector. For input parameters, Adjacency matrices at different times The dimensionality reduction encoding representation, h t-1 The hidden state at time t-1. The candidate cell state is calculated using the following formula (13).

[0111]

[0112] Among them, W c b is the weight matrix to be learned corresponding to the cell state update. c is the corresponding bias vector, and tanh is the hyperbolic tangent function. The cell state c is updated using the following formula (14). t :

[0113]

[0114] Among them, f t For the Gate of Oblivion, c t-1 The cell state at time t-1, in t For the input gate, ⊙ represents element-wise multiplication. The hidden state h is updated using the following formula (15). t :

[0115] h t =out t ⊙tanh(c t (15)

[0116] Among them, out t For the output gate, ⊙ represents element-wise multiplication, tanh is the hyperbolic tangent function, and c t It is in the cellular state.

[0117] Step b23, calculate the output value R t =W r ·h t +b r Among them, W r It is the total weight to be learned, b r It is the total bias vector.

[0118] Step b24, LSTM backpropagation parameter update, using stochastic gradient descent based on the following loss function. Update the learnable parameters in the encoder and decoder. Let be the element in the i-th row and j-th column of the adjacency matrix at time t. Let t be the output value corresponding to the element in the i-th row and j-th column of the adjacency matrix at time t, and N be the number of elements in the adjacency matrix.

[0119] Step S3052: The adjacency matrix is ​​reduced in dimensionality using an autoencoder to obtain a low-dimensional vector representation of the nodes in the attack sequence graph. Steps b21 to b24 are repeated to train the autoencoder until it converges, yielding a low-dimensional representation of each node in the attack sequence graph. use Perform temporal clustering based on SOM (Self-Organizing Map).

[0120] Step S3053: Convert the low-dimensional vector representation into a temporal triple. Specifically, this involves converting the low-dimensional representation of a single node in the attack time series graph at time t. It is a D out A vector of ×1, representing each node at different times and in different dimensions. The numerical data in the matrix, after normalization, are represented as follows: in, t Δ =1,2...T-1, for time t Δ In terms of different dimensions f Z of Canopy clustering based on Euclidean distance is performed using preset parameters T1 and T2 for fast clustering, representing different low-dimensional representation dimensions. They were obtained respectively The number of clusters, denoted as cluster center. Calculate all data points under different low-dimensional representation dimensions The Euclidean distance to each cluster center is obtained t Δ The formula for calculating the Canopy-Jaccard distance between different nodes i and j at time t is shown in formula (16):

[0121]

[0122] in, f is the number of clusters. Z for Dimensions Let be the Euclidean distances from nodes i and j to the cluster centers, respectively. Further processing according to the numerical differences between different time series sequences into triplet form, denoted as:

[0123]

[0124] in,

[0125] Step S3054 involves using the Self-Organizing Map (SOM) algorithm to determine key nodes in the attack time series graph based on temporal triples and a preset distance formula. The preset distance formula is determined by the Canopy clustering algorithm and Jaccard distance. Optionally, the competitive layer of the three-dimensional SOM algorithm uses the number of multivariate temporal data clusters determined by the initial Canopy clustering results as the first dimension of the SOM competitive layer, and uses the feature dimension and time series length of the multivariate temporal data as the second and third dimensions of the SOM competitive layer. Specifically, step S3054 includes:

[0126] Step c1, initial competition layer construction, will Consider N×D as cellular data out The three-dimensional matrix of ×(T-1) is used as the input data for the SOM, and the time t is recorded as follows: Δ Different f Z The cluster centers of different clusters under the dimension are To perform Canopy-Jaccard distance calculation, calculate the distance at different times t. Δ Different f Z Mean number of clusters under dimension Set the competition layer as Calculate the time t of each node. Δ Different f Z The sum of distances in dimension from its cluster center is denoted as . in, Refers to t Δ Time f Z The cluster centers of the cluster to which node i belongs in dimension 1 are selected to extract the dft. i smallest The corresponding nodes Data serves as the initial competition layer.

[0127] Step c2, input node data In the time dimension v, the winning neuron is found according to the Canopy-Jaccard distance. The winning neighborhood radius is determined using the following formula:

[0128]

[0129]

[0130] Where g is the number of iterations, and the neighborhood of the winning neuron is... The learning rate of neuron r' within the cell The update is shown in formula (19):

[0131]

[0132] Step c3, follow the steps in step c2 Update the competitive layer neurons The weight matrix of the competition layer is then corrected both forward and backward. Specifically, the update of each data point involves itself and the K data points preceding and following it in its time series. w For each data element, if t′=0, the update of the weight matrix involves both the element itself and the subsequent K data elements in its time series. w For each data element, the update formula for the current t′ is as follows:

[0133]

[0134]

[0135] For time t′+k, k = ±1, ±2, ..., ±K w The updated formula is shown below:

[0136]

[0137]

[0138] Step c4: After the iteration ends or the algorithm converges, map the neurons in the competition layer to the actual nodes according to the Canopy-Jaccard distance. Treat each neuron as a cluster center, and the nodes in the attack sequence graph are assigned to the cluster represented by the nearest cluster center. The node closest to the neuron is regarded as the cluster center of that class, and the Canopy-Jaccard distance is recalculated. DFT i The smallest node is designated as the critical node.

[0139] Step S3055: Determine the maximum attack path based on the weights of the key node and the connecting edges. Optionally, based on the adjacency matrix at the latest time step, the node with the largest edge weight among the neighbors pointing to the key node is taken as the predecessor node, and the process is repeated forward until the edge weight is less than the lower quartile of the overall edge weight. The node with the largest edge weight among the neighbors pointed to by the key node is taken as the successor node, and the process is repeated backward until the edge weight is less than the lower quartile of the overall edge weight. The maximum attack path is thus generated.

[0140] In one alternative implementation, Figure 4 This is a schematic diagram of the overall framework of the maximum attack path generation method based on attack tree and temporal graph clustering according to an embodiment of the present invention. Figure 4 As shown, firstly, the vulnerability disclosure, vulnerability threat level CVSS basic score (vulnerability base score), and system information flow time-series score (vulnerability information flow anomaly score) are obtained. The system information flow time-series score is determined by log statistics and the vulnerability's impact scope (including vulnerability location and security metrics of the systems affected by the vulnerability). Based on the above information, a score is assigned to each individual node of the vulnerability within the system. Specifically, the vulnerability's time-series score is determined by multiplying the vulnerability disclosure, vulnerability information flow anomaly score, and vulnerability base score. For details, please refer to [link to relevant documentation]. Figure 2 Step a1 of the illustrated embodiment will not be repeated here. Then, resource-oriented attack tree construction is performed, including atomic attack chain construction, resource node transfer probability calculation, and resource-oriented attack tree generation. For details, please refer to [link to relevant documentation]. Figure 2 Step 202 of the illustrated embodiment will not be repeated here. Next, a resource-oriented attack tree to attack graph conversion is performed, including resource-oriented attack tree filtering, attack behavior node expansion, and temporal attack graph construction. For details, please refer to [link to relevant documentation]. Figure 2 Step 204 of the illustrated embodiment will not be repeated here. Finally, key node mining based on temporal attack graph clustering is performed, including node dimensionality reduction encoding based on a single-layer GCN-LSTM autoencoder, calculation of canopy-Jaccard distance for node dimensionality reduction encoded data, construction of a 3D SOM competition layer, and updating of the competition layer based on the 3D SOM. For details, please refer to [link to relevant documentation]. Figure 2 Step 205 of the illustrated embodiment will not be repeated here.

[0141] This embodiment performs temporal collection and analysis of vulnerability information. Combining atomic attack chains, resource-oriented attack trees, and temporal attack graphs, it utilizes an autoencoder and an improved three-dimensional self-organizing map (SOM) algorithm to generate a low-dimensional, discrete mapping by learning from the data in the input space, achieving dimensionality reduction. Cluster analysis is then performed on the SOM competition layer, achieving the goals of comprehensively understanding threats, optimizing defense strategies, detecting advanced threats, visualizing attack behavior, meeting compliance and regulatory requirements, and providing better security decision support. This ultimately improves network security, reduces the risk of potential attacks, and ensures the continuity and reliability of critical infrastructure.

[0142] This embodiment also provides a maximum attack path generation device based on attack tree and time sequence graph clustering. This device is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0143] This embodiment provides a maximum attack path generation device based on attack tree and temporal graph clustering, such as Figure 5 As shown, it includes: an acquisition module 501, used to acquire a mapping table of atomic attack behaviors and vulnerabilities, atomic attack nodes, and the sets of prerequisites and subsequent operations corresponding to the atomic attack nodes; an attack tree generation module 502, used to generate a resource-oriented attack tree based on the atomic attack nodes and the sets of prerequisites and subsequent operations corresponding to the atomic attack nodes; an attack probability determination module 503, used to determine the attack probability of the root node in the resource-oriented attack tree based on the mapping table and a preset attack success probability calculation formula; a timing graph generation module 504, used to convert the resource-oriented attack tree into an attack timing graph based on the mapping table and the attack probability of the root node; and an attack path acquisition module 505, used to cluster the attack timing graph using an autoencoder and a self-organizing map algorithm to obtain the maximum attack path.

[0144] In one optional implementation, the atomic attack node, the set of prerequisites, and the set of subsequent operations include resource nodes and atomic attack behavior nodes. The resource nodes and atomic attack behavior nodes are used to distinguish whether the atomic attack involves resource acquisition. The set of prerequisites and the set of subsequent operations include the sequential relationship between the nodes in the set and the atomic attack node. The attack tree generation module includes: an attack chain construction unit, used to construct an atomic attack chain based on the atomic attack node and the set of prerequisites and the set of subsequent operations corresponding to the atomic attack node; and an attack tree generation unit, used to generate a resource-oriented attack tree based on preset resource nodes, the atomic attack chain, and the sequential relationship.

[0145] In one optional implementation, the timing diagram generation module includes: an attack cost determination unit, used to determine the attack cost of nodes in the resource-oriented attack tree according to a mapping table using a general vulnerability scoring system; a transition probability calculation unit, used to calculate the optimal transition probability of resource nodes in the resource-oriented attack tree based on the attack cost and the attack probability of the root node according to a preset optimization objective and constraints; and a conversion unit, used to convert resource-oriented attack trees with attack probabilities greater than a preset threshold into attack timing diagrams according to the optimal transition probability and the mapping table.

[0146] In one optional implementation, the attack sequence graph includes nodes and connecting edges. The transformation unit includes: an acquisition subunit for acquiring the timing score of the vulnerability in the mapping table; a weight determination subunit for determining the weight of the connecting edge based on the timing score and the optimal transition probability; and an adjacency matrix generation subunit for generating an adjacency matrix corresponding to the attack sequence graph with an attack probability greater than a preset threshold based on the weight of the connecting edge.

[0147] In one optional implementation, the attack path acquisition module includes: an autoencoder construction unit for constructing an autoencoder based on a graph neural network and a long short-term memory network; a dimensionality reduction unit for using the autoencoder to reduce the dimensionality of the adjacency matrix to obtain a low-dimensional vector representation of the nodes in the attack time sequence graph; a triplet conversion unit for converting the low-dimensional vector representation into temporal triplets; a key node determination unit for using a self-organizing map algorithm to determine key nodes in the attack time sequence graph based on the temporal triplets and a preset distance formula, wherein the preset distance formula is determined by the Canopy clustering algorithm and Jaccard distance; and an attack path determination unit for determining the maximum attack path based on the key nodes and the weights of the connecting edges.

[0148] In one optional implementation, the acquisition sub-unit includes: a scoring acquisition sub-module, used to acquire vulnerability disclosure, vulnerability information flow anomaly score, and vulnerability basic score; and a time-series scoring determination sub-module, used to determine the time-series score of the vulnerability based on the product of vulnerability disclosure, vulnerability information flow anomaly score, and vulnerability basic score.

[0149] In one optional implementation, the scoring acquisition submodule is specifically used to: acquire the time interval between the discovery and public disclosure of a vulnerability; determine the vulnerability disclosure degree based on the time interval, the vulnerability disclosure path influence factor, and the vulnerability disclosure detail influence factor; determine the vulnerability information flow anomaly score from multiple feature dimensions using the isolated forest algorithm; and determine the vulnerability basic score based on a general vulnerability scoring system.

[0150] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0151] In this embodiment, the maximum attack path generation device based on attack tree and timing graph clustering is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0152] This invention also provides a computer device having the above-described features. Figure 5 The maximum attack path generation device shown is based on attack tree and time sequence graph clustering.

[0153] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 6As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 6 Take a processor 10 as an example.

[0154] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0155] The memory 20 stores instructions executable by at least one processor 10 to cause at least one processor 10 to perform the method shown in the above embodiments.

[0156] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0157] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0158] The computer device also includes a communication interface 30 for communicating with other devices or communication networks.

[0159] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0160] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for generating the maximum attack path based on attack tree and temporal graph clustering, characterized in that, The method includes: Obtain a mapping table of atomic attack behaviors and vulnerabilities, atomic attack nodes, and the set of prerequisites and subsequent operations corresponding to the atomic attack nodes; A resource-directed attack tree is generated based on the atomic attack node and the set of prerequisites and subsequent operations corresponding to the atomic attack node. The attack probability of the root node in the resource-oriented attack tree is determined based on the mapping table and the preset attack success probability calculation formula. Based on the mapping table and the attack probability of the root node, the resource-guided attack tree is converted into an attack sequence diagram. The attack sequence graph is clustered using autoencoders and self-organizing map algorithms to obtain the maximum attack path; The atomic attack node, the prerequisite set, and the subsequent operation set include resource nodes and atomic attack behavior nodes. The resource nodes and atomic attack behavior nodes are used to distinguish whether an atomic attack involves resource acquisition. The prerequisite set and the subsequent operation set include the order relationship between nodes in the set and the atomic attack node. Generating a resource-oriented attack tree based on the atomic attack node and its corresponding prerequisite set and subsequent operation set includes: Construct an atomic attack chain based on the atomic attack node and the set of prerequisites and subsequent operations corresponding to the atomic attack node; Based on preset resource nodes, a resource-guided attack tree is generated according to the atomic attack chain and the sequential relationship; The step of converting the resource-guided attack tree into an attack sequence diagram based on the mapping table and the attack probability of the root node includes: The attack cost of nodes in the resource-oriented attack tree is determined by using a general vulnerability scoring system based on a mapping table; Based on the preset optimization objectives and constraints, the optimal transition probability of resource nodes in the resource-oriented attack tree is calculated according to the attack cost and the attack probability of the root node. Based on the optimal transition probability and the mapping table, resource-oriented attack trees with attack probabilities greater than a preset threshold are converted into attack sequence diagrams.

2. The maximum attack path generation method based on attack tree and temporal graph clustering according to claim 1, characterized in that, The attack sequence graph includes nodes and connecting edges. The step of converting resource-oriented attack trees with attack probabilities greater than a preset threshold into an attack sequence graph based on the optimal transition probability and the mapping table includes: Obtain the timing score of vulnerabilities in the mapping table; The weights of the connecting edges are determined based on the time-series scores and the optimal transition probabilities. Based on the weights of the connecting edges, an adjacency matrix is ​​generated corresponding to the attack sequence graph where the attack probability is greater than a preset threshold.

3. The maximum attack path generation method based on attack tree and temporal graph clustering according to claim 2, characterized in that, The step of clustering the attack sequence graph using autoencoders and self-organizing maps to obtain the maximum attack path includes: An autoencoder is constructed based on graph neural networks and long short-term memory networks; The adjacency matrix is ​​reduced in dimensionality using the autoencoder to obtain a low-dimensional vector representation of the nodes in the attack sequence graph. The low-dimensional vector representation is converted into a temporal triple; The key nodes in the attack timing graph are determined using the self-organizing map algorithm based on the temporal triplet and a preset distance formula, wherein the preset distance formula is determined by the Canopy clustering algorithm and Jaccard distance. The maximum attack path is determined based on the weights of the key nodes and connecting edges.

4. The maximum attack path generation method based on attack tree and temporal graph clustering according to claim 2, characterized in that, Obtain the time-series scores of vulnerabilities in the mapping table, including: Obtain vulnerability disclosure, vulnerability information flow anomaly score, and basic vulnerability score; The time-series score of a vulnerability is determined by multiplying the vulnerability disclosure, the vulnerability information flow anomaly score, and the vulnerability base score.

5. The maximum attack path generation method based on attack tree and temporal graph clustering according to claim 4, characterized in that, The acquisition of vulnerability disclosure, vulnerability information flow anomaly score, and vulnerability basic score includes: Obtain the time interval between the discovery and public disclosure of a vulnerability; The vulnerability disclosure degree is determined based on the time interval, the impact factor of the vulnerability disclosure method, and the impact factor of the detail of the vulnerability disclosure. Anomaly scores for vulnerability information flow were determined using the isolated forest algorithm across multiple feature dimensions. The basic vulnerability score is determined based on a general vulnerability scoring system.

6. A maximum attack path generation device based on attack tree and temporal graph clustering, characterized in that, The device includes: The acquisition module is used to acquire a mapping table of atomic attack behaviors and vulnerabilities, atomic attack nodes, and the set of prerequisites and subsequent operations corresponding to the atomic attack nodes. The attack tree generation module is used to generate a resource-oriented attack tree based on the atomic attack node and the set of prerequisites and subsequent operations corresponding to the atomic attack node. An attack probability determination module is used to determine the attack probability of the root node in the resource-oriented attack tree based on the mapping table and a preset attack success probability calculation formula. The timing diagram generation module is used to convert the resource-guided attack tree into an attack timing diagram based on the mapping table and the attack probability of the root node. The attack path acquisition module is used to cluster the attack sequence graph using an autoencoder and a self-organizing map algorithm to obtain the maximum attack path. The atomic attack node, the prerequisite set, and the subsequent operation set include resource nodes and atomic attack behavior nodes. The resource nodes and atomic attack behavior nodes are used to distinguish whether an atomic attack involves resource acquisition. The prerequisite set and the subsequent operation set include the order relationship between nodes in the set and the atomic attack node. Generating a resource-oriented attack tree based on the atomic attack node and its corresponding prerequisite set and subsequent operation set includes: Construct an atomic attack chain based on the atomic attack node and the set of prerequisites and subsequent operations corresponding to the atomic attack node; Based on preset resource nodes, a resource-guided attack tree is generated according to the atomic attack chain and the sequential relationship; The step of converting the resource-guided attack tree into an attack sequence diagram based on the mapping table and the attack probability of the root node includes: The attack cost of nodes in the resource-oriented attack tree is determined by using a general vulnerability scoring system based on a mapping table; Based on the preset optimization objectives and constraints, the optimal transition probability of resource nodes in the resource-oriented attack tree is calculated according to the attack cost and the attack probability of the root node. Based on the optimal transition probability and the mapping table, resource-oriented attack trees with attack probabilities greater than a preset threshold are converted into attack sequence diagrams.

7. The maximum attack path generation device based on attack tree and temporal graph clustering according to claim 6, characterized in that, The atomic attack node, the prerequisite set, and the subsequent operation set include resource nodes and atomic attack behavior nodes. The resource nodes and atomic attack behavior nodes are used to distinguish whether an atomic attack involves resource acquisition. The prerequisite set and the subsequent operation set include the order relationship between the nodes in the set and the atomic attack node. The attack tree generation module includes: An attack chain construction unit is used to construct an atomic attack chain based on the atomic attack node and the set of prerequisites and subsequent operations corresponding to the atomic attack node. The attack tree generation unit is used to generate a resource-oriented attack tree based on preset resource nodes, the atomic attack chain, and the sequential relationship.

8. The maximum attack path generation device based on attack tree and temporal graph clustering according to claim 7, characterized in that, The timing diagram generation module includes: The attack cost determination unit is used to determine the attack cost of a node in the resource-oriented attack tree based on a mapping table using a general vulnerability scoring system. The transition probability calculation unit is used to calculate the optimal transition probability of resource nodes in the resource-oriented attack tree based on the attack cost and the attack probability of the root node, according to the preset optimization target and constraints. The conversion unit is used to convert resource-oriented attack trees with attack probabilities greater than a preset threshold into attack sequence diagrams based on the optimal transition probability and the mapping table.

9. The maximum attack path generation device based on attack tree and temporal graph clustering according to claim 8, characterized in that, The attack sequence graph includes nodes and connecting edges, and the transformation unit includes: Get the sub-unit, used to obtain the timing score of the vulnerability in the mapping table; The weight determination subunit is used to determine the weight of the connecting edge based on the time series score and the optimal transition probability; The adjacency matrix generation sub-unit is used to generate an adjacency matrix corresponding to an attack sequence graph with an attack probability greater than a preset threshold based on the weight of the connecting edges.

10. The maximum attack path generation device based on attack tree and temporal graph clustering according to claim 9, characterized in that, The attack path acquisition module includes: Autoencoder building unit, used to build autoencoders based on graph neural networks and long short-term memory networks; The dimensionality reduction unit is used to perform dimensionality reduction processing on the adjacency matrix using the autoencoder to obtain a low-dimensional vector representation of the nodes in the attack sequence graph. The triplet conversion unit is used to convert the low-dimensional vector representation into a temporal triplet; The critical node determination unit is used to determine the critical nodes in the attack timing graph using the self-organizing map algorithm based on the temporal triplet and the preset distance formula, wherein the preset distance formula is determined by the Canopy clustering algorithm and Jaccard distance. The attack path determination unit is used to determine the maximum attack path based on the weights of the key nodes and connecting edges.

11. The maximum attack path generation device based on attack tree and temporal graph clustering according to claim 9, characterized in that, Acquiring sub-units includes: The scoring acquisition submodule is used to obtain vulnerability disclosure, vulnerability information flow anomaly score, and vulnerability basic score; The timing score determination submodule is used to determine the timing score of a vulnerability based on the product of the vulnerability disclosure, the vulnerability information flow anomaly score, and the vulnerability base score.

12. The maximum attack path generation device based on attack tree and temporal graph clustering according to claim 11, characterized in that, The scoring acquisition submodule is specifically used for: Obtain the time interval between the discovery and public disclosure of a vulnerability; The vulnerability disclosure degree is determined based on the time interval, the impact factor of the vulnerability disclosure method, and the impact factor of the detail of the vulnerability disclosure. Anomaly scores for vulnerability information flow were determined using the isolated forest algorithm across multiple feature dimensions. The basic vulnerability score is determined based on a general vulnerability scoring system.

13. A computer device, characterized in that, include: A memory and a processor are interconnected, the memory stores computer instructions, and the processor executes the maximum attack path generation method based on attack tree and temporal graph clustering as described in any one of claims 1 to 5 by executing the computer instructions.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the maximum attack path generation method based on attack tree and temporal graph clustering as described in any one of claims 1 to 5.

Images