0day attack path prediction method and system based on knowledge graph for network security

Abstract

The present invention discloses a 0day attack path prediction method and system for a knowledge graph for network security. The method includes: constructing a knowledge graph between an attacker entity and a device entity; predicting the link relationship between the attacker entity and the device entity according to a neural network; the prediction of the link relationship between the attacker entity and the device entity according to the neural network includes: the neural network predicts the gain of each attack path in each sub-attack graph, and selects the attack path corresponding to the maximum value from the gains of all attacks as the 0day attack path. The present invention provides a 0day attack path prediction method and system for a knowledge graph for network security, which solves the technical problems of low prediction accuracy and poor timeliness in the process of predicting the route of network attacks.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of information security technology in the field of data processing technology, and in particular to a method and system for predicting 0day attack paths based on a knowledge graph for network security. Background Art

[0002] Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a branch of computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making. Research in the field of artificial intelligence includes robotics, natural language processing, computer vision, decision-making and reasoning, human-computer interaction, recommendation and search, basic AI theory, etc.

[0003] During the network attack and defense process, the attacker and defender may have multiple strategies to choose from. Different defense strategies will produce different security benefits for specific attack strategies. Limited by resources, capabilities, and preferences, the defender faces the decision-making problem of optimizing the configuration of defense resources, selecting the optimal defense strategy, and maximizing benefits. Traditional network defense decision-making methods rely more on subjective judgment based on experience, and it is difficult to provide effective and reliable suggestions for network security managers to select defense strategies.

[0004] However, during the network attack and defense process, the defender faces technical problems such as low prediction accuracy and poor timeliness in predicting the route of network attacks. Summary of the invention

[0005] In order to solve at least one of the technical problems mentioned above, the present invention provides a 0day attack path prediction method and system for a knowledge graph for network security.

[0006] First, a 0day attack path prediction method based on a knowledge graph for network security is provided, including:

[0007] Build a knowledge graph between attacker entities and device entities;

[0008] Predict the link relationship between the attacker entity and the device entity based on the neural network;

[0009] The method of predicting the link relationship between the attacker entity and the device entity based on the neural network includes: the neural network predicts the attack gain of each attack path in each sub-attack graph, and selects the attack path corresponding to the maximum value from all attack gains as the 0day attack path.

[0010] Preferably, predicting the attack gain of each attack path in each sub-attack graph according to the neural network includes:

[0011] The single-step attack gain is the profit obtained by the attacker for each attack step, which can be expressed as: Gi = BiBi+1 / Ci; where Bi and Bi+1 are the threat values ​​of the invading network node and the decision-making layer network node i and i+1 to the network, that is, the single-step attack gain from node i to i+1; Ci is the attack cost of attacking node Si; the total attack gain in, The total attack cost for an attack sequence or an attack path.

[0012] Preferably, the total attack cost of an attack sequence or an attack path is expressed as

[0013] E i It consists of two parts: operating cost P(i) and risk cost Risk(i).

[0014] Preferably, the method predicts the attack gain of each attack path in each sub-attack graph according to the neural network, selects the attack path corresponding to the maximum value from all attack gains as the 0day attack path, and then includes:

[0015] Get the probability Pm of successful exploitation of the mth vulnerability in the attack path with the largest attack gain;

[0016] If Pm is greater than the preset value, m vulnerabilities are initially considered as abnormal nodes.

[0017] Preferably, the method of obtaining the vulnerability exploitation success probability Pm of the mth vulnerability in the attack path with the largest attack gain comprises:

[0018] Get the attacker's knowledge proficiency and total number of vulnerabilities;

[0019] The probability of successful exploitation Pm is obtained based on the attacker's proficiency in knowledge and the number of vulnerability attacks;

[0020]

[0021] k is the attacker’s proficiency in knowledge, and k∈[0,1]; Ni is the total number of vulnerabilities; t is the number of attacks by the attacker on vulnerability m.

[0022] Preferably, the target program provides normal parameters, environment variables and all settings to ensure the normal operation of the program, and records the instruction sequence g1 of the normal execution of the program;

[0023] The set of parameters that triggered the exception during the fuzz testing process is used as input and passed to the target program. Other settings remain unchanged and the program execution sequence g2 that triggered the exception is recorded.

[0024] Compare the instruction sequences of the two rounds of execution, focus on analyzing the code areas that perform differently during the two executions, and combine static reverse engineering and dynamic debugging and tracing methods to analyze this part of the code to locate the abnormal nodes.

[0025] Secondly, a 0day attack path prediction method system based on a knowledge graph for network security is provided, including:

[0026] Modeling module, used to build a knowledge graph between attacker entities and device entities;

[0027] A prediction module, used to predict the link relationship between the attacker entity and the device entity based on the neural network;

[0028] The processing module is used by the neural network to predict the attack gain of each attack path in each sub-attack graph, and select the attack path corresponding to the maximum value from all attack gains as the 0day attack path.

[0029] Preferably, the probability acquisition module is used to obtain the vulnerability exploitation success probability Pm of the mth vulnerability in the attack path with the largest attack gain;

[0030] The positioning module is used to initially identify m vulnerabilities as abnormal nodes if Pm is greater than a preset value.

[0031] In a third aspect, an electronic device is provided, comprising: a processor, a sending device, an input device, an output device and a memory, wherein the memory is used to store computer program code, the computer program code comprises computer instructions, and when the processor executes the computer instructions, the electronic device executes the 0day attack path prediction method for the knowledge graph for network security as described above.

[0032] In a fourth aspect, a computer-readable storage medium is provided, in which a computer program is stored. The computer program includes program instructions, and when the program instructions are executed by a processor of an electronic device, the processor executes the 0day attack path prediction method for the knowledge graph for network security as described above.

[0033] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the background technology, the drawings required for use in the embodiments of the present application or the background technology will be described below.

[0035] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used to illustrate the technical solutions of the present disclosure together with the specification.

[0036] Figure 1 A schematic diagram of a process flow of a 0day attack path prediction method for a knowledge graph for network security provided in an embodiment of the present application;

[0037] Figure 2 Another schematic diagram of the process of predicting a 0day attack path based on a knowledge graph for network security provided in an embodiment of the present application;

[0038] Figure 3 A schematic diagram of the structure of a 0day attack path prediction system based on a network defense knowledge graph provided in an embodiment of the present application;

[0039] Figure 4 A schematic diagram of the hardware structure of a 0day attack path prediction system based on a network defense knowledge graph provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0042] The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C can represent including any one or more elements selected from the set consisting of A, B, and C.

[0043] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0044] In addition, in order to better illustrate the present invention, numerous specific details are provided in the following specific embodiments. It should be understood by those skilled in the art that the present invention can be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present invention.

[0045] Example 1

[0046] This application provides a 0day attack path prediction method for network security knowledge graph, such as Figure 1-2 As shown, including:

[0047] Step S10, constructing a knowledge graph between the attacker entity and the device entity;

[0048] Step S10, constructing a knowledge graph of perception vectors, decision vectors, and execution vectors;

[0049] According to the transformation-based model between entity vectors and relationship vectors as well as entity vectors and relationship paths, relationship triples (h, r, t) and path triples (h, p, t) are established.

[0050] Step S20, predicting the link relationship between the attacker entity and the device entity according to the neural network;

[0051] Step S20, predicting the link relationship between the attacker entity and the device entity according to the neural network specifically includes: the neural network predicts the attack gain of each attack path in each sub-attack graph, and selects the attack path corresponding to the maximum value from all attack gains as the 0day attack path.

[0052] In this application, the proposed method can rely on the knowledge system provided by the knowledge graph to provide more comprehensive knowledge support for attack prediction, reduce the dependence of prediction analysis on expert models, and better overcome the adverse effects of the unknown nature of 0day vulnerabilities on prediction analysis, thereby improving the accuracy of 0day attack predictions. In addition, by predicting the link relationship between the attacker entity and the device entity based on the neural network, the reasons for the formation of the inference results can be effectively traced back, thereby improving the interpretability of the attack prediction analysis results to a certain extent.

[0053] Preferably, predicting the attack gain of each attack path in each sub-attack graph according to the neural network includes:

[0054] The single-step attack gain is the profit obtained by the attacker for each attack step, which can be expressed as: Gi = BiBi+1 / Ci; where Bi and Bi+1 are the threat values ​​of the invading network node and the decision-making layer network node i and i+1 to the network, that is, the single-step attack gain from node i to i+1; Ci is the attack cost of attacking node Si; the total attack gain in, The total attack cost for an attack sequence or an attack path.

[0055] Preferably, the total attack cost of an attack sequence or an attack path is expressed as

[0056] E i It consists of two parts: operating cost P(i) and risk cost Risk(i).

[0057] In the cost analysis of attack behavior, a mathematical model of operation cost is proposed:

[0058] P(i)=μ×cost(Meta-operations)+η×cost(Sequence),i∈n,

[0059] Among them: cost(Meta-operation) represents the meta-operation cost of network node attack, and the calculation result depends on the meta-operation itself and the usage of resources; cost(Sequence) represents the operation sequence cost of network node attack; μ represents the probability value of network node attack; η represents the path redundancy with low correlation in the network node attack path.

[0060] During the attack, the attacker also has to bear the risk of being discovered by the network administrator, that is, pay the corresponding risk cost Risk(i). Therefore, the risk cost factor must be considered when conducting a cost analysis of the attack behavior, and Risk(i) is related to factors such as network security risk coefficient, attacker experience, and operating cost.

[0061] The network security risk coefficient is a measure used to evaluate the likelihood of a certain attack behavior being detected. The calculation formula is expressed as Risk(i) = Ψ(vi) × Ι(ai), where Ψ(vi) represents the influence coefficient of the resource node on the attack behavior; I(ai) represents the influence coefficient of the attack node itself. As the attack node penetrates deeper and the attack distance Ld increases, the complexity of the resource node being attacked becomes higher, the time required for the attacker increases, and thus the exposed risk also becomes greater. Moreover, with each step deeper, the cost incurred will increase exponentially. Therefore, the attacker will seek a shorter attack distance to avoid risks.

[0062] Taking the attack distance as one of the factors for evaluating the risk cost and introducing the attack path redundancy coefficient, the risk cost calculation formula is RiskCost = P(i) × Risk(i) × Ex(i)count - 1 × ξ,

[0063] where: P(i) represents the operation cost; Risk(i) (Risk(i) > 1) represents the security risk coefficient, defined by expert experience; Ex(i) (0 < Ex(i) < 1) is the attacker experience dependence coefficient; ξ represents the attack path redundancy coefficient; count represents the number of attacks. According to the above definitions, the calculation formula for the attack cost E(i) incurred by the attack behavior between attack nodes can be expressed as The calculation formula for the total attack cost of a single attack path is where represents the attack cost weight coefficient.

[0064] Preferably, according to the neural network prediction of the gain of each attack path in each sub - attack graph, select the attack path corresponding to the maximum value from all attack gains as the 0day attack path. After that, it includes: After that, it includes:

[0065] Step 30, obtain the vulnerability exploitation success probability Pm of the m - th vulnerability in the attack path with the maximum attack gain;

[0066] Step 40, if Pm is greater than the preset value, then regard the m - th vulnerability as an abnormal node.

[0067] Specifically, obtain the attacker's proficiency in knowledge and the total number of vulnerabilities; obtain the vulnerability exploitation success probability Pm according to the attacker's proficiency in knowledge and the number of attacks on the vulnerability:

[0068]

[0069] k is the attacker's proficiency in knowledge, and k ∈ [0, 1]; Ni is the total number of vulnerabilities; t is the number of attacks by the attacker on vulnerability m.

[0070] Preferably, the target program provides normal parameters, environment variables and all settings to ensure the normal operation of the program, and records the instruction sequence g1 of the normal execution of the program;

[0071] The set of parameters that triggered the exception during the fuzz testing process is used as input and passed to the target program. Other settings remain unchanged and the program execution sequence g2 that triggered the exception is recorded.

[0072] Specifically, the assembly language itself has no semantics and cannot determine the vulnerability location based on semantic errors like analyzing source code. The library functions provided by the C language have many unsafe API calls. When the tainted data propagates in the assembly instruction stream, it is likely to be the location where the exception occurs when it passes through these unsafe functions. Dangerous operations are divided into three categories: unsafe function calls, unsafe jumps, and unsafe port binding operations.

[0073] Compare the instruction sequences of the two rounds of execution, focus on analyzing the code areas that perform differently during the two executions, and combine static reverse engineering and dynamic debugging and tracing methods to analyze this part of the code to locate the abnormal nodes.

[0074] With this configuration, static reverse engineering and dynamic debugging and tracing can be combined to quickly locate abnormal nodes and determine the cause of the abnormality.

[0075] This application also provides a 0day attack path prediction method system for network security knowledge graph, such as Figure 3 As shown, including:

[0076] A modeling module 100, used to construct a knowledge graph between an attacker entity and a device entity;

[0077] A prediction module 200, for predicting a link relationship between an attacker entity and a device entity based on a neural network;

[0078] The processing module 300 is used for predicting the attack gain of each attack path in each sub-attack graph by a neural network, and selecting the attack path corresponding to the maximum value from all attack gains as the 0day attack path.

[0079] Preferably, the probability acquisition module is used to obtain the vulnerability exploitation success probability Pm of the mth vulnerability in the attack path with the largest attack gain;

[0080] The positioning module is used to initially identify m vulnerabilities as abnormal nodes if Pm is greater than a preset value.

[0081] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0082] The present application also provides an electronic device, including: a processor, a sending device, an input device, an output device and a memory, the memory is used to store computer program code, the computer program code includes computer instructions, when the processor executes the computer instructions, the electronic device executes a method such as any one of the possible implementation methods described above.

[0083] The present application also provides a computer-readable storage medium, in which a computer program is stored. The computer program includes program instructions. When the program instructions are executed by a processor of an electronic device, the processor executes a method as described in any possible implementation manner.

[0084] See also Figure 4 , Figure 4 A schematic diagram of the hardware structure of a message push device provided in an embodiment of the present application.

[0085] The automated test device 2 includes a processor 21, a memory 22, an input device 23, and an output device 24. The processor 21, the memory 22, the input device 23, and the output device 24 are coupled via a connector, and the connector includes various interfaces, transmission lines, or buses, etc., which are not limited in the embodiments of the present application. It should be understood that in each embodiment of the present application, coupling refers to mutual connection in a specific manner, including direct connection or indirect connection through other devices, for example, through various interfaces, transmission lines, buses, etc.

[0086] The processor 21 may be one or more graphics processing units (GPUs). When the processor 21 is a GPU, the GPU may be a single-core GPU or a multi-core GPU. Optionally, the processor 21 may be a processor group consisting of multiple GPUs, and the multiple processors are coupled to each other via one or more buses. Optionally, the processor may also be other types of processors, etc., which are not limited in the embodiments of the present application.

[0087] The memory 22 can be used to store computer program instructions and various computer program codes including the program code for executing the program code of the present application. Optionally, the memory includes but is not limited to random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or portable read-only memory (CD-ROM), which is used for related instructions and data.

[0088] The input device 23 is used to input data and / or signals, and the output device 24 is used to output data and / or signals. The output device 23 and the input device 24 can be independent devices or an integrated device.

[0089] It is understandable that in the embodiment of the present application, the memory 22 can not only be used to store related instructions, and the embodiment of the present application does not limit the specific data stored in the memory.

[0090] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0091] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. Those skilled in the art can also clearly understand that the descriptions of the various embodiments of the present application have different focuses. For the convenience and brevity of description, the same or similar parts may not be repeated in different embodiments. Therefore, for parts not described or not described in detail in a certain embodiment, refer to the records of other embodiments.

[0092] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0093] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0094] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted by a computer-readable storage medium. The computer instructions can be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, a data center, etc. that contains one or more available media integrated. The available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, digital versatile discs (DVD)), or semiconductor media (eg, solid state disks (SSD)).

[0095] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by a computer program to instruct the relevant hardware, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned method embodiments. The aforementioned storage medium includes: read-only memory (ROM) or random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

Claims

1. A 0day attack path prediction method based on knowledge graph for network security, characterized by: include: Constructing a knowledge graph between attacker entities and device entities, including: constructing a knowledge graph of perception vectors, decision vectors, and execution vectors, and establishing relationship triples (h, r, t) and path triples (h, p, t) based on the transformation-based model between entity vectors and relationship vectors and between entity vectors and relationship paths; Predict the link relationship between the attacker entity and the device entity based on the neural network; The predicting of the link relationship between the attacker entity and the device entity according to the neural network includes: predicting the attack gain of each attack path in each sub-attack graph according to the neural network, and selecting the attack path corresponding to the maximum value from all attack gains as the 0day attack path; Get the probability Pm of successful exploitation of the mth vulnerability in the attack path with the largest attack gain; If Pm is greater than the preset value, the node where the mth vulnerability is located is regarded as an abnormal node; The step of predicting the attack gain of each attack path in each sub-attack graph according to the neural network includes: The single-step attack gain is the profit obtained by the attacker for each attack step, which can be expressed as: Gi = Bi*Bi+1 / Ci; where Bi is the threat value of the intruding network node i to the network, Bi+1 is the threat value of the decision-making layer network node i+1 to the network, that is, the single-step attack gain from node i to i+1; Ci is the attack cost of attacking node Si; the total attack gain G= , where C = The total attack cost spent for an attack sequence or an attack path; The total attack cost of an attack sequence or an attack path is expressed as C= ; =Ci consists of two parts: operating cost P(i) and risk cost Risk(i); The method for obtaining the vulnerability exploitation success probability Pm of the mth vulnerability in the attack path with the largest attack gain includes: Get the attacker's knowledge proficiency and total number of vulnerabilities; According to the attacker's proficiency in knowledge and the number of vulnerability attacks, the probability of successful vulnerability exploitation Pm=Pi is calculated as follows: ； k is the attacker’s proficiency in knowledge, and k ∈ [0,1]; Ni is the total number of vulnerabilities; t is the number of attacks by the attacker on vulnerability m.

2. A 0day attack path prediction system for network security knowledge graph, using the 0day attack path prediction method for network security knowledge graph as claimed in claim 1, characterized in that: include: Modeling module, used to build a knowledge graph between attacker entities and device entities; A prediction module, used to predict the link relationship between the attacker entity and the device entity based on the neural network; The processing module is used for the neural network to predict the attack gain of each attack path in each sub-attack graph, and select the attack path corresponding to the maximum value from all attack gains as the 0day attack path; A probability acquisition module, used to obtain the probability Pm of successful exploitation of the mth vulnerability in the attack path with the largest attack gain; The positioning module is used to regard the node where the mth vulnerability is located as an abnormal node if Pm is greater than a preset value.

3. An electronic device, characterized in that: include: A processor, a sending device, an input device, an output device and a memory, wherein the memory is used to store computer program codes, the computer program codes include computer instructions, and when the processor executes the computer instructions, the electronic device executes the method as claimed in claim 1.

4. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a processor of an electronic device, the processor is caused to execute the method of claim 1.

Images