Method for detecting smart home network and related device

Abstract

The application provides a smart home network detection method and related equipment, target vulnerability information corresponding to a network topology structure is determined by using network configuration information. Since the target vulnerability information is for the entire network topology structure, the behaviors that can be implemented by an attacker in the smart home network are simulated based on the target vulnerability information. The process determines an initial attack node in the network topology structure and an attack strategy corresponding to the initial attack node through the target vulnerability information. Any other network node in the network topology structure except the initial attack node is taken as a target node, and it is determined whether the target node satisfies the attack strategy corresponding to the initial attack node. When the target node satisfies the attack strategy, a target attack node is determined based on the target node. All possible target attack paths can be obtained according to all paths passed by the initial attack node to the target attack node, and all potential attack paths of the smart home network are detected, thereby ensuring the security of the smart home network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a detection method for a smart home network and related equipment. BACKGROUND

[0002] In recent years, digital technology has rapidly entered the smart home environment, and there are many embedded components in the smart home network. These components are mostly connected, authenticated, and exchange messages in a multi-factor authentication manner.

[0003] However, once there are enough smart home device or smart home network identity verification vulnerabilities, an attack can find a way to steal user data of a legitimate user or even gain full control over the smart home network, thus affecting the security of the smart home network.

[0004] Therefore, how to detect a smart home network to detect all potential attack paths in the smart home network and ensure the security of the smart home network has become a technical problem to be solved. SUMMARY

[0005] Therefore, the purpose of the present application is to provide a detection method for a smart home network and related equipment to solve or partially solve the above technical problems.

[0006] To achieve the above purpose, a first aspect of the present application provides a detection method for a smart home network, comprising:

[0007] obtaining network topology and network configuration information of a smart home network to be detected;

[0008] determining target vulnerability information corresponding to the network topology based on the network configuration information;

[0009] determining an initial attack node in the network topology and an attack strategy corresponding to the initial attack node according to the target vulnerability information, wherein the attack strategy corresponding to the initial attack node is used to indicate a network attack performed under the initial attack node;

[0010] taking any other network node in the network topology except the initial attack node as a target node, and determining whether the target node satisfies the attack strategy corresponding to the initial attack node;

[0011] in response to determining that the target node satisfies the attack strategy corresponding to the initial attack node, determining a target attack node and taking a path from the initial attack node to the target attack node as a target attack path.

[0012] Optionally, the determining the attack strategy corresponding to the initial attack node in the network topology according to the target vulnerability information comprises:

[0013] determining the attack type, the attack condition and the attack result corresponding to the initial attack node based on the target vulnerability information;

[0014] combining the attack type corresponding to the initial attack node, the attack condition corresponding to the initial attack node and the attack result corresponding to the initial attack node to obtain the attack strategy corresponding to the initial attack node.

[0015] Optionally, the determining whether the target node satisfies the attack strategy corresponding to the initial attack node comprises:

[0016] determining whether the target node exists the attack condition triggering the attack action of the attack type corresponding to the initial attack node to obtain a determination result;

[0017] determining whether the target node satisfies the attack strategy according to the determination result.

[0018] Optionally, the determining the target attack node in response to determining that the target node satisfies the attack strategy corresponding to the initial attack node comprises:

[0019] in response to determining that the target node satisfies the attack strategy corresponding to the initial attack node, taking the target node as a current intermediate attack node and determining a next intermediate attack node of the current intermediate attack node based on the attack strategy corresponding to the initial attack node;

[0020] in response to the non-existence of a new next intermediate attack node corresponding to the next intermediate attack node, taking the next intermediate attack node as the target attack node.

[0021] Optionally, the determining the next intermediate attack node of the current intermediate attack node based on the attack strategy corresponding to the initial attack node comprises:

[0022] obtaining the attack result corresponding to the current intermediate attack node;

[0023] selecting a network node corresponding to the current intermediate attack node from the network topology as the next intermediate attack node according to the attack result corresponding to the current intermediate attack node.

[0024] Optionally, the selecting the network node corresponding to the current intermediate attack node from the network topology as the next intermediate attack node according to the attack result corresponding to the current intermediate attack node comprises:

[0025] obtain an intermediate path from the current intermediate attack node to an attack result corresponding to the current intermediate attack node, and add the intermediate path to a preset attack edge set corresponding to the smart home network to be detected;

[0026] select a next intermediate attack node of the current intermediate attack node from the network topology based on an attack edge corresponding to the current intermediate attack node in the attack set.

[0027] Optionally, the determining the target vulnerability information corresponding to the network topology based on the network configuration information comprises:

[0028] finding the target vulnerability information corresponding to the network topology from a preset vulnerability database based on the network configuration information, wherein the vulnerability database comprises vulnerability information corresponding to different network configuration information.

[0029] Optionally, the determining the target vulnerability information corresponding to the network topology based on the network configuration information comprises:

[0030] sending verification information to each network node in the network topology;

[0031] obtaining feedback information of each network node based on the verification information;

[0032] in response to feedback information of any network node in the network nodes not matching the verification information, determining that the any network node has a vulnerability, obtaining and storing vulnerability information of the any network node as the target vulnerability information.

[0033] Based on the same inventive concept, a second aspect of the present application provides a detection device of a smart home network, comprising:

[0034] an obtaining module configured to obtain a network topology and network configuration information of a smart home network to be detected;

[0035] a vulnerability determining module configured to determine target vulnerability information corresponding to the network topology based on the network configuration information;

[0036] a first determining module configured to determine an initial attack node in the network topology and an attack strategy corresponding to the initial attack node according to the target vulnerability information, wherein the attack strategy corresponding to the initial attack node is used to indicate a network attack performed at the initial attack node;

[0037] A second determining module is configured to determine whether any other network node in the network topology except the initial attack node is a target node, and whether the target node meets the attack strategy corresponding to the initial attack node.

[0038] A path determining module is configured to determine a target attack node and a target attack path from the initial attack node to the target attack node in response to determining that the target node meets the attack strategy corresponding to the initial attack node.

[0039] Based on the same inventive concept, a third aspect of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor implements the method of the first aspect when executing the computer program.

[0040] As can be seen from the above, the detection method for the smart home network and the related device provided by the present application determine the target vulnerability information corresponding to the network topology by using the network configuration information. Since the target vulnerability information is for the entire network topology, the behaviors that can be achieved by the attacker in the smart home network can be simulated based on the target vulnerability information. The simulation process determines the initial attack node in the network topology and the attack strategy corresponding to the initial attack node through the target vulnerability information, determines any other network node in the network topology except the initial attack node as a target node, and determines whether the target node meets the attack strategy corresponding to the initial attack node. When the target node meets the attack strategy corresponding to the initial attack node, the target attack node is determined based on the target node, and all possible target attack paths can be obtained according to all paths from the initial attack node to the target attack node, thereby detecting all potential attack paths in the smart home network and ensuring the security of the smart home network. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the present application or related art, the following will briefly introduce the drawings needed to be used in the embodiments or related art descriptions. Obviously, the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0042] Figure 1 The flowchart of the detection method for the smart home network of the embodiments of the present application;

[0043] Figure 2A The formal analysis process schematic diagram of the embodiments of the present application;

[0044] Figure 2BFig. 1 is a schematic diagram of an attack graph system framework according to an embodiment of the present application;

[0045] Figure 2C Fig. 2 is a schematic diagram of a target attack path according to an embodiment of the present application;

[0046] Figure 3 Fig. 3 is a structural block diagram of a detection device of a smart home network according to an embodiment of the present application;

[0047] Figure 4 Fig. 4 is a schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0049] It should be noted that, unless otherwise defined, technical terms or scientific terms used in the embodiments of the present application should be understood as their common meanings to those of ordinary skill in the art to which the present application pertains. The terms "first", "second", and similar terms used in the embodiments of the present application do not denote any order, quantity, or importance, but are merely used to distinguish different components. The terms "include", "contain", and similar terms mean that the elements or objects before the terms encompass the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects. The terms "connect" or "connected" and similar terms do not mean only physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms "upper", "lower", "left", "right", and the like are merely used to indicate relative positional relationships, and when the absolute positions of the described objects change, the relative positional relationships can also change accordingly.

[0050] It can be understood that, before using the technical solutions of the various embodiments of the present application, the user will be informed of the type, scope of use, use scenario, and the like of the personal information involved by appropriate means, and the authorization of the user will be obtained.

[0051] For example, in response to receiving a user's active request, a prompt message is sent to the user to explicitly prompt the user that the operation requested to be performed will require the acquisition and use of the user's personal information. Thus, the user can voluntarily choose whether to provide personal information to the electronic device, application program, server, or storage medium, and the like software or hardware that performs the operation of the technical solutions of the present application according to the prompt message.

[0052] As an optional but non-limiting implementation, in response to receiving the active request of the user, the manner of sending the prompt information to the user may be, for example, a pop-up window manner in which the prompt information may be presented in a text manner. In addition, the pop-up window may also carry a selection control for the user to select "agree" or "disagree" to provide the personal information to the electronic device.

[0053] It can be understood that the above notification and user authorization obtaining process is only illustrative and does not limit the implementation of the present application, and other manners meeting the relevant laws and regulations can also be applied to the implementation of the present application.

[0054] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0055] In recent years, digital technology has rapidly entered the smart home environment, and there are many embedded components in the smart home network, which are mostly connected, authenticated and exchange messages in a multi-factor authentication manner. In a typical smart home system setting, the wireless sensor network formed by these sensors can sense, receive, process and transmit data collected from various different devices, users and computers connected in the smart home system to respond to users with personalized services. The wireless sensor network can usually be built using a ZigBee network, which is very suitable for home network environment. At the same time, the wireless sensor network also collects, distributes and processes user data with other networks, domains or systems (such as the Internet), so the security, privacy and credibility of the wireless sensor network are crucial. However, in terms of user data and identity authentication, the current ZigBee network security technology is not very mature in terms of monitoring and control. Once there are enough smart home device or smart home network identity authentication vulnerabilities, attacks may find a way to steal legitimate user data or even gain full control of the smart home network, and the attacker's attack path may be from one sensor to another sensor, then a convergence node, and finally a master device, thus affecting the security of the smart home network.

[0056] Therefore, how to detect the smart home network to detect all potential attack paths in the smart home network and ensure the security of the smart home network has become a technical problem to be solved.

[0057] In addition, the existing security analysis of smart home networks is mainly formal analysis. When using formal analysis to analyze the security of a protocol, the protocol specification process needs to be abstracted into modeling rules, an attacker model is built according to the security threats faced by the protocol, and the security properties that the protocol needs to meet are defined. After modeling, it is proved whether the protocol meets the security goal through manual verification or automatic verification. The content of formal analysis includes the state machine of all protocol participants, the interaction information between participants, the use of cryptography by participants and attackers, and the enemy model. Generally speaking, the more accurate the definition of the enemy model and the security properties, the easier it is to find potential security threats in the protocol. The common process of formal analysis is shown in FIG. 1. Figure 2A

[0058] The target, the formal analysis of the protocol mainly includes two branches of the computational model and the symbolic model. In the computational model, messages are modeled using bit strings, cryptographic primitives are modeled using bit string to bit string function mapping, and attackers are modeled using probabilistic Turing machines. The computer can restore the actual running scenario of the protocol, but the proof process is very complex. Up to now, the computational model is verified by manual proof. Therefore, the computational model is often used for security analysis of the protocol independent model. In the symbolic model, cryptographic primitives are modeled using function symbols, messages are cryptographic primitives, and attackers process these items based on a fixed set of operations and follow the perfect cryptography assumption. The symbolic model is easier to implement automatic verification due to its model. In addition, the verification process of the computational model usually needs human intervention to ensure the correctness and completeness of the verification process. The verification process of the symbolic model can be assisted by mature verification tools. Different verification tools have different expression and verification capabilities, and human intervention is needed to further filter according to the characteristics of the protocol.

[0059] Although the formal analysis method has high analysis accuracy and efficiency, it also has some shortcomings. First, the formal analysis method can only analyze one security goal or security property in one scenario at a time. If all protocols in a smart home network are to be analyzed, it will take a lot of time and is prone to some omissions due to the large workload. Second, the formal analysis tool usually cannot be visually displayed in the analysis results. It still needs to spend a lot of time by manual to interpret and verify the analysis results. And the formal analysis method can only analyze the running of a single protocol at a time, which is inefficient when facing the complex environment of the entire smart home network.

[0060] ​In order to ensure that the smart home network to be detected is free from all types of network attacks, all vulnerabilities in the smart home network to be detected must be detected so that the attacker cannot exploit the vulnerabilities and compromise the network security. Vulnerabilities in authentication and exploit vulnerabilities can be intuitively demonstrated by using an attack graph, and therefore, the attack graph can be repaired for the attack path that the attacker can use to access the target network. In order to facilitate the network security manager to start from the known network security knowledge and quickly reinforce the security of the managed network, the attack graph system framework of the present application as shown in Figure 2B The attack graph system framework of the present application as shown in

[0061] The embodiment of the present application provides a detection method of a smart home network, which determines target vulnerability information corresponding to a network topology structure by using network configuration information. Since the target vulnerability information is for the entire network topology structure, the behavior that an attacker can achieve in the smart home network can be simulated based on the target vulnerability information. The simulation process determines an initial attack node in the network topology structure and an attack strategy corresponding to the initial attack node by using the target vulnerability information, and then determines whether any other network node in the network topology structure except the initial attack node is a target node and whether the target node satisfies the attack strategy corresponding to the initial attack node. When the target node satisfies the attack strategy corresponding to the initial attack node, a target attack node is determined based on the target node, and all possible target attack paths can be obtained according to all paths from the initial attack node to the target attack node, thereby detecting all potential attack paths in the smart home network and ensuring the security of the smart home network.

[0062] As shown in Figure 1 The method of the embodiment includes the following steps.

[0063] In step 101, the network topology structure and the network configuration information of the smart home network to be detected are obtained.

[0064] In this step, the network topology refers to the layout structure of the devices corresponding to each network node in the smart home network to be detected, mainly representing the way each network node in the smart home network to be detected is connected to another network node or the external Internet, for example: "a device named homeSever can be connected to the external Internet through the Transmission Control Protocol (TCP) protocol using port 80", and the network topology of a smart home network to be detected will include many such information.

[0065] The attack graph system of the present application parses the network topology in the smart home network to be detected into an abstract access control list (ACL). The following is an ACL entry that allows TCP traffic to flow from the external network (extNets) to port 80 on the homeServer:

[0066] accessControlList(internet, homeServer, TCP, 80).

[0067] The network configuration information includes the configuration information of the devices in the smart home network to be detected, the principal, and the principal policy.

[0068] Among them, the configuration information includes the name of all devices (for example "homeServer"), the operating system and application software (for example "tomcat") running, the communication protocol (for example TCP protocol) used by the device when communicating in the smart home network, the communication port (for example 80 port) used by the device when communicating in the smart home network, and the user account (for example user tom) used by the device when running. In addition, the configuration information of the device can also be directly scanned and extracted by the scanner, and can be checked by manual.

[0069] The process of converting the configuration information into Prolog is as follows:

[0070] networkService(homeServer, tomcat, TCP, 80, tom).

[0071] The above sentence means that the program tomcat runs on the machine homeServer with the user tom identity and listens on port 80 using the Transmission Control Protocol (TCP) protocol.

[0072] The subject represents the account of the host in the smart home network to be detected, including the account name (such as "member"), the host name (such as "homeMemberPC") where it is located, and the account authority (such as "memberAccount").

[0073] The subject policy specifies which subjects can access which data, and each subject and data has a symbolic name, including the subject (such as "any user"), the action (such as "read"), and the data content (such as "homeCtrlWebPages"). The whole subject policy is "any user can read homeCtrlWebPages", and such a subject policy rule can also have multiple lines.

[0074] The following is an example of a subject policy:

[0075] allow(_,read,homeCtrlWebPages).

[0076] allow(homeAdmin,write,homeCtrlwebPages).

[0077] These subject policies specify that any user can access the control web page of the main system, and only the administrator of the smart home network can access any data arbitrarily, and any behavior not explicitly allowed is prohibited.

[0078] Step 102, determining target vulnerability information corresponding to the network topology based on the network configuration information.

[0079] In this step, the target vulnerability information includes the ID of the vulnerability in the vulnerability library (such as CVE-2013-0643), the device that may exist the vulnerability (such as "homeServer"), the core component that causes the vulnerability (such as Adobe Flash Player), and the consequences that may be caused by the vulnerability. The target vulnerability information will be used in the attack graph generation algorithm later.

[0080] The target vulnerability information describes the vulnerability situation in the smart home network to be detected. The Open Vulnerability Assessment Language (OVAL) scanner can be deployed on the device of the smart home network to be detected and scan for defects. The result of the scanner is converted, for example, as follows:

[0081] vulReports(homeServer,CVE-2013-0643,AdodeFlashPlayer).

[0082] vulInfo(′CVE-2013-0643,remoteExploit,execArbitraryCode).

[0083] That is, a vulnerability with a unique code (Identity document, ID) of "CVE-2013-0643" is reported on the command server (homeServer) in the smart home network to be detected. The second line is the vulnerability information provided by the preset vulnerability database, which provides information about the impact of the vulnerability. This vulnerability enables an attacker to remotely exploit the device for attack and ultimately execute arbitrary code. This vulnerability allows unauthorized disclosure of information, unauthorized modification, and interruption of service.

[0084] In fact, there are many vulnerabilities in the identity authentication module that can be used by attackers, such as the vulnerability with ID "CVE-2013-5531". This vulnerability allows a remote attacker to bypass authentication through a specially crafted session on Transmission Control Protocol (TCP) port 443, and read support bundle configuration and credential data.

[0085] In addition, atomic attack rules can also be determined according to the target vulnerability information, which describe the attack type (such as "remote exploit cross-site scripting vulnerability") and determine the attacker's choices at each stage. For example, the following is a Prolog rule for exploiting a cross-site scripting vulnerability in a service program:

[0086] execCode(Attacker, Host, User): %% Rule-cross-site-script malicious (Attacker),

[0087] vulExists(Host, Program, CrossSiteScript, GainPrivileges),

[0088] networkService(Host, Program, Protocol, Port, User),

[0089] netAccess(Attacker, _AttackerFrom, Host, Protocol, Port).

[0090] For this vulnerability, the prerequisite attack execCode requires the attacker to first have certain access to the device Host, and the consequence of exploiting the vulnerability is that the attacker can obtain the privileges of the program owner.

[0091] In step 103, an initial attack node in the network topology is determined according to the target vulnerability information, and an attack strategy corresponding to the initial attack node is determined, wherein the attack strategy corresponding to the initial attack node is used to indicate a network attack performed under the initial attack node.

[0092] In this step, the target vulnerability information, the network configuration information, the smart home network topology, the subject, the atomic attack rule and the subject strategy are arranged in a format defined by the attack graph system of the present application, wherein the target vulnerability information, the network configuration information, the smart home network topology and the network topology structure are arranged as Prolog clauses representing facts, and the atomic attack rule and the subject strategy are arranged as Prolog clauses representing relations.

[0093] The set of Prolog facts of the target vulnerability information, the network configuration information and the smart home network topology input into the attack graph system of the present application represent the network state and information about the vulnerability, which are stored in the attack graph analysis database by the attack graph system.

[0094] The logical reasoning engine generates trace steps by using the atomic attack rule determined based on the target vulnerability information, the subject strategy in the network configuration information and the set of Prolog facts, and inputs these trace steps into the attack graph generation algorithm for running to generate an attack graph, so that a complete target attack path of an attacker can be clearly and intuitively presented through the attack graph. Therefore, the attack graph is interpreted, so that the detected smart home network can be repaired and improved according to the discovered attack path.

[0095] The following is the definition of the attack graph:

[0096] (Np, Nc, Ne, E, A, G) represents an attack graph, wherein Np, Nc and Ne are three sets of disjoint nodes, is an edge in the attack graph, A is a mapping of a node to its attributes, and G∈Ne is a target of an attacker.

[0097] There are three types of nodes in the original attack graph:

[0098] a. A step node, i.e. an AND node, is used to represent a possible exploitation step when all prerequisites (configuration nodes or privilege nodes) are true;

[0099] b. A privilege node is represented as an OR node, which represents a certain level of privilege that can be derived from any of its predecessors (AND nodes);

[0100] c. Configuration nodes represent the network's configuration conditions. For example, network vulnerabilities or connectivity attributes are included in configuration nodes.

[0101] Np, Nc, and Ne are sets of privileged nodes, configuration nodes, and exploitation step nodes, respectively. Configuration can also be interpreted as basic facts; if a fact comes from the input of the logic inference engine, it can be considered primitive. Exploitation steps are the result of repeatedly applying atomic attack rules to the input facts; therefore, they can also be understood as another fact node derived from known facts. Edges in the logic attack graph can only run from exploitation step nodes to privileged nodes, or from privileged nodes to fact nodes (configuration nodes or exploitation step nodes). Attribute labeling functions map fact nodes to the facts they represent and privileged nodes to the rules used for derivation.

[0102] The attack graph generation algorithm takes as input the set T of all TraceStep terms and the attacker’s target G (i.e. the target attack point), and outputs the attack graph (Np, Nc, Ne, E, A, G).

[0103] The natural language description of the attack graph generation algorithm is as follows:

[0104] (1) Establish 5 sets: Np, Nc, Ne, E, A, all of which are empty sets;

[0105] (2) Select one TraceStep item t from the input TraceStep item set T. t is a TraceStep item, which can be represented as t = because(atomicAttackRule, Fact, Conjunct);

[0106] (3) Create a new privileged node r, add privileged node r to the privileged node set Np, let the attribute of privileged node r be atomic AttackRule in t, and add the relationship r→t to the node to attribute mapping set A;

[0107] (4) Find whether there is a node n in the set of nodes Ne that satisfies A(n) = Fact, that is, whether there exists a node n in Ne whose attribute is Fact in t;

[0108] (5) If the n found in step (4) does not exist, create a new fact node n, let the attribute of fact node n be Fact in t, add the relationship n→Fact to the mapping set A of the node to the attribute, and add fact node n to the set Ne of the node using the step;

[0109] (6) Create an edge (n, t) between the privileged node r created in step (3) and the fact node n created in step (5), and add this edge to the edge set E;

[0110] (7) Select a fact f from the Conjunct in t;

[0111] (8) Find out whether there exists a fact node c in the set of step nodes Ne and the set of configuration nodes Nc that satisfies A(c) = f, that is, whether there exists a node c in Ne and Nc whose attribute is fact f;

[0112] (9) If the node c does not exist, create a new fact node c, set the attribute of fact node c to f, and add the relationship c→f to the mapping set A of nodes to attributes. If the fact f is directly input from the logic reasoning engine, add fact node c to the configuration node set Nc; otherwise, add fact node c to the utilization step node set Ne.

[0113] (10) Create an edge (r, c) between the privileged node r created in step (3) and the fact node c created in step (9), and add this edge to the edge set E;

[0114] (11) Repeat steps (7)-(10) until all facts in the Conjunct of t have been traversed;

[0115] (12) Repeat steps (2)-(11) until all TraceStep items t in the TraceStep set T have been traversed;

[0116] (13) At this point, (Np, Nc, Ne, E, A, G) is the generated attack graph.

[0117] The attack graph has now been generated.

[0118] like Figure 2C The image shown is an example of a generated attack graph, which displays two target attack paths, one above the other.

[0119] The upper target attack path interpretation: the attacker accesses the device HomeServer from the TCP protocol 80 port through the Internet, attacks the device CommunicationSensor from the device HomeServer, obtains the permission of executing arbitrary code as the user apache through the execCode attack, and then uses the subject policy accessFile to perform write operation on the / export directory of the device HomePC, and finally uses the subject policy accessFile to perform write operation on the / usr / local / share directory of the HomePC.

[0120] The lower target attack path interpretation: the attacker accesses the device HomeServer from the TCP protocol 80 port through the Internet, attacks the device CommunicationSensor from the device HomeServer, obtains the permission of executing arbitrary code as the user apache through the execCode attack, and then attacks the device CommunicationSensor again through the Remote Procedure Call Protocol (RPC) protocol 100005 port to obtain the root user's permission through the execCode attack, and then uses the subject policy accessFile to perform write operation on the / export directory of the device HomePC, and finally uses the subject policy accessFile to perform write operation on the / usr / local / share directory of the HomePC.

[0121] By Figure 2C It can be seen that the attack graph is generated in a very visual form, and all the nodes and attack methods passed in the target attack path are clearly marked in the graph, so that the security administrator of the smart home network can intuitively understand the risks and occurrence modes in the current smart home network, and can therefore quickly take remedial measures, thereby improving the overall security of the smart home network.

[0122] In step 104, any other network node in the network topology except the initial attack node is taken as a target node, and it is determined whether the target node satisfies the attack policy corresponding to the initial attack node.

[0123] In this step, in order to calculate the attack graph containing all possible attack paths, the logical reasoning engine must traverse all possible derived paths and record the tracking steps in the process, so as to take any other network node in the network topology structure as a target node except the initial attack node, and determine whether the target node meets the attack strategy corresponding to the initial attack node.

[0124] Step 105, in response to determining that the target node meets the attack strategy corresponding to the initial attack node, determining the target attack node, and taking the path from the initial attack node to the target attack node as the target attack path.

[0125] In this step, when the target node meets the attack strategy corresponding to the initial attack node, the target node is added to the attack node set, and the final target attack node is determined based on the target node, and all paths from the initial attack node to the target attack node are taken as the target path. Since the target vulnerability information is for the entire network topology structure, the behavior that can be achieved by the attacker in the smart home network can be simulated based on the target vulnerability information. The simulation process determines the initial attack node in the network topology structure through the target vulnerability information, and the attack strategy corresponding to the initial attack node, and takes any other network node in the network topology structure as a target node except the initial attack node, and determines whether the target node meets the attack strategy corresponding to the initial attack node. When the target node meets the attack strategy corresponding to the initial attack node, the target attack node is determined based on the target node, and all paths from the initial attack node to the target attack node are taken as the target path. Therefore, all possible target attack paths can be obtained, and all potential attack paths in the smart home network can be detected, thereby ensuring the security of the smart home network.

[0126] In some embodiments, step 103 comprises:

[0127] Step 1031, determining the attack type, attack condition and attack result corresponding to the initial attack node based on the target vulnerability information.

[0128] Step 1032, combining the attack type corresponding to the initial attack node, the attack condition corresponding to the initial attack node and the attack result corresponding to the initial attack node to obtain the attack strategy corresponding to the initial attack node.

[0129] In the above scheme, the logical reasoning engine generates trace step items by using the determined atomic attack rule based on the target vulnerability information, the subject policy in the network configuration information and the set of Prolog facts, and inputs these trace step items into an attack graph generation algorithm for running to generate an attack graph, which can clearly and intuitively show a complete target attack path of an attacker through the attack graph. Therefore, the attack graph is interpreted, so that the detected smart home network can be repaired and improved according to the discovered attack path.

[0130] The attack step path has the following format:

[0131] Attack simulation path (i.e. attack strategy):

[0132] TraceStep: := because (atomicAttackRule, Fact, Conjunct)

[0133] Fact: := predicate (hist of constant)

[0134] Conjunct: := [list of Fact]

[0135] Using the above step path information, an attack graph can be constructed. Simply put, each TraceStep item (i.e. trace step item) is proved to be a privileged node in the attack graph. The Fact field in the step path becomes the parent node of the node, and the Conjunct field becomes its child node. It can be simply understood that each TraceStep item is an attack step path, in which atomicAttackRule is the attack manner (i.e. attack type), Fact is the attack condition (i.e. attack condition), and Conjunct is the attack consequence (i.e. attack result). The Conjunct of one TraceStep may be the Fact of another TraceStep. The original Fact content comes from the input of the logical reasoning engine, i.e. the target vulnerability information, network configuration information and network topology structure in the input of the attack graph system of the present application.

[0136] In some embodiments, in step 104, the determination of whether the target node satisfies the attack strategy corresponding to the initial attack node comprises:

[0137] Step 1041, determining whether the target node has an attack condition triggering an attack action of the attack type corresponding to the initial attack node, to obtain a determination result.

[0138] Step 1042, determining whether the target node satisfies the attack strategy according to the determination result.

[0139] In the above scheme, the target node in the network topology is traversed, it is judged whether the attack condition of the attack action of the attack type corresponding to the initial attack node exists in the attribute of the target node, if not, a new target node is determined, it is judged whether the attack condition of the attack action of the attack type corresponding to the initial attack node exists in the attribute of the new target node, if yes, an edge between the initial attack node and the new target node is created, and the created edge is saved for clear and intuitive display in the attack graph.

[0140] In some embodiments, in step 105, in response to determining that the target node satisfies the attack strategy corresponding to the initial attack node, the target attack node is determined, including:

[0141] Step 1051, in response to determining that the target node satisfies the attack strategy corresponding to the initial attack node, the target node is taken as a current intermediate attack node, and the next intermediate attack node of the current intermediate attack node is determined based on the attack strategy corresponding to the initial attack node.

[0142] Step 1052, in response to the absence of a new next intermediate attack node corresponding to the next intermediate attack node, the next intermediate attack node is taken as the target attack node.

[0143] In the above scheme, if the target node satisfies the attack strategy corresponding to the initial attack node, the target node is taken as the current intermediate attack node, that is, a new initial attack node, to find the corresponding next intermediate attack node, until the absence of a new next intermediate attack node, the final next intermediate attack node is taken as the target attack node.

[0144] The attack strategy corresponding to the initial attack node can be used to quickly determine the next intermediate attack node of the previous intermediate attack node.

[0145] In addition, the target attack node can also be obtained from the target vulnerability information.

[0146] In some embodiments, in step 1051, the next intermediate attack node of the current intermediate attack node is determined based on the attack strategy corresponding to the initial attack node, including:

[0147] Step 10511, an attack result corresponding to the current intermediate attack node is obtained.

[0148] Step 10512, according to the attack result corresponding to the current intermediate attack node, a network node corresponding to the current intermediate attack node is selected from the network topology as the next intermediate attack node.

[0149] In the above scheme, the attack result is used to indicate the consequence of the attack, so that the next intermediate node affected by the current intermediate attack node performing the attack in the network topology structure can be determined quickly.

[0150] In some embodiments, step 10512 comprises:

[0151] Step 105121 obtains an intermediate path from the current intermediate attack node to the attack result corresponding to the current intermediate attack node, and adds the intermediate path to a preset attack edge set corresponding to the smart home network to be detected.

[0152] Step 105122 selects a next intermediate attack node of the current intermediate attack node from the network topology structure based on an attack edge corresponding to the current intermediate attack node in the attack set.

[0153] In the above scheme, the attack result corresponding to the current intermediate attack node can represent the next intermediate node affected by the current intermediate attack node performing the attack, and the intermediate path from the current intermediate attack node to the next intermediate node is added to the preset attack edge set initially empty as an attack edge for clear and intuitive display in the attack graph.

[0154] In addition, the intermediate path from the current intermediate attack node to the corresponding next intermediate node can be determined from the attack set, so that the corresponding attack path can be quickly and intuitively found in the attack graph, targeted remediation can be quickly performed, and thus the overall security of the smart home network can be improved.

[0155] In some embodiments, step 102 comprises:

[0156] Based on the network configuration information, target vulnerability information corresponding to the network topology structure is searched from a preset vulnerability database, wherein the vulnerability database comprises vulnerability information corresponding to different network configuration information.

[0157] In the above scheme, the vulnerability information is provided by the preset vulnerability database, and the vulnerability database provides information about the impact of the vulnerability, so that the target vulnerability information corresponding to the network topology structure can be searched from the preset vulnerability database based on the network configuration information, and thus the target vulnerability information of the smart home network to be detected can be quickly determined.

[0158] In some embodiments, step 102 comprises:

[0159] Step 1021 sends verification information to each network node in the network topology structure.

[0160] Step 1022, obtaining feedback information of each network node based on the verification information.

[0161] Step 1023, in response to the feedback information of any network node of each network node not matching the verification information, determining that the any network node has a vulnerability, and obtaining and storing vulnerability information of the any network node as the target vulnerability information.

[0162] In the above scheme, the Open Vulnerability Assessment Language (OVAL) scanner can be deployed on the devices in the smart home network for scanning, simulating the attack actions performed by the attacker, sending verification information to each network node in the network topology, determining that the network node with the feedback information not matching the verification information has a vulnerability, obtaining and storing the vulnerability information of the network node with the vulnerability as the target vulnerability information, and then the target vulnerability information for the smart home network to be detected can be quickly obtained for use in the attack graph generation algorithm.

[0163] Through the above scheme, the target vulnerability information corresponding to the network topology is determined by using the network configuration information. Since the target vulnerability information is for the entire network topology, the behaviors that can be achieved by the attacker in the smart home network can be simulated based on the target vulnerability information. The simulation process determines the initial attack node in the network topology and the attack strategy corresponding to the initial attack node through the target vulnerability information, and then any other network node in the network topology except the initial attack node is taken as a target node, and it is determined whether the target node satisfies the attack strategy corresponding to the initial attack node. When the target node satisfies the attack strategy corresponding to the initial attack node, the target attack node is determined based on the target node, and all paths from the initial attack node to the target attack node can be obtained to represent all possible target attack paths, and all potential attack paths in the smart home network are detected, and the security of the smart home network is ensured.

[0164] It should be noted that the method of the embodiments of the present application can be executed by a single device, such as a computer or a server, etc. The method of the embodiments of the present application can also be applied in a distributed scenario, and completed by multiple devices cooperating with each other. In this distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiments of the present application, and the multiple devices can interact with each other to complete the method.

[0165] It is to be understood that the foregoing description is directed to embodiments of the application. Various embodiments can be devised without departing from the scope of the application. Some of the embodiments of the application are described above with acertain level of particularity. This level of particularity is not to be interpreted to limit the scope of the application, but is to convey the overall spirit of other embodiments to those skilled in the art. The scope of the application is defined by the appended claims. The description above is intended to be illustrative, and not restrictive. Many other embodiments will be apparent to those of skill in the art upon reviewing the above description. The scope of the application should, therefore, be determined not with reference to the above description, but instead should be determined with reference to the appended claims, along with their full scope of equivalents.

[0166] Corresponding to any of the above-mentioned embodiment methods based on the same inventive concept, the application further provides a smart home network detection device.

[0167] Reference Figure 3 The smart home network detection device comprises:

[0168] An acquisition module 301 is configured to acquire network topology structure and network configuration information of a smart home network to be detected;

[0169] A vulnerability determination module 302 is configured to determine target vulnerability information corresponding to the network topology structure based on the network configuration information;

[0170] A first determination module 303 is configured to determine an initial attack node in the network topology structure and an attack strategy corresponding to the initial attack node according to the target vulnerability information, wherein the attack strategy corresponding to the initial attack node is used to indicate a network attack performed under the initial attack node;

[0171] A second determination module 304 is configured to determine whether any other network node in the network topology structure except the initial attack node is a target node satisfying the attack strategy corresponding to the initial attack node;

[0172] A path determination module 305 is configured to determine a target attack node and a target attack path from the initial attack node to the target attack node in response to determining that the target node satisfies the attack strategy corresponding to the initial attack node.

[0173] In some embodiments, the first determination module 303 is specifically configured to:

[0174] determine an attack type, an attack condition and an attack result corresponding to the initial attack node based on the target vulnerability information;

[0175] combine the attack type corresponding to the initial attack node, the attack condition corresponding to the initial attack node and the attack result corresponding to the initial attack node to obtain the attack strategy corresponding to the initial attack node.

[0176] In some embodiments, the second determining module 304 comprises:

[0177] The first determining unit is configured to, in response to determining that the target node meets the attack strategy corresponding to the initial attack node, take the target node as a current intermediate attack node, and determine a next intermediate attack node of the current intermediate attack node based on the attack strategy corresponding to the initial attack node.

[0178] The second determining unit is configured to, in response to there being no new next intermediate attack node corresponding to the next intermediate attack node, take the next intermediate attack node as the target attack node.

[0179] In some embodiments, the first determining unit comprises:

[0180] The obtaining sub-unit is configured to obtain an attack result corresponding to the current intermediate attack node.

[0181] The determining sub-unit is configured to select a network node corresponding to the current intermediate attack node from the network topology structure as the next intermediate attack node according to the attack result corresponding to the current intermediate attack node.

[0182] In some embodiments, the determining sub-unit is specifically configured to:

[0183] Obtain an intermediate path from the current intermediate attack node to the attack result corresponding to the current intermediate attack node, and add the intermediate path to a preset attack edge set corresponding to the smart home network to be detected.

[0184] Select a next intermediate attack node of the current intermediate attack node from the network topology structure based on an attack edge corresponding to the current intermediate attack node in the attack set.

[0185] In some embodiments, the obtaining module 301 is specifically configured to:

[0186] Search for target vulnerability information corresponding to the network topology structure from a preset vulnerability database based on the network configuration information, wherein the vulnerability database comprises vulnerability information corresponding to different network configuration information.

[0187] In some embodiments, the obtaining module 301 is specifically configured to:

[0188] Send verification information to each network node in the network topology structure.

[0189] Obtain feedback information of each network node based on the verification information.

[0190] In response to the feedback information of any of the network nodes not matching the verification information, it is determined that the any of the network nodes has a vulnerability, and the vulnerability information of the any of the network nodes is acquired and stored as the target vulnerability information.

[0191] For the convenience of description, the above apparatus is described in various modules in terms of functions. Of course, in the implementation of the present application, the functions of the modules can be implemented in one or more software and / or hardware.

[0192] The apparatus of the above embodiments is used to implement the detection method of the corresponding smart home network in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here again.

[0193] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the program to implement the detection method of the smart home network according to any of the above embodiments.

[0194] Figure 4 A more specific hardware structure of an electronic device provided by the present embodiment is shown, which can include a processor 401, a memory 402, an input / output interface 403, a communication interface 404, and a bus 405. The processor 401, the memory 402, the input / output interface 403, and the communication interface 404 are connected to each other through the bus 405 for communication within the device.

[0195] The processor 401 can be implemented in the form of a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, etc., for executing related programs to implement the technical solutions provided by the present embodiment.

[0196] The memory 402 can be implemented in the form of a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 402 can store an operating system and other application programs, and when the technical solutions provided by the present embodiment are implemented by software or firmware, the related program codes are saved in the memory 402 and executed by the processor 401.

[0197] The input / output interface 403 is configured to connect an input / output module to realize information input and output. The input / output module can be configured in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0198] The communication interface 404 is configured to connect a communication module (not shown in the figure) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired manner (such as a USB, a network cable, etc.) or a wireless manner (such as a mobile network, WIFI, Bluetooth, etc.).

[0199] The bus 405 includes a channel to transmit information between various components (such as the processor 401, the memory 402, the input / output interface 403, and the communication interface 404) of the device.

[0200] It should be noted that although the above device only shows the processor 401, the memory 402, the input / output interface 403, the communication interface 404, and the bus 405, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only contain components necessary for implementing the embodiments of the present specification, and does not have to contain all the components shown in the figure.

[0201] The electronic device of the above embodiments is used to realize the detection method of the smart home network in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here.

[0202] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides a non-transitory computer readable storage medium storing computer instructions for causing the computer to execute the detection method of the smart home network as described in any of the above embodiments.

[0203] The computer readable media of the embodiments can include permanent and non-permanent, removable and non-removable media, which can be implemented by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0204] The storage medium of the above embodiments stores computer instructions for causing the computer to execute the detection method of the smart home network as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here.

[0205] Those skilled in the art should understand that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of the present application (including claims) is limited to these examples; the above embodiments or technical features between different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes of the different aspects of the embodiments of the present application as described above. In order to be brief, they are not provided in detail.

[0206] In addition, in order to simplify the description and discussion, and so as not to make the embodiments of the present application difficult to understand, the well-known power / ground connections of integrated circuit (IC) chips and other components can or can not be shown in the provided drawings. In addition, the devices can be shown in the form of block diagrams in order to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented the embodiments of the present application (i.e. these details should be fully within the understanding of those skilled in the art). Where specific details (e.g. circuits) are set forth in order to describe the exemplary embodiments of the present application, it will be apparent to those skilled in the art that the embodiments of the present application can be implemented without these specific details or with variations of these specific details. Therefore, these descriptions should be considered illustrative rather than limiting.

[0207] While the present application has been described in connection with certain embodiments thereof, many modifications, substitutions, changes, and of forms will be apparent to those of ordinary skill in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0208] Embodiments of the present application are intended to cover all such alterations, modifications, and variations as they can come within the scope of the appended claims. Accordingly, although specific embodiments have been furthered in connection with the present application, any omission, substitution, change, improvement, etc. made by one of ordinary skill in the art to the disclosed embodiments should be considered to be within the scope of the present application.

Claims

1. A method for detecting a smart home network, characterized in that, include: Obtain the network topology and network configuration information of the smart home network to be tested; Based on the network configuration information, target vulnerability information corresponding to the network topology is determined; The initial attack node in the network topology is determined based on the target vulnerability information, and the attack strategy corresponding to the initial attack node is determined. The attack strategy corresponding to the initial attack node is used to indicate the network attack to be performed under the initial attack node. Take any other network node in the network topology other than the initial attack node as the target node, and determine whether the target node satisfies the attack strategy corresponding to the initial attack node; In response to determining that the target node satisfies the attack strategy corresponding to the initial attack node, the target attack node is determined, and the path from the initial attack node to the target attack node is taken as the target attack path; The step of determining the target attack node in response to determining that the target node satisfies the attack strategy corresponding to the initial attack node includes: In response to determining that the target node satisfies the attack strategy corresponding to the initial attack node, the target node is designated as the current intermediate attack node, and the next intermediate attack node is determined based on the attack strategy corresponding to the initial attack node. In response to the absence of a new intermediate attack node corresponding to the next intermediate attack node, the next intermediate attack node is taken as the target attack node; The step of determining the next intermediate attack node based on the attack strategy corresponding to the initial attack node includes: Obtain the attack result corresponding to the current intermediate attack node; Based on the attack result corresponding to the current intermediate attack node, a network node corresponding to the current intermediate attack node is selected from the network topology as the next intermediate attack node; The step of selecting a network node corresponding to the current intermediate attack node from the network topology as the next intermediate attack node based on the attack result corresponding to the current intermediate attack node includes: Obtain the intermediate path from the current intermediate attack node to the attack result corresponding to the current intermediate attack node, and add the intermediate path to the preset attack edge set corresponding to the smart home network to be detected; Based on the attack edge corresponding to the current intermediate attack node in the attack set, the next intermediate attack node is selected from the network topology.

2. The method according to claim 1, characterized in that, The step of determining the attack strategy corresponding to the initial attack node in the network topology based on the target vulnerability information includes: Based on the target vulnerability information, determine the attack type, attack conditions, and attack result corresponding to the initial attack node; The attack type, attack conditions, and attack results corresponding to the initial attack node are combined to obtain the attack strategy corresponding to the initial attack node.

3. The method according to claim 2, characterized in that, Determining whether the target node satisfies the attack strategy corresponding to the initial attack node includes: Determine whether the target node has attack conditions that trigger an attack action of the attack type corresponding to the initial attack node, and obtain the determination result; Based on the judgment result, determine whether the target node meets the attack strategy.

4. The method according to claim 1, characterized in that, The step of determining the target vulnerability information corresponding to the network topology based on the network configuration information includes: Based on the network configuration information, target vulnerability information corresponding to the network topology is searched from a preset vulnerability database, wherein the vulnerability database includes vulnerability information corresponding to different network configuration information.

5. The method according to claim 1, characterized in that, The step of determining the target vulnerability information corresponding to the network topology based on the network configuration information includes: Send verification information to each network node in the network topology; Obtain feedback information from each network node based on the verification information; If the feedback information from any network node does not match the verification information, it is determined that the network node has a vulnerability, and the vulnerability information of the network node is acquired and stored as the target vulnerability information.

6. A detection device for a smart home network, characterized in that, include: The acquisition module is configured to acquire the network topology and network configuration information of the smart home network to be tested. The vulnerability determination module is configured to determine target vulnerability information corresponding to the network topology based on the network configuration information. The first determining module is configured to determine an initial attack node in the network topology and an attack strategy corresponding to the initial attack node based on the target vulnerability information, wherein the attack strategy corresponding to the initial attack node is used to indicate the network attack to be performed under the initial attack node. The second determining module is configured to take any other network node in the network topology other than the initial attack node as the target node and determine whether the target node satisfies the attack strategy corresponding to the initial attack node. The path determination module is configured to determine the target attack node in response to determining that the target node satisfies the attack strategy corresponding to the initial attack node, and to take the path from the initial attack node to the target attack node as the target attack path; The second determining module includes: The first determining unit is configured to, in response to determining that the target node satisfies the attack strategy corresponding to the initial attack node, take the target node as the current intermediate attack node and determine the next intermediate attack node based on the attack strategy corresponding to the initial attack node; The second determining unit is configured to, in response to the absence of a new next intermediate attack node corresponding to the next intermediate attack node, designate the next intermediate attack node as the target attack node. The first defined unit includes: The acquisition subunit is configured to acquire the attack result corresponding to the current intermediate attack node; Determine a subunit, and based on the attack result corresponding to the current intermediate attack node, select a network node corresponding to the current intermediate attack node from the network topology as the next intermediate attack node; The sub-unit is defined and specifically configured as follows: Obtain the intermediate path from the current intermediate attack node to the attack result corresponding to the current intermediate attack node, and add the intermediate path to the preset attack edge set corresponding to the smart home network to be detected; Based on the attack edge corresponding to the current intermediate attack node in the attack set, the next intermediate attack node is selected from the network topology.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 5.

Images