Threat path construction method for power monitoring system based on ATT&CK framework

Abstract

The present invention discloses a method for constructing a threat path of an electric power monitoring system based on an ATT&CK framework, and relates to the technical field of electric power monitoring, including: S1, constructing an undirected graph G of a monitoring network based on the connectivity status between electric power equipment; S2, converting the undirected graph G of the monitoring network into a directed graph D of the monitoring network according to asset classification information of the electric power monitoring system; S3, calculating the directed graph D of the monitoring network using a depth-first algorithm, obtaining all attack paths of the target electric power equipment, and merging the attack paths to obtain an attack graph; S4, setting a node of the target attack device as a target node based on the attack graph; S5, establishing a mapping relationship between the ATT&CK framework and a network kill chain, and constructing a target device threat path graph F of the target node based on the mapping relationship; realizing automatic construction of threat paths and discovering relevant threats and path information inside the electric power monitoring system, supplementing new attack methods, and further ensuring the safe and stable operation of the electric power system.

Description

Technical Field

[0001] The present invention relates to the field of power monitoring technology, and in particular to a method for constructing a threat path for a power monitoring system based on an ATT&CK framework. Background Art

[0002] With the development of network security environment, various attack methods emerge in an endless stream. The attack mode dominated by APT (Advanced Persistent Threat) attack has gradually become the main threat faced by the power grid. At the same time, with the change of power supply structure, the exposure of the power system has gradually expanded; threat path construction is one of the effective means to defend against APT attacks. Through threat path construction, we can better understand the behavior of attackers, so as to formulate more effective defense strategies and prevent attackers from attacking along the threat path. The technical means of constructing threat paths in the existing technology are mainly the improved Deep Q-Network (DQN) algorithm, NDSPI-DQN (decoupling) algorithm and threat path generation method of knowledge graph. Although the above methods solve the problems of high labor cost and high time complexity faced by traditional threat path generation methods and improve the efficiency of path generation, in the face of complex and changing power supply structure, there is no fine division of the types and security levels of power monitoring systems, and the protection ability for new attack methods such as sociological attacks, 0Day attacks, and supply chain attacks is insufficient, and the response rate and security strategy adaptation are still limited.

[0003] Chinese patent, publication number: CN112769821B, publication date: July 22, 2022, discloses a threat response method and device based on threat intelligence and ATT&CK, the method including establishing a threat intelligence library, collecting the threat intelligence from public resources and traditional security devices, combining the ATT&CK framework to parse the entire life cycle of attack behavior, and establishing an attacker machine learning model in the form of a complete attack chain; establishing a mapping relationship between labels and processing rules based on the attacker machine learning model; using DFI-based deep flow detection technology to monitor real-time traffic data, identify and continuously change label values ​​according to changes in real-time traffic characteristics; activating threat defense according to the mapping relationship between labels and processing rules. The invention mainly provides a method of collecting threat intelligence, using the ATT&CK framework to parse the attack behavior, and then establishing a mapping relationship between the corresponding labels and processing rules that can activate threat defense, thereby solving the problems of difficulty in linking the attack intention with the attack process and inability to obtain effective intelligence due to incomplete threat intelligence information, resulting in a lack of evidence in the tracing process, and the attack behavior will consume a lot of resources and even cause network congestion or paralysis. In the face of the complex communication relationship between devices and the changeable power supply structure of the power monitoring system, this method fails to take into account the classification and grading of the equipment, and cannot generate accurate threat paths to improve the protection capability of the power monitoring system. Summary of the invention

[0004] The purpose of the present invention is to address the problem that the existing threat path generation methods have limitations and lead to poor defense effects; a threat path construction method for a power monitoring system based on the ATT&CK framework is designed, and an attack graph of internal threats in the power monitoring system is constructed through the connectivity between devices in the power monitoring system and the hierarchical information of the devices, and the threat path of the target device is supplemented with information in combination with ATT&CK tactical information and the network kill chain, thereby realizing automatic construction of the threat path, and supplementing the traditional threat path construction method with new attack methods such as sociological attacks, 0Day attacks, and supply chain attacks; further improving the efficient operation of the power monitoring system and ensuring the safe and stable operation of the power system; at the same time, through the threat path construction method, relevant threats and path information within the power monitoring system can be automatically discovered, providing a theoretical basis and support for the formulation of security strategies under the new power system.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: a method for constructing a threat path of a power monitoring system based on the ATT&CK framework, comprising the following steps:

[0006] S1. Construct an undirected graph G of the monitoring network based on the connectivity status between power equipment;

[0007] S2. Convert the monitoring network undirected graph G into a monitoring network directed graph D according to the asset classification information of the power monitoring system;

[0008] S3, using a depth-first algorithm to calculate the directed graph D of the monitoring network, obtain all attack paths of the target power equipment and merge the attack paths to obtain an attack graph;

[0009] S4, setting a node of a target attack device as a target node based on the attack graph;

[0010] S5. Establish a mapping relationship between the ATT&CK framework and the network kill chain, and construct a target device threat path graph F of the target node based on the mapping relationship.

[0011] In this scheme, an undirected graph G is constructed through the connectivity status information between power devices, which can clearly show the connection relationship between each device, simplify and visualize the complex power monitoring network, and provide basic data of device connection path information for building threat paths; the asset classification information of the power monitoring system reflects the importance of different devices in the power system. According to the classification information, the undirected graph is converted into a directed graph to make a more accurate analysis of the impact between different devices and the construction of attack paths; by traversing the directed graph D through the depth-first algorithm, all potential attack paths can be found, so that potential threats and risk points can be more comprehensively identified, providing data support for subsequent target device selection and threat path analysis; all attack paths are merged into an attack graph, which intuitively shows the attack steps and paths that the attacker may take. The asset classification information is obtained, and then the attack graph can be used to predict the devices that may be attacked, so as to take timely protective measures, reduce or even avoid attacks on the devices, and improve the safety of the devices; the target nodes help security personnel to more accurately locate and analyze potential security threats, protect and defend the key nodes of the system, so as to provide guidance for the formulation of targeted defense strategies, and provide clear goals for the subsequent threat path construction; the threat path diagram of the target device is constructed through the mapping relationship between the ATT&CK framework and the network kill chain, the purpose is to map the threat path of the target device in the attack graph with the attack technology and methods in the ATT&CK framework, so as to construct the threat path diagram of the target device, so as to fully understand the potential attack means and threat path, so as to formulate more effective defense measures, and provide support for the formulation of detailed security strategies and countermeasures. At the same time, the threat path is automatically constructed in combination with ATT&CK tactical information and the network kill chain, and the new attack methods such as sociological attacks, 0Day attacks, and supply chain attacks are supplemented; the efficient operation of the power monitoring system is further improved to ensure the safe and stable operation of the power system.

[0012] Preferably, the S1 includes:

[0013] S11, classifying the types and levels of the power monitoring system assets to obtain the classification information of the power monitoring system assets;

[0014] S12. Based on the classification information, an undirected graph G of a monitoring network of the power monitoring system is constructed according to the communication mechanism between power equipment of various types and corresponding levels.

[0015] Preferably, the S11 includes:

[0016] S111. Classify the types of power monitoring system assets based on the ATT&CK framework structure, and establish a corresponding relationship between the ATT&CK framework structure and the types;

[0017] S112. Based on the CIA asset classification strategy and the asset attributes of the power monitoring system, importance classification is performed to obtain an asset classification table of the power monitoring system.

[0018] Preferably, the asset attributes include the subsystem to which the asset belongs, the type of data carried by the power monitoring system, and the logical location of the power monitoring system.

[0019] In this scheme, considering the importance and complexity of the power monitoring system, the traditional asset classification strategy based on CIA (Confidentiality, Integrity, Availability) may not achieve the desired effect. Therefore, the importance of assets in the power monitoring system is comprehensively evaluated in terms of the subsystem to which the assets belong, the type of data carried by the power monitoring system, and the logical position of the power monitoring system. Accurate classification of assets in the power monitoring system is achieved to more comprehensively and accurately evaluate the importance of each asset in the power monitoring system, which helps to formulate differentiated security protection strategies for assets of different levels, helps to comprehensively improve the security, operating efficiency and emergency response capabilities of the system, and provides optimization basis and support for the subsequent optimization of threat paths of target equipment, providing strong guarantees for the stable operation of the power system.

[0020] Preferably, the S2 includes:

[0021] S21. Analyze the attack characteristics of power equipment threats based on APT attack patterns;

[0022] The attack characteristics include: a trend of the attack threat on the power equipment to shift from equipment of a low importance level to equipment of a high importance level or between equipment of the same importance level;

[0023] S22. Based on the attack characteristics, the monitoring network undirected graph G is used as a data source, and the monitoring network directed graph D is constructed in combination with the power monitoring system asset level table.

[0024] In this scheme, by analyzing the attack characteristics of the acquisition equipment of the APT attack mode, the monitoring network undirected graph G is converted into the monitoring network directed graph D in combination with the asset level information of the power monitoring system, so as to achieve a clearer and more intuitive description of the movement trend of internal threats in the power monitoring system, so that targeted protection measures can be formulated to improve the security protection capabilities of the entire system.

[0025] Preferably, S3 includes:

[0026] S31, setting a source node and a target threat node based on the monitoring network directed graph D, traversing and searching the monitoring network directed graph D by a depth-first algorithm, and obtaining all path information from the source node to the target threat node;

[0027] S32: Merge the path information to generate a target threat movement directed graph V, and use the target threat movement directed graph V as the attack graph.

[0028] In this scheme, the directed graph D is traversed by the depth-first algorithm, which solves the loop problem in the directed graph D. By traversing and finding all potential attack paths, potential threats and risk points can be more comprehensively identified, providing data support for subsequent target device selection and threat path analysis; all attack paths are merged into an attack graph, which intuitively shows the attack steps and paths that the attacker may take. Because the directed graph D is obtained based on the asset classification information of the power monitoring system, the attack graph can also be used to predict the equipment that may be attacked, so as to take protective measures in time, reduce or even avoid attacks on the equipment, and improve equipment safety.

[0029] Preferably, the S5 includes:

[0030] S51. Associate the attack strategy in the ATT&CK industry matrix with the network kill chain to establish a mapping relationship between the attack strategy and the network kill chain;

[0031] S52, constraining the target threat movement directed graph V based on the mapping relationship to generate a single-node monomer threat path graph A;

[0032] S53, according to the state information of the node in the target threat mobile directed graph V, perform primary pruning and secondary pruning on the monomer threat path graph A corresponding to the node to obtain a trimmed monomer threat path optimization graph Ai;

[0033] S54, obtaining relevant information of the target node based on the single threat path optimization graph Ai, and constructing an initial threat path graph J of the target node;

[0034] S55, traversing the non-target nodes v in the target threat movement directed graph V a , configure the non-target nodes, optimize the initial threat path graph J according to the configuration results, and use the optimized initial threat path graph J as the target device threat path graph F.

[0035] Preferably, the S53 includes:

[0036] S531: Determine whether the target threatens the node v to be tested in the mobile directed graph V i The identity information of the user is used, and the first trimming is performed according to the judgment result to obtain the single threat path diagram A after the first trimming, wherein:

[0037] If the node v to be tested i If the target node is the node, there is no lateral movement of the node, and the node to be tested v i The corresponding lateral movement node and its predecessor neighbor node in the single threat path graph A are deleted;

[0038] If the node v to be tested i is not the target node, then the node to be tested v i is the path starting node or the path node, and the node to be tested v i The corresponding damage process control node, suppression response function node and impact node in the single threat path diagram A are deleted;

[0039] S532. Based on the asset type of the node, the monomer threat path graph A is trimmed again in combination with the asset-related technical information in the ATT&CK framework to obtain the monomer threat path optimization graph Ai.

[0040] Preferably, the S54 includes:

[0041] The nodes and edges in the single threat path optimization graph Ai are obtained, and the nodes and edges are used as the nodes and edges of the initial threat path graph J.

[0042] Preferably, in S55, configuring the non-target node includes:

[0043] Determine the non-target node v a Is there a successor neighbor node v b , if so, then the non-target node v a The corresponding lateral movement nodes and their adjacent edges in the single threat path graph A are added to the initial threat path graph J;

[0044] Synchronously, the successor neighbor node v bThe execution node and its adjacent edges are added to the initial threat path graph J.

[0045] In this solution, by establishing a mapping relationship between the ATT&CK framework and the network kill chain, the attacker's tactics, techniques, and procedures (TTP) are combined with each stage of the network kill chain in order to build a threat path for the target device based on the attacker's attack means and attack path, and provide security personnel with in-depth security threat analysis tools, so that they can fully understand the attacker's attack strategy and means, and thus formulate more effective defense measures. Among them, by associating the tactics in the ATT&CK industrial matrix with the network kill chain, a threat path map for a single node can be generated, and the threat path map for a single node can be processed, and the node can be conditionally deleted to obtain a more comprehensive, reliable, and refined threat path map.

[0046] Beneficial effects of the present invention:

[0047] Through the connectivity between devices in the power monitoring system and the hierarchical information of the devices, an attack graph of internal threats in the power monitoring system is constructed. Combined with ATT&CK tactical information and the network kill chain, the threat path of the target device is supplemented to achieve automatic construction of the threat path, supplementing new attack methods such as sociological attacks, 0Day attacks, and supply chain attacks; further improving the efficient operation of the power monitoring system and ensuring the safe and stable operation of the power system; at the same time, through the threat path construction method, it can automatically discover relevant threats and path information within the power monitoring system, providing a theoretical basis and support for the formulation of security strategies under the new power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Other features, objects and advantages of the present invention will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings. The drawings are only for the purpose of illustrating preferred embodiments and are not to be considered as limiting the present invention. Also, the same reference symbols are used throughout the drawings to represent the same parts.

[0049] Figure 1 The present invention is a flowchart of a method for constructing a threat path for a power monitoring system based on the ATT&CK framework according to an embodiment of the present invention.

[0050] Figure 2 A schematic diagram of constructing an undirected graph G of a monitoring network according to an embodiment of the present invention.

[0051] Figure 3 The present invention is a flowchart for constructing a monitoring network directed graph D according to an embodiment of the present invention.

[0052] Figure 4 Schematic diagram of the structure of a monitoring network directed graph D according to an embodiment of the present invention.

[0053] Figure 5 The present invention is a flowchart of constructing a target threat mobile directed graph V according to an embodiment of the present invention.

[0054] Figure 6 Schematic diagram of the structure of a target threat mobile directed graph V according to an embodiment of the present invention.

[0055] Figure 7 A schematic diagram of the mapping relationship between ATT&CK and the network kill chain according to an embodiment of the present invention.

[0056] Figure 8 This is a flow chart of cutting a single threat path optimization graph Ai according to an embodiment of the present invention.

[0057] Fig. 9 The present invention is a flowchart for constructing a target device threat path map according to an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation method described herein is only an optimal embodiment of the present invention, which is only used to explain the present invention and does not limit the scope of protection of the present invention. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0059] First, some nouns or terms that appear in the process of describing the embodiments of the present invention are subject to the following explanations:

[0060] ATT&CK: The abbreviation of Adversarial Tactics Techniques and Common Knowledge. It is a model and knowledge base that reflects the attack behaviors of each attack life cycle. ATT&CK helps to understand known attacker behaviors, techniques, and tactics, prepare detection measures, and verify the effectiveness of defense infrastructure and analysis strategies.

[0061] CIA: refers to the classification of information system security levels according to the confidentiality, integrity and availability of information systems in information security level protection work. The three properties are referred to as CIA.

[0062] APT: The abbreviation of Advanced Persistent Threat. It is a long-term and highly concealed attack mode. The attacker carefully plans and lurks in the target network for a long time, collecting various information of the target, such as business processes, system operation status, etc., waiting for an opportunity to launch an attack and steal the target's core information.

[0063] Resource-associated attack technology information: refers to attack technologies associated with specific resources or assets in an industrial environment, which describes in detail how attackers use specific resources to perform attacks, including the tools, techniques, and strategies used. Among them, the industrial matrix in ATT&CK is a security framework specifically for industrial control systems, designed to help organizations understand, prevent, and respond to cyber attacks against these systems; specific resources may include hardware, software, network components, sensors, actuators, etc. in industrial control systems. Attackers may exploit vulnerabilities or weaknesses in these resources to perform various attack behaviors to achieve their goals, such as disrupting production, stealing sensitive data, or ransomware.

[0064] Cyber ​​Kill Chain: The Cyber ​​Attack Lifecycle. Is a phase-based model used to describe the stages of a targeted cyber attack. It breaks down each stage of a malware attack that defenders can identify and prevent.

[0065] Example 1: Figure 1 As shown, a method for constructing a threat path of a power monitoring system based on the ATT&CK framework includes steps S1-S5, wherein:

[0066] S1. Construct a monitoring network undirected graph G based on the connectivity status between power equipment.

[0067] Specifically, S1 includes:

[0068] S11. Classify the types and levels of power monitoring system assets to obtain hierarchical information of power monitoring system assets, wherein: S111. Classify the types of power monitoring system assets based on the ATT&CK framework structure, and establish a corresponding relationship between the ATT&CK framework structure and the type;

[0069] S112, based on the CIA asset classification strategy and the asset attributes of the power monitoring system, an importance classification is performed to obtain an asset classification table of the power monitoring system, wherein the asset attributes include the subsystem to which the asset belongs, the type of data carried by the power monitoring system, and the logical position of the power monitoring system;

[0070] S12. Based on the hierarchical information, an undirected graph G of the monitoring network of the power monitoring system is constructed according to the communication mechanism between power equipment of various types and corresponding levels.

[0071] In this embodiment, based on the asset classification of the ATT&CK framework and combined with the characteristics of the power monitoring system, the power monitoring system assets are divided into 7 types, as shown in Table 1:

[0072] Table 1 Classification of power monitoring system assets

[0073]

[0074] It is understandable that in the face of the importance and complexity of the power monitoring system, the traditional asset classification strategy based on CIA (Confidentiality, Integrity, Availability) may not achieve the desired effect. Therefore, based on CIA, we can comprehensively evaluate the importance of assets in the power monitoring system in combination with the importance of the subsystem to which the assets belong, the type of data carried by the power monitoring system, and the logical location of the power monitoring system, so as to achieve accurate classification of assets in the power monitoring system. Among them, the subsystems to which the assets belong include real-time systems, non-real-time systems, and management systems. The types of data carried include production data, analysis data, and marketing data. The logical location of the power monitoring system includes the master station side and the plant station side. The specific classification is shown in Table 2:

[0075] Table 2 Power monitoring system asset level table

[0076]

[0077] Specifically, Figure 2 As shown in the figure, according to the network accessibility between devices, an undirected graph of the power monitoring system network is generated. First, the devices in the network topology are recorded as points v in the undirected graph G. If there are n devices in the topology, then V(G) = {v1, v2, ..., v n}; Let v i With v j are two nodes in V(G), 1≤i≤n, 1≤j≤n, i≠j, if v i With v j The network is reachable between them, then it is recorded as an edge v in the undirected graph G i v j .

[0078] S2. Convert the monitoring network undirected graph G into the monitoring network directed graph D according to the asset classification information of the power monitoring system.

[0079] Specifically, S2 includes:

[0080] S21. Analyze the attack characteristics of power equipment threats based on APT attack patterns;

[0081] Attack characteristics include: the trend of attack threats on power equipment moving from equipment with a low importance level to equipment with a high importance level or between equipment with the same importance level;

[0082] S22. Based on the attack characteristics, the monitoring network undirected graph G is used as the data source, and the monitoring network directed graph D is constructed in combination with the power monitoring system asset level table.

[0083] S3. Use the depth-first algorithm to calculate the directed graph D of the monitoring network, obtain all attack paths of the target power equipment, and merge the attack paths to obtain an attack graph.

[0084] Specifically, S3 includes:

[0085] S31, setting a source node and a target threat node based on the monitoring network directed graph D, traversing and searching the monitoring network directed graph D through a depth-first algorithm, and obtaining all path information from the source node to the target threat node;

[0086] S32: Merge the path information to generate a target threat movement directed graph V, and use the target threat movement directed graph V as an attack graph.

[0087] S4. Set the node of the target attack device as the target node based on the attack graph.

[0088] S5. Establish a mapping relationship between the ATT&CK framework and the network kill chain, and build a target device threat path diagram F of the target node based on the mapping relationship.

[0089] Specifically, S5 includes:

[0090] S51. Associate the attack strategy in the ATT&CK industry matrix with the network kill chain to establish a mapping relationship between the attack strategy and the network kill chain;

[0091] S52, constraining the target threat mobile directed graph V based on the mapping relationship to generate a single node single threat path graph A; S53, performing primary and secondary pruning on the single threat path graph A corresponding to the node according to the state information of the node in the target threat mobile directed graph V, and obtaining the single threat path optimization graph Ai after pruning;

[0092] S54, obtaining relevant information of the target node based on the single threat path optimization graph Ai, and constructing an initial threat path graph J of the target node, wherein the nodes and edges in the single threat path optimization graph Ai are obtained, and the nodes and edges are used as the nodes and edges of the initial threat path graph J;

[0093] S55, traverse the non-target node v in the target threat movement directed graph V a, configure the non-target nodes, optimize the initial threat path graph J according to the configuration results, and use the optimized initial threat path graph J as the target device threat path graph F.

[0094] Specifically, S53 includes:

[0095] S531, determine the target threat mobile directed graph V to be tested node v i The identity information of the target is trimmed according to the judgment result to obtain a trimmed single threat path diagram A, where:

[0096] If the node v to be tested i If the node is the target node, there is no lateral movement of the node. i The lateral movement node and its predecessor neighbor node in the corresponding single threat path graph A are deleted;

[0097] If the node v to be tested i is a non-target node, then the node to be tested v i is the starting node or the passing node of the path, and the node to be tested v i The corresponding damage process control node, suppression response function node and impact node in the single threat path diagram A are deleted;

[0098] S532. Based on the asset type of the node, the single threat path graph A is pruned once and combined with the asset-related technical information in the ATT&CK framework to obtain the single threat path optimization graph Ai.

[0099] Specifically, in S55, configuring the non-target node includes:

[0100] Determine non-target node v a Is there a successor neighbor node v b , if so, the non-target node v a The corresponding lateral movement nodes and their adjacent edges in the single threat path graph A are added to the initial threat path graph J;

[0101] Synchronously, the successor neighbor node v b The execution node and its adjacent edges are added to the initial threat path graph J.

[0102] As a specific implementation method, Figure 3 and Figure 4As shown in the figure, considering that the purpose of APT attacks is to steal core secrets, destroy or hinder the key systems of tasks, programs or organizations, the main target of attackers is high-value or critical equipment and data in the system. Therefore, it can be known that the movement trend of threats is usually from low-importance equipment to high-importance equipment, or between equipment of equal importance. Based on this feature and the asset level table of the power monitoring system, a monitoring network directed graph D is constructed to describe the movement trend of threats within the power monitoring system. The specific steps are:

[0103] B1. Let I be the importance of the device. For the set V(G) of nodes in the undirected graph G(V,E) of the monitoring network, there exists a directed graph D of the monitoring network, in which the set of points V(D) = V(G). Then, the set V(D) of nodes in the directed graph D(V,E) of the monitoring network can be obtained.

[0104] B2. For any two nodes v in the undirected graph G(V,E) of the monitoring network i， v j , whose importance is denoted as I i , I j , if v i， v j If there is an edge between them, then compare I i , I j The size of the node is calculated, and an edge is added to the directed graph D(V,E) of the monitoring network, with the direction from the node with lower importance to the node with higher importance; i =I j , then add bidirectional edges between the corresponding nodes, and finally obtain the set E(D) of edges in the directed graph D(V,E) of the monitoring network;

[0105] B3. Combine the node set V(D) and the edge set E(D) into a monitoring network directed graph D(V,E).

[0106] Specifically, Figure 5 and Figure 6 As shown in Figure 1, the monitoring network directed graph D(V,E) represents the connectivity status of each device in the network and the possible threat movement direction. Based on the monitoring network directed graph D(V,E), we can construct a threat movement path graph for a specific target. Let Temp(V,E) be the temporary graph, v t The steps for constructing the target threat mobile directed graph Vt(V,E) are as follows:

[0107] C1. Select a node v from the directed graph D(V,E) of the monitoring network i , query the edges associated with it, if v i If there are only outgoing edges and no incoming edges, then v iRecord it as the source node and continue to query other nodes. If v i If there are both outgoing and incoming edges, the node is abandoned, and other nodes are selected from the directed graph D(V,E) of the monitoring network for query, and n source nodes are finally obtained, 1≤n≤|V(D)|;

[0108] C2. Search for the source node v using a depth-first algorithm i to v t All paths between them, and save these paths and nodes as source nodes v i , the target node is v t The attack path graph Tempvi-vt(V,E);

[0109] C3, repeat steps (1) to (2) until all source nodes to the target node v t After the path calculation is completed, the target v can be obtained. t n threat movement paths;

[0110] C4, set the target to v t The n threat movement paths are merged to obtain a target v t The total graph of threat movement paths Vt(V,E).

[0111] Specifically, Figure 7 As shown in the figure, based on expert experience, the 12 tactics in the ATT&CK industrial matrix are associated with the network kill chain to obtain the mapping result between the ATT&CK framework and the network kill chain.

[0112] Furthermore, if Figure 8 As shown in the figure, the steps for cutting the threat path of a single node based on the mapping results of the ATT&CK framework and the network kill chain are as follows:

[0113] First, determine the target threat moving directed graph Vt(V,E) to be tested node v i Identity information, if v i =v t , then v i The target node in the target threat moving directed graph Vt(V,E) does not have the action of moving horizontally to other nodes, so it is necessary to i In the single threat path diagram A(V,E), TA0109 moves horizontally and its predecessor nodes are deleted; if v i ≠v t , then the node v to be tested i is the starting node or path node of the path. Since the target of the entire attack path is v t , so we need to set the node v to be tested iIn the single threat path diagram A(V,E), the TA0106 damage process control node, TA0107 suppression response function node and TA0105 impact node are deleted;

[0114] Secondly, through the resource-related attack technology information in the industrial matrix in ATT&CK, the single threat path graph A(V,E) of vi is further pruned to obtain the pruned single threat path graph Ai(V,E) of node vi;

[0115] Finally, repeat the above steps until all nodes in Vt(V,E) are traversed, and finally a pruned set of single node threat path graphs is obtained, completing the threat path graph of the node v to be tested. i Cropping of the single threat path diagram.

[0116] Furthermore, if Fig. 9 As shown in the figure, add the nodes and edges in the single threat path optimization graph Ai(V,E) of node vi to the directed graph Dt(V,E), and repeat this step until all nodes in the target threat movement directed graph Vt(V,E) are traversed. At this time, we get a target node v t Select a node v from the target threat movement directed graph Vt(V,E) a , v a ≠v t , if the successor neighbor of the node is v b , then add an edge (v a .Ta109,v b .Ta104), where v a .Ta109 is v a TA0109 lateral movement node in the single threat path diagram Aa(V,E), v b .Ta104 is v b Execute node TA0104 in the single threat path graph Ab(V,E). Repeat this step until all nodes in the target threat movement directed graph Vt(V,E) are traversed, and finally the target node v is obtained. t Threat path diagram Dt(V,E) (target device threat path diagram).

[0117] The effect of this embodiment is: by associating the 12 tactics in the ATT&CK industrial matrix with the network kill chain according to expert experience, the mapping result of the ATT&CK framework and the network kill chain is obtained, which introduces new attack methods such as social attacks, 0day attacks, and supply chain attacks on the basis of traditional attack methods, and through the threat path construction method, the automatic discovery of internal threat paths in the power monitoring system is realized; this method not only provides theoretical support for the formulation of security policies for the power monitoring system, but also provides the possibility for adaptive adjustment of network security policies when threats are detected.

[0118] The above specific embodiments are preferred embodiments of the present invention, and are not intended to limit the specific implementation scope of the present invention. The scope of the present invention includes but is not limited to the present specific embodiments. All equivalent changes made in accordance with the shape, structure, and method of the present invention are within the protection scope of the present invention.

Claims

1. A method for constructing a threat path for a power monitoring system based on the ATT&CK framework, characterized by: The steps include: S1. Construct an undirected graph G of the monitoring network based on the connectivity status between power equipment; S2. Convert the monitoring network undirected graph G into a monitoring network directed graph D according to the hierarchical information of the power monitoring system assets; S3, using a depth-first algorithm to calculate the directed graph D of the monitoring network, obtain all attack paths of the target power equipment and merge the attack paths to obtain an attack graph; S4, setting a node of a target attack device as a target node based on the attack graph; S5. Establish a mapping relationship between the ATT&CK framework and the network kill chain, and construct a target device threat path graph F of the target node based on the mapping relationship; The S1 includes: S11, classifying the types and levels of the power monitoring system assets to obtain the classification information of the power monitoring system assets; S111. Classify the types of power monitoring system assets based on the ATT&CK framework structure, and establish a corresponding relationship between the ATT&CK framework structure and the types; S112, based on the CIA asset classification strategy and the asset attributes of the power monitoring system, the importance level is classified to obtain the power monitoring system asset level table; S12, based on the classification information, constructing a monitoring network undirected graph G of the power monitoring system according to the communication mechanism between power equipment of each type and corresponding level; The S3 includes: S31, setting a source node and a target threat node based on the monitoring network directed graph D, traversing and searching the monitoring network directed graph D by a depth-first algorithm, and obtaining all path information from the source node to the target threat node; S32, merging the path information to generate a target threat movement directed graph V, and using the target threat movement directed graph V as the attack graph; The S5 includes: S51. Associate the attack strategy in the ATT&CK industry matrix with the network kill chain to establish a mapping relationship between the attack strategy and the network kill chain; S52, constraining the target threat movement directed graph V based on the mapping relationship to generate a single-node monomer threat path graph A; S53, according to the state information of the node in the target threat mobile directed graph V, perform primary pruning and secondary pruning on the monomer threat path graph A corresponding to the node to obtain a trimmed monomer threat path optimization graph Ai; S54, obtaining relevant information of the target node based on the single threat path optimization graph Ai, and constructing an initial threat path graph J of the target node; S55, traversing the non-target nodes v in the target threat movement directed graph V a , configure the non-target nodes, optimize the initial threat path graph J according to the configuration results, and use the optimized initial threat path graph J as the target device threat path graph F.

2. The method for constructing a threat path for a power monitoring system based on the ATT&CK framework according to claim 1 is characterized in that: The asset attributes include the subsystem to which the asset belongs, the type of data carried by the power monitoring system, and the logical location of the power monitoring system.

3. The method for constructing a threat path for a power monitoring system based on the ATT&CK framework according to claim 1 is characterized in that: The S2 includes: S21. Analyze the attack characteristics of power equipment threats based on APT attack patterns; The attack characteristics include: a trend of the attack threat on the power equipment to shift from equipment of a low importance level to equipment of a high importance level or between equipment of the same importance level; S22. Based on the attack characteristics, the monitoring network undirected graph G is used as a data source, and the monitoring network directed graph D is constructed in combination with the power monitoring system asset level table.

4. The method for constructing a threat path for a power monitoring system based on the ATT&CK framework according to claim 1 is characterized in that: The S53 includes: S531: Determine whether the target threatens the node v to be tested in the mobile directed graph V i The identity information of the user is used, and the first trimming is performed according to the judgment result to obtain the single threat path diagram A after the first trimming, wherein: If the node v to be tested i If the target node is the node, there is no lateral movement of the node, and the node to be tested v i The corresponding lateral movement node and its predecessor neighbor node in the single threat path graph A are deleted; If the node v to be tested i is not the target node, then the node to be tested v i is the path starting node or the path node, and the node to be tested v i The corresponding damage process control node, suppression response function node and impact node in the single threat path diagram A are deleted; S532. Based on the asset type of the node, the monomer threat path graph A is trimmed again in combination with the asset-related technical information in the ATT&CK framework to obtain the monomer threat path optimization graph Ai.

5. The method for constructing a threat path for a power monitoring system based on the ATT&CK framework according to claim 1 is characterized in that: The S54 includes: The nodes and edges in the single threat path optimization graph Ai are obtained, and the nodes and edges are used as the nodes and edges of the initial threat path graph J.

6. The method for constructing a threat path for a power monitoring system based on the ATT&CK framework according to claim 1 is characterized in that: In the S55, configuring the non-target node includes: Determine the non-target node v a Is there a successor neighbor node v b , if so, the non-target node v a The corresponding lateral movement nodes and their adjacent edges in the single threat path graph A are added to the initial threat path graph J; Synchronously, the successor neighbor node v b The execution node and its adjacent edges are added to the initial threat path graph J.

Images