Network attack scheme recommendation method and device, electronic equipment and storage medium

Abstract

The embodiment of the application provides a network attack scheme recommendation method and device, electronic equipment and storage medium, and belongs to the technical field of network security. The method comprises the following steps: screening a plurality of hosts with vulnerabilities from a target network by combining vulnerability description information, service configuration information and a preset derivation rule; screening a plurality of risk hosts from the plurality of hosts with vulnerabilities and obtaining attack state transition information between the risk hosts by combining the service configuration information, network configuration information and the derivation rule; grouping the risk hosts according to the attack state transition information and determining a group attack path between each risk group; determining a plurality of target risk hosts according to a risk quantization value obtained by performing multidimensional scoring on each risk host according to the vulnerability description information; and generating a target simulation attack scheme corresponding to a target attack path based on the group attack path and the plurality of target risk hosts. The application can improve the generation efficiency of the network attack scheme.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network attack scheme recommendation method and device, electronic equipment and a storage medium. BACKGROUND

[0002] In order to evaluate the security of a target network and prevent potential attacks, network security evaluation needs to be performed on the target network to find security vulnerabilities and potential risks existing in the target network and provide suggestions for improving security. Among them, generating a network attack scheme is one of the important contents of network security evaluation, which can help understand the security problems existing in the target network and guide the security repair work of the target network.

[0003] In related technologies, an attack graph formed based on a target network is often used to determine a corresponding network attack scheme. However, as the size of the target network increases, the complexity of the attack graph also increases exponentially, which further reduces the generation efficiency of the network attack scheme. SUMMARY

[0004] The main purpose of the embodiments of the present application is to provide a network attack scheme recommendation method, device, electronic equipment and storage medium, which can improve the generation efficiency of the network attack scheme.

[0005] To achieve the above purpose, a first aspect of the embodiments of the present application provides a network attack scheme recommendation method, which comprises:

[0006] obtaining vulnerability description information, service configuration information and network configuration information of a target network;

[0007] jointly filtering a plurality of hosts with vulnerabilities from the target network based on the vulnerability description information, the service configuration information and a preset derivation rule;

[0008] jointly filtering a plurality of risk hosts from the plurality of hosts with vulnerabilities based on the service configuration information, the network configuration information and the derivation rule, and obtaining attack state transition information between the risk hosts;

[0009] grouping the risk hosts according to the attack state transition information, and forming a group attack path between the risk groups according to the attack state transition information;

[0010] performing multi-dimensional scoring on each of the risk hosts according to the vulnerability description information to obtain a corresponding risk quantization value, and determining a plurality of target risk hosts according to the risk quantization value;

[0011] forming a target attack path based on the group attack path and the plurality of target risk hosts, and generating a target simulation attack scheme corresponding to the target attack path.

[0012] In some embodiments, the joint of the vulnerability description information, the service configuration information and the preset derivation rule, the plurality of hosts with vulnerabilities are screened from the target network, comprising:

[0013] The vulnerability description information and the service configuration information are parsed respectively to obtain a plurality of vulnerability parsing information and a plurality of service parsing information, wherein the service parsing information includes program information for indicating the host currently running;

[0014] The vulnerability exploitation rule matched with the vulnerability parsing information and the service configuration information is determined from the derivation rule, and the host indicated by the vulnerability exploitation rule is determined as the host with vulnerabilities in the target network.

[0015] In some embodiments, the joint of the service configuration information, the network configuration information and the derivation rule, a plurality of risk hosts are screened from the plurality of hosts with vulnerabilities, and attack state transition information between the risk hosts is obtained, comprising:

[0016] The network configuration information is parsed to obtain a plurality of network parsing information, wherein the network parsing information includes topology information for indicating the structure of the target network;

[0017] The hazard propagation rule matched with the service configuration information is determined from the derivation rule, and the host indicated by the hazard propagation rule is determined as a risk host;

[0018] The multi-hop network access rule matched with the network configuration information is determined from the derivation rule, and the attack state transition information between the risk hosts is determined according to the multi-hop network access rule.

[0019] In some embodiments, the risk hosts are grouped according to the attack state transition information, and a group attack path between the risk groups is formed according to the attack state transition information, comprising:

[0020] The entry associated host and the exit associated host corresponding to the risk host are determined according to the attack state transition information, and the risk host with the same entry associated host and exit associated host is determined as the same risk group;

[0021] The previous attack group and the subsequent attack group of any risk group are determined according to the attack state information, and the corresponding group attack path is formed based on the risk group and the corresponding previous attack group and subsequent attack group.

[0022] In some embodiments, the multi-dimensional scoring of each of the risk hosts according to the vulnerability description information comprises:

[0023] Based on the corresponding vulnerability description information of each of the risk hosts, corresponding vulnerability detailed information is queried from a preset vulnerability knowledge base;

[0024] The vulnerability detailed information is scored from a first dimension to obtain a vulnerability impact score, and is scored from a second dimension to obtain a vulnerability exploitation score;

[0025] According to preset first and second weight values, the vulnerability impact score and the vulnerability exploitation score are weighted and calculated respectively, and the calculated result is the risk quantization value of the risk host.

[0026] In some embodiments, after the risk hosts are grouped according to the attack state transition information, the method further comprises:

[0027] A host to be evaluated is determined according to attack node information input by a user;

[0028] If the host to be evaluated is one of any of the risk groups, the host to be evaluated is determined as a target risk host;

[0029] According to the attack state transition information, other risk groups associated with the risk group in which the target risk host is located are determined, and a group attack path between each of the risk groups is determined;

[0030] According to the risk quantization value, other target risk hosts in each of the other risk groups are determined, a target attack path is formed based on the group attack path and all the target risk hosts, and a target simulation attack scheme corresponding to the target attack path is generated.

[0031] In some embodiments, the generation of the target simulation attack scheme corresponding to the target attack path comprises:

[0032] According to the vulnerability detailed information, node attack strategies corresponding to each of the target risk hosts are determined from a preset security knowledge base;

[0033] According to an attack order indicated by the target attack path, each of the node attack strategies is sequentially spliced to generate the target simulation attack scheme corresponding to the target attack path.

[0034] To achieve the above object, a second aspect of the embodiment of the present application proposes a network attack scheme recommendation device, the device comprising:

[0035] An acquisition module is configured to acquire vulnerability description information, service configuration information, and network configuration information of a target network;

[0036] A first processing module is configured to filter a plurality of hosts with vulnerabilities from the target network by combining the vulnerability description information, the service configuration information, and a preset derivation rule;

[0037] A second processing module is configured to filter a plurality of risk hosts from the plurality of hosts with vulnerabilities and obtain attack state transition information between the risk hosts by combining the service configuration information, the network configuration information, and the derivation rule;

[0038] A grouping module is configured to group the risk hosts according to the attack state transition information and form a group attack path between the risk groups according to the attack state transition information;

[0039] A target risk host determination module is configured to score each risk host in multiple dimensions to obtain a corresponding risk quantification value according to the vulnerability description information, and determine a plurality of target risk hosts according to the risk quantification value;

[0040] A target simulated attack scheme generation module is configured to form a target attack path based on the group attack path and the plurality of target risk hosts, and generate a target simulated attack scheme corresponding to the target attack path.

[0041] To achieve the above object, a third aspect of the embodiments of the present application provides an electronic device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the network attack scheme recommendation method of the first aspect when executing the computer program.

[0042] To achieve the above object, a fourth aspect of the embodiments of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the network attack scheme recommendation method of the first aspect.

[0043] The network attack scheme recommendation method, device, electronic equipment and storage medium provided by the embodiments of the present application obtain vulnerability description information, service configuration information and network configuration information of a target network; jointly use the vulnerability description information, service configuration information and a preset derivation rule to filter a plurality of hosts with vulnerabilities from the target network; use the content-reduced vulnerability description information, service configuration information and network configuration information to first determine the hosts with vulnerabilities, so as to further determine risk hosts based on a hazard propagation rule; then, jointly use the service configuration information, network configuration information and derivation rule to filter a plurality of risk hosts from the plurality of hosts with vulnerabilities, and obtain attack state transition information between the risk hosts; group the risk hosts according to the attack state transition information, and form a group attack path between each risk group according to the attack state transition information; grouping the plurality of risk hosts in the target network based on the attack state transition information can accelerate the speed of determining a target attack path; multi-dimensionally score each risk host according to the vulnerability description information to obtain a corresponding risk quantization value, and determine a plurality of target risk hosts according to the risk quantization value; form a target attack path based on the group attack path and the plurality of target risk hosts, and generate a target simulation attack scheme corresponding to the target attack path. Based on the group attack path and the risk quantization value, the user can quickly determine the target attack path from the large number of risk hosts in the target network, thereby improving the efficiency of the finally generated target simulation attack scheme. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 is an application scenario diagram of a network attack scheme recommendation device provided by the embodiments of the present application;

[0045] Figure 2 is an optional flowchart of a network attack scheme recommendation method provided by the embodiments of the present application;

[0046] Figure 3 is an optional visual scheme recommendation interface diagram of a network attack scheme recommendation method provided by the embodiments of the present application;

[0047] Figure 4 is an optional functional module diagram of a network attack scheme recommendation device provided by the embodiments of the present application;

[0048] Figure 5 is a hardware structure diagram of an electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0050] It should be noted that although the functional modules are divided in the device schematic diagram, the logical order is shown in the flowchart, but in some cases, the steps shown or described can be performed in a manner different from the module division in the device or the order in the flowchart. The terms "first", "second", and the like in the specification and claims and the above-described drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0051] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the specification herein is for the purpose of describing the embodiments of the present application only and is not intended to be limiting of the present application.

[0052] First, the terms involved in the present application are analyzed:

[0053] Cyber Range is a technology or product based on virtualization technology, which simulates and reproduces the running state and running environment of network architecture, system equipment and business processes in real network space, so as to more effectively realize learning, research, testing, competition, exercise and other behaviors related to network security, and improve the network security confrontation level of personnel and institutions.

[0054] Attack path refers to the logical sequence of all attack means used by an attacker when attacking a single asset, or refers to the path taken by a network attacker to penetrate a target network application system, in other words, the relevant measures and attack means taken by an attacker when attacking. There can be multiple attack paths, and target attack path refers to one or more paths determined by the system from multiple attack paths.

[0055] The attacker refers to an attacker participating in the network range, who tests and improves information security defense capabilities by simulating attack methods in the real world. It should be noted that the attacker of the network range is committed to simulating testing in a compliant and ethical manner, thereby enhancing the network security capabilities of the organization, and will not conduct malicious attacks in the actual network world.

[0056] The defender refers to the defender participating in the network range, who is responsible for protecting network systems, applications and data from potential attackers. The goal of the network range defender is to discover vulnerabilities, strengthen security policies, and improve the ability to resist real attacks, and to use these experimental opportunities to evaluate and improve the security architecture and emergency response plan of the organization.

[0057] A neural network model is a computational model based on artificial neurons (or nodes) connected to each other, which is used in the field of machine learning and artificial intelligence. The neural network model is composed of multiple layers of neurons connected to each other through weighted connections, forming a complex network structure. During the training process, the neural network model learns the complex relationships between input data by adjusting connection weights and parameters such as activation functions, and can make predictions or classifications on new data.

[0058] A natural language processing model is a model that analyzes, understands, generates, and processes natural language through computer algorithms and statistical learning methods. Natural Language Processing (NLP) is an important branch of artificial intelligence, which involves the understanding and generation of computer to human language.

[0059] To evaluate the security of the target network and prevent potential attacks, network security evaluation needs to be performed on the target network to discover security vulnerabilities and potential risks existing in the target network and provide suggestions for improving security. Among them, generating a network attack scheme is an important part of network security evaluation, which can help understand the security problems existing in the target network and guide the security repair work of the target network.

[0060] In related technologies, the network attack scheme is often determined based on the attack graph formed by the target network. However, as the size of the target network increases, the complexity of the attack graph also increases exponentially, which further reduces the generation efficiency of the network attack scheme.

[0061] Therefore, the embodiments of the present application provide a network attack scheme recommendation method and device, electronic equipment and storage medium, which can improve the generation efficiency of the network attack scheme.

[0062] It can be understood that in the specific embodiments of the present application, when obtaining the vulnerability description information, service configuration information and network configuration information of the target network, the permission or consent of the relevant object will be obtained first, and the collection, use and processing of the relevant data obtained will strictly comply with relevant laws, regulations and standards.

[0063] In addition, when obtaining the vulnerability description information, service configuration information and network configuration information of the target network, the separate permission or separate consent of the relevant object will be obtained through methods such as pop-up windows or jumping to confirmation pages, and after obtaining the explicit separate permission or separate consent, the necessary vulnerability description information, service configuration information and network configuration information for enabling the embodiments of the present disclosure to function normally will be obtained.

[0064] It should be noted that the embodiments of the present application will also first obtain the permission or consent of the relevant object when obtaining other data, and the collection, use and processing of these data also strictly comply with relevant laws, regulations and standards, which will not be described here.

[0065] The network attack scheme recommendation method, device, electronic equipment and storage medium provided by the embodiments of the present application are specifically described through the following embodiments. First, the application scenario of the network attack scheme recommendation device in the embodiments of the present application is described, as shown in the following figure. Figure 1 Figure 1 is the application scenario diagram of the network attack scheme recommendation device provided by the embodiments of the present application. The network attack scheme recommendation method provided by the embodiments of the present application can be applied to the network attack scheme recommendation device (for the convenience of description, hereinafter can also be referred to as "recommendation device"). In an application scenario, the target network A in a certain network target range includes host A, B, C, D and a server. First, the vulnerability description information, service configuration information and network configuration information of the target network A are obtained, and these information are input into the recommendation device in the embodiments of the present application. The recommendation device can quickly determine which host in the target network A has a risk vulnerability according to these information, determine the target risk host based on the host with the risk vulnerability, determine the target attack path according to the target risk host, and give the target simulation attack scheme. For example, the recommendation device determines that the host A, the host B and the server all have risk vulnerabilities, and the attacker is most likely to break into the host A first. Then, the host information A obtained from the host A is used to access the server, and the server information obtained from the server is used to break into the host B. Therefore, it can be determined that the target attack path is host A→server→host B, and the corresponding node attack and defense strategy is found from the preset security knowledge base according to the vulnerability detailed information of each node on the target attack path, and then the target simulation attack and defense scheme is formed.

[0066] It can be understood that the network target range improves the network security protection capability through the attack and defense drill of simulating the real network environment. Therefore, the target network where the attacker is located can quickly determine the target simulation attack and defense scheme through the recommendation device, so as to subsequently attack or test the security performance of each node of the target network. On the other hand, the target network where the defender is located can also quickly determine the target simulation attack and defense scheme through the recommendation device, so as to repair the target network according to the target simulation attack and defense scheme, and prevent the possible risks to enhance the security performance of the target network. That is, the recommendation device provided by the embodiments of the present application can improve the generation efficiency of the network attack scheme (target simulation attack and defense scheme), and then, for the attacker, the simulation attack accuracy and efficiency can be improved; for the defender, the target network can be repaired systematically, and the network security defense capability can be improved.

[0067] ​Then, the optimization scheduling method based on reinforcement learning in the embodiments of the present application is described in detail through the following embodiments.

[0068] In the embodiments of the present application, the network attack scheme recommendation device will be described from the dimension of the network attack scheme recommendation device, which can be integrated in a computer device, such as a server. Figure 2 Figure 2 is an optional flowchart of the network attack scheme recommendation method provided by the embodiments of the present application (for the convenience of description, the following can also be referred to as "recommendation method"), Figure 2 The method in the embodiments of the present application can include but is not limited to the following steps 101 to 105, wherein the recommendation device, when executing the recommendation method, has the following specific process, it needs to be first pointed out that the order of steps 101 to 105 in the embodiments is not specifically limited, the order of steps can be adjusted or some steps can be reduced, increased according to actual needs. Figure 2

[0069] Step 101, obtaining vulnerability description information, service configuration information and network configuration information of the target network.

[0070] The following describes step 101 in detail.

[0071] In some embodiments, in order to finally determine the target simulation attack scheme corresponding to the target network, it is necessary to first obtain the vulnerability description information, service configuration information and network configuration information corresponding to the target network. The target network can be an enterprise internal local area network (LAN) or wide area network (WAN), cloud infrastructure and service, mobile application backend server, Internet of Things device and related infrastructure, personal computer, home network or small office network, etc., which is not specifically limited in the embodiments of the present application.

[0072] Among them, the vulnerability description information can be obtained by scanning with a vulnerability scanning tool, and the vulnerability description information is used to represent a brief description of the vulnerabilities existing in the target network, for example, the vulnerability description information includes the vulnerability number corresponding to the vulnerability, so that the simple vulnerability description information helps the recommendation device to quickly determine the corresponding vulnerability exploitation rule in the subsequent.

[0073] Further, the common vulnerability number includes the following:

[0074] Common Vulnerabilities and Exposures (CVE), a vulnerability database maintained by MITRE Corporation, each vulnerability has a unique number, for example, CVE-2023-4634;

[0075] ​​China National Vulnerability Database (CNVD), a vulnerability database maintained by the China National Vulnerability Database, each vulnerability has a unique number, such as CNVD-2023-4634;

[0076] SUSE Security Advisories (SUSE), a security advisory published by SUSE, each vulnerability has a unique number, such as SUSE-SA:2023:4634.

[0077] Among them, the service configuration information can be obtained by the relevant personnel in advance, and the service configuration information can include but is not limited to the relevant software, services, protocols and ports of each host in the target network and other information, and the service configuration information indicates the software currently running in the target network and its related information.

[0078] Further, the service configuration information can also be obtained by the vulnerability scanning tool. Among them, the vulnerability scanning tool can be Nessus, Openvas or QualysGuard, or other software or devices that can scan the vulnerabilities of the target network, and the embodiments of the present application do not make specific limitations. Since the content recorded in the operation document has update delay, the service configuration information and network configuration information of the current target network can be obtained in real time through the network scanning tool, so as to more accurately determine the corresponding vulnerability exploitation rule and harm propagation rule according to the service configuration information and network configuration information, thereby improving the accuracy of the finally determined target simulation attack scheme.

[0079] Among them, the network configuration information is usually obtained by the relevant operation personnel in advance, and the network configuration information can include but is not limited to protocol address (IP address), subnet mask, gateway, virtual local area network configuration (VLAN configuration), router configuration and firewall rule, etc. The network configuration information indicates the related information of the host currently running in the target network, and the topology information between the hosts, for example, according to the IP address corresponding to each host, all hosts can be grouped to determine multiple subnets in the target network, and the attack state transition information between the hosts can be determined.

[0080] For example, the service configuration information and the network configuration information can be set by the relevant personnel in the operation document, and the service configuration information and the network configuration information corresponding to the target network can be obtained by reading the operation document.

[0081] Step 102, screening a plurality of hosts with vulnerabilities from the target network by combining the vulnerability description information, the service configuration information and the preset derivation rule.

[0082] The step 102 is described in detail as follows.

[0083] In some embodiments, the derivation rule includes a vulnerability exploitation rule and a hazard propagation rule. The vulnerability exploitation rule is used to match the obtained vulnerability description information and the service configuration information, so as to screen the hosts with vulnerabilities from the plurality of hosts in the target network.

[0084] For example, a certain vulnerability description information indicates that the vulnerability affects the Apache HTTP Server 2.4.41 version, and the target host needs to open the 80 port to be exploited. Meanwhile, the obtained service configuration information indicates that a certain host D in the target network opens the 80 port and runs the Apache HTTP Server 2.4.41 version. At this time, the host D can be determined to have the vulnerability by the vulnerability exploitation rule.

[0085] It can be understood that in the related art, a vulnerability scanning tool is used to perform a detailed scan on each host to determine which hosts have vulnerabilities, so as to determine the risk hosts afterwards. However, in a network target with a large number of hosts, such a way is often infeasible due to too low efficiency, that is, the efficiency of the target simulation attack scheme can be improved only by quickly determining the risk nodes. Based on this, the embodiments of the present application improve the determination efficiency of the risk hosts by using the content-reduced vulnerability description information, the service configuration information and the network configuration information obtained by scanning the target network. Further, when determining the risk hosts, the determination efficiency of the risk hosts can also be improved by using a sampling scanning method, for example, only one host in a group of hosts with the same configuration can be scanned. In addition, in addition to the vulnerability scanning tool, risk information can also be obtained from a vulnerability knowledge base according to the host configuration information (including but not limited to system software and hardware version, running service information) provided by the user. In this way, the final target simulation attack and defense scheme does not need to be determined based on the detailed information of all the hosts in the target network, and thus the efficiency of generating the final target simulation attack and defense scheme is improved.

[0086] In some embodiments, screening a plurality of hosts with vulnerabilities from the target network by combining the vulnerability description information, the service configuration information and the preset derivation rule includes the following steps 201 to 203.

[0087] Step 201, respectively analyzing the vulnerability description information and the service configuration information to obtain a plurality of vulnerability analysis information and a plurality of service analysis information, wherein the service analysis information includes program information used to indicate the currently running host.

[0088] Step 202, determining the vulnerability exploitation rule matched with the vulnerability analysis information and the service configuration information from the derivation rule, and determining the host indicated by the vulnerability exploitation rule as the host with vulnerability in the target network.

[0089] The steps 201 to 202 are described in detail below.

[0090] In some embodiments, the vulnerability description information and the service configuration information are used to jointly determine the corresponding vulnerability exploitation rule, so as to determine which hosts in the target network have vulnerabilities according to the vulnerability exploitation rule. In order to further extract more critical information from the vulnerability description information and the service configuration information, the vulnerability description information and the service configuration information need to be parsed, unnecessary parsing contents are removed, and the recommended device further understands the current risk vulnerability through the vulnerability analysis information obtained after parsing, and the recommended device further understands the software on the host currently running through the service configuration information obtained after parsing.

[0091] Further, in order to facilitate the recommended device to better understand the vulnerability analysis information and the service configuration information, they can be converted into a unified language, such as Data Query Language (Datalog), and the derivation rule is also expressed in Datalog language. In this way, the recommended device can better match the vulnerability description information, the service configuration information and the derivation rule, and the determination speed of the vulnerability exploitation rule is accelerated through the unified information recording mode, and the determination efficiency of the target simulation attack scheme is improved.

[0092] Further, since the service configuration information includes information of related software, services, protocols and ports of each host, the service configuration information obtained after parsing also includes corresponding key information such as related software, services, protocols and ports, or only the key information such as protocols and ports can be obtained according to the preset derivation rule. That is, the specific content of the service configuration information can be obtained by setting the content associated by the derivation rule, and the present application embodiment does not make specific limitation. Illustratively, the derivation rule in the present application embodiment includes the vulnerability exploitation rule, and since the vulnerability exploitation rule includes the vulnerability exploitation rule related to the port information, the service configuration information obtained after parsing in the present application embodiment includes the port information of the host currently running.

[0093] Further, the following is an example of a vulnerability exploitation rule logical expression,

[0094] execCode(Attacker, Host, Priv):

[0095] vulExists(Host, VulID, Program),

[0096] vulProperty (VulID, remoteExploit, privEscalation),

[0097] networkService (Host, Program, Protocol, Port, Priv),

[0098] netAccess (Attacker, Host, Protocol, Port),

[0099] malicious (Attacker)

[0100] Wherein, the execCode (Attacker, Host, Priv) indicates that the subject of the attacker (Attacker) can execute any code on the host Host with the permission Priv. The netAccess (Attacker, Host, Protocol, Port) indicates that the subject Attacker can send a packet to the port Port on the computer Host through the protocol Protocol. The above logical expressions can be set in detail according to the actual situation, for example, execCode1 (Attacker1, Host1, Priv1) and execCode2 (Attacker2, Host2, Priv2) are two different logical exploitation rules.

[0101] Further, the parsed plurality of vulnerability parsing information, service configuration information and plurality of vulnerability exploitation rules are matched to determine the corresponding vulnerability exploitation rule. In example 1, when the target network B is parsed, the vulnerability parsing information b and the service configuration information b are obtained, wherein the vulnerability parsing information b includes the vulnerability number (VulID1), the vulnerability name (Name1), the vulnerability influence (Priv1), the vulnerability description (“allowing unauthenticated remote attackers to execute malicious code”), the service configuration information b includes the service (remoteExploit1), the program (Program1), the port information (Port1), the protocol (Protocol1), and the access path (Path1), and further the vulExists1 (Host1, VulID1, Program1) in the vulnerability exploitation rule can be determined as the target vulnerability exploitation rule, and according to the target vulnerability exploitation rule, the host Host1 can be determined as the host with the vulnerability.

[0102] Alternatively, determine that vulnerability parsing information b and service configuration information b in Example 1 match networkService1(Host1, Program1, Protocol1, Port1, Priv1) in the vulnerability exploitation rule, thereby determining that host Host1 is the vulnerable host. When the vulnerability parsing information and service configuration information match one of the multiple vulnerability exploitation rules, the matched rule is determined to be the target vulnerability exploitation rule.

[0103] It is understandable that since the network target range involves multiple hosts, the amount of vulnerability resolution information and service configuration information obtained through analysis is usually quite large, while the content contained in the vulnerability resolution information and service configuration information obtained through analysis is relatively concise, that is, it highly summarizes the vulnerability situation in the network and the running software situation. Therefore, in a large-scale network environment, by comparing the vulnerability resolution information and service configuration information with the vulnerability exploitation rules, the host with the vulnerability can be quickly identified.

[0104] Step 103 : Combining the service configuration information, the network configuration information and the deduction rules, a plurality of risky hosts are screened from the plurality of hosts with vulnerabilities, and attack state transition information between the risky hosts is obtained.

[0105] Step 103 is described in detail below.

[0106] In some embodiments, a host with a vulnerability does not necessarily present a risk, but rather a host with a risk indicates that the vulnerability has a high probability of being exploited, thereby impacting the host and the system it is in. Therefore, in order to gain a deeper understanding of the potential risks and threats in the target network, embodiments of the present application not only need to determine which hosts have vulnerabilities, but also need to determine the risky hosts and the attack state transition information between the risky hosts based on the determination of the vulnerable hosts, so as to subsequently determine the target attack path formed by the target risky host from the risky hosts.

[0107] In some embodiments, combining service configuration information, network configuration information, and derivation rules to screen multiple risky hosts from multiple hosts with vulnerabilities and obtain attack state transition information between the risky hosts includes the following steps 301 to 303:

[0108] Step 301: parse network configuration information to obtain a plurality of network parsing information, wherein the network parsing information includes topology information for indicating the structure of a target network.

[0109] Step 302: Determine a hazard propagation rule that matches the service configuration information from the derivation rules, and determine that the host indicated by the hazard propagation rule is a risky host.

[0110] Step 303, determining the multi-hop network access rule matched with the network configuration information from the derivation rule, and determining the attack state transition information between the risk hosts according to the multi-hop network access rule.

[0111] The steps 301 to 303 are described in detail as follows.

[0112] In some embodiments, the service configuration information and the network configuration information are used to jointly determine the corresponding hazard propagation rule, so as to determine which hosts are risk hosts and the attack state transition information between the risk hosts according to the hazard propagation rule. In order to further extract more key information from the network configuration information, the network configuration information needs to be parsed, unnecessary parsing contents are removed, and the network parsing information obtained after parsing is used to make the recommendation device further understand the current network topology.

[0113] Further, in order to facilitate the recommendation device to better perform data processing, the network parsing information can also be converted into the Datalog language, so that the determination speed of the hazard propagation rule is accelerated through the unified information recording manner, and the determination efficiency of the target simulation attack scheme is improved.

[0114] Further, since the network configuration information can include but is not limited to IP address, subnet mask, gateway, VLAN configuration, router configuration, firewall rule and the like, the network parsing information obtained after parsing also includes the corresponding IP address, subnet mask, gateway, VLAN configuration, router configuration and firewall rule and the like, or only the IP address and the subnet mask and the like can be parsed according to the preset derivation rule, that is, the specific contents of the network parsing information can be set by the contents associated by the derivation rule, and the embodiments of the present application do not make specific limitations. Illustratively, the derivation rule in the embodiments of the present application includes a security diffusion rule, since the security diffusion rule contains the hazard propagation rule related to the topology information, the network parsing information obtained in the embodiments of the present application includes the topology information corresponding to the target network, for example, HostA-HostB is a topology information, indicating that there is a connection between HostA-HostB. It needs to be noted that the topology information indicates that there is a physical or logical connection relationship between the objects involved, but there is not necessarily an actual data flow relationship.

[0115] Further, the security diffusion rule includes a hazard propagation principle and a multi-hop network access rule, and the following is an example A of the logical expression of the hazard propagation principle,

[0116] accessFile(Attacker,Host,Access,Path):

[0117] execCode(Attacker, Host, Owner),

[0118] filePath(Attacker, Owner, Path)

[0119] Further, the following is an example B of a harm propagation principle logical expression,

[0120] execCode(Attacker, Host, Owner) :

[0121] accessFile(Attacker, Host, write, Path),

[0122] filePath(Host, Owner, Path),

[0123] malicious(Attacker)

[0124] where accessFile(Attacker, Host, Access, Path) means that the principal Attacker can access the computer Host using the privileges of Owner, and he can access any file owned by Owner; execCode(Attacker, Host, Owner) means that the principal Attacker can execute any code on the computer Host with the privileges of Owner. Similarly, the above logical expressions can be set in detail according to actual conditions, for example, accessFilel(Attackerl, Hostl, Accessl, Pathl) and accessFile2(Attacker2, Host2, Access2, Path2) are two different harm propagation principles.

[0125] Further, the following is an example of a multi-hop network access rule logical expression,

[0126] netAccess(Attacker, HostB, Protocol, Port) :

[0127] execCode(Attacker, HostA, Priv),

[0128] hacl(HostA, HostB, Protocol, Port)

[0129] Wherein, netAccess (Attacker, HostB, Protocol, Port) indicates that the subject Attacker accesses HostA with a certain privilege Priv, and when the target network allows HostA to access HostB through the protocol Protocol and the port Port, then the subject Attacker can access HostB through the protocol Protocol and the port Port, that is, after Attacker attacks HostA, it can obtain access rights and then attack HostB.

[0130] Further, the parsed plurality of vulnerability parsing information, network parsing information and plurality of vulnerability exploitation rules are matched to determine the corresponding hazard propagation rule. In example 2, after the target network B is parsed to obtain the vulnerability parsing information b, the network configuration information of the target network B is parsed to obtain the network parsing information b, wherein the vulnerability parsing information b contains the same content as example 1, and the network parsing information b includes Host1-Host2, Host1-Host3, indicating that Host1 and Host2, Host3 exist logical connection association. Based on this, the execCode1 (Attacker1, Host1, Owner1) and the filePath1 (Attacker1, Owner1, Path1) in the hazard propagation principle can be determined as the target hazard propagation rule, according to which it can be determined that Attacker1 can obtain Owner1 privilege on Host1 and then maliciously access the directory file under Owner1 privilege; then, the netAccess1 (Attacker1, Host2, Protocol1, Port1) in the multi-hop network access rule is determined to determine that the attacker can attack Host2 through the protocol Protocol1 and the port Port after attacking Host1. Therefore, it can be determined that Host1 and Host2 are both risk hosts, the attack state information of Host1 is to attack Host2, and the attack state information of Host2 is to be attacked by Host1.

[0131] Further, the hazard propagation principle can determine that the Owner1 privilege of the risk host has a management vulnerability, and the defender can review and strengthen the Owner1 privilege management in the target network; through the multi-hop network access rule, the direct or indirect attack state transfer information between the plurality of risk hosts can be determined.

[0132] Further, since the topology information only defines the logical connection relationship between the hosts, in a network target field containing a large number of hosts, if the association between the risk hosts is determined by analyzing each topology information one by one, a large amount of computing power is required, and the efficiency of determining the associated hosts is usually low. The embodiments of the present application determine the corresponding hazard propagation rule through the matching of the service configuration information and the network analysis information. Since the service configuration information and the network analysis information contain relatively simple content, the recommendation device can quickly determine the corresponding hazard propagation rule, and then use the hazard propagation rule and the topology information to quickly determine the attack state transition information between the risk hosts.

[0133] Further, in addition to the vulnerability exploitation rule, the hazard propagation principle and the multi-hop network access rule, a self-defined derivation rule can also be defined, so that the recommendation device can more quickly determine the risk hosts, the attack state transition information between the risk hosts or other functional content according to the self-defined derivation rule. The actual situation can be set, and the embodiments of the present application do not make specific limitations.

[0134] Step 104, grouping the risk hosts according to the attack state transition information, and forming the grouping attack path between the risk groups according to the attack state transition information.

[0135] The step 104 is described in detail below.

[0136] In some embodiments, after determining the attack state transition information corresponding to each risk host, it is usually necessary to group the risk hosts according to the attack state information, so as to then form the grouping attack path corresponding to each risk group according to the attack state transition information, so as to improve the generation efficiency of the target attack path.

[0137] It can be understood that for the attacker and the defender, both parties hope to find the shortest and most effective target attack path. Therefore, grouping a plurality of risk hosts in the target network based on the attack state transition information can speed up the speed of determining the target attack path, and then can speed up the efficiency of generating the target simulation attack scheme, so as to provide the target simulation attack scheme for the attacker or the defender to use.

[0138] In some embodiments, grouping the risk hosts according to the attack state transition information, and forming the grouping attack path between the risk groups according to the attack state transition information, includes the following steps 401 to 402:

[0139] Step 401, determining the entry associated host and the exit associated host corresponding to the risk host according to the attack state transition information, and determining the risk host whose entry associated host and exit associated host are the same as the same risk group.

[0140] Step 402, determining the antecedent attack group and the consequent attack group of any risk group according to the attack state information, and forming a corresponding group attack path based on the risk group and the corresponding antecedent attack group and consequent attack group.

[0141] The steps 401 to 402 are described in detail below.

[0142] In some embodiments, the ingress associated host table represents other risk hosts capable of attacking the risk host, and the egress associated host table represents other risk hosts capable of being attacked by the risk host, and each risk host is grouped according to the ingress associated host and the egress associated host corresponding to the risk host.

[0143] For example, the attack state information of the risk host A and the risk host B indicates that they can access the same protocol and port of the risk host C and the risk host D, and the risk host E and the risk host F can access the risk host A and the risk host B, and it is determined that the risk host E and the risk host F are the group a, the risk host C and the risk host D are the group b, and the risk host A and the risk host B are the group c.

[0144] Further, after grouping is completed, the antecedent attack group and the consequent attack group of each risk group are determined according to the attack state transition information between groups, and then the corresponding group attack path is determined. For example, in the above example, the group attack path is determined to be group a->group c->group b. Further, if the risk host A and the risk host B can also access the risk host G and the risk host H, the risk host G and the risk host H are determined to be the group d, and the group attack path can also include group a->group c->group d.

[0145] Step 105, multi-dimensionally scoring each risk host according to the vulnerability description information to obtain a corresponding risk quantization value, and determining a plurality of target risk hosts according to the risk quantization value.

[0146] The step 105 is described in detail below.

[0147] In some embodiments, the target risk host is used to indicate a node participating in forming a final target attack path, and the target risk host needs to be determined based on the risk quantization value corresponding to each risk host, and the risk quantization is used to indicate the expected damage degree of the corresponding risk host.

[0148] Further, it is determined which risk hosts are target risk hosts by comparing each risk quantization value with a preset first threshold value, wherein the first threshold value can be obtained by relevant personnel according to experience, or can be obtained by a neural network model based on historical data, and the first threshold value can be determined according to the number of target risk hosts in actual situation, and the embodiments of the present application do not make specific limitation.

[0149] Further, the grouping attack path between groups and the risk quantification value within each group can be calculated in parallel, so that the demand of the target network for determining the target attack path can be quickly responded, and the generation efficiency of the target simulation attack scheme is improved.

[0150] In some embodiments, the risk quantification value of each risk host is obtained by multi-dimensional scoring according to the vulnerability description information, including the following steps 501 to 503:

[0151] Step 501, based on the corresponding vulnerability description information of each risk host, the corresponding vulnerability detailed information is queried from the preset vulnerability knowledge base.

[0152] Step 502, score the vulnerability detailed information from the first dimension to obtain the vulnerability impact score, and score the vulnerability detailed information from the second dimension to obtain the vulnerability exploitation score.

[0153] Step 503, according to the preset first weight value and the second weight value, the vulnerability impact score and the vulnerability exploitation score are weighted and calculated respectively, and the calculated result is the risk quantification value of the risk host.

[0154] The steps 501 to 503 are described in detail as follows.

[0155] In some embodiments, the risk quantification value is used to represent the severity of the corresponding vulnerability existing in the corresponding risk host; the vulnerability detailed information is determined according to the vulnerability description information, the vulnerability description information is different from the vulnerability detailed information, the vulnerability description information is a more general description of the corresponding information of the vulnerability, while the vulnerability detailed information elaborates the specific information of the vulnerability. The purpose is to enable the recommendation device to quickly determine the vulnerability exploitation rule based on the vulnerability description information, and then determine the risk host in the target network through the vulnerability exploitation rule. Then, the risk level of the risk host is calculated by determining the vulnerability detailed information of the risk host, which avoids the waste of computing resources caused by using complex information to determine the risk host at the beginning, and improves the generation efficiency of the final target simulation attack scheme.

[0156] Exemplarily, the following is a vulnerability detailed information:

[0157] {Vulnerability name: Heartbleed

[0158] Vulnerability number: CVE-2014-0160

[0159] Vulnerability type: buffer overflow vulnerability

[0160] Affected scope: Open software library (OpenSSL) 1.0.1 to 1.0.1f version (excluding 1.0.1g and above versions)

[0161] Vulnerability description: Heartbleed vulnerability is derived from the implementation of the Heartbeat Extension of the Transport Layer Security Protocol (TLS) and / or Datagram Transport Layer Security Protocol (DTLS) in OpenSSL. Due to the incorrect verification of the payload length sent in the heartbeat request, an attacker can cause the server to return excess data by constructing a malicious heartbeat request, thereby leaking sensitive information in the server memory, such as private keys, user credentials, etc.

[0162] Potential impact: Attackers can exploit the Heartbleed vulnerability to obtain sensitive data in the server memory, which may lead to user privacy leakage and even system intrusion.

[0163] Further, the recommendation device can query the vulnerability detailed information corresponding to the vulnerability description information from the preset vulnerability knowledge base. The vulnerability knowledge base can be National Vulnerability Database (NVD), Common Vulnerabilities and Exposures (CVE), or Open Sourced Vulnerability Database (OSVDB), etc. The vulnerability knowledge base can be set according to actual needs, and the embodiments of the present application do not make specific limitations. And from the above examples of vulnerability detailed information, it can be found that the vulnerability detailed information is more comprehensive and richer than the content contained in the vulnerability description information. In this way, it is convenient to perform multi-dimensional risk assessment on the risk host according to the detailed vulnerability detailed information afterwards, and improve the evaluation credibility.

[0164] Further, the first dimension is used to indicate the impact of the vulnerability on the target network, such as the potential impact information in the vulnerability detailed information within the judgment range of the first dimension, and the second dimension is used to indicate the exploitability of the vulnerability, such as the vulnerability description information within the judgment range of the second dimension. It should be noted that the impact of the vulnerability and the exploitability are different, the impact degree focuses on the impact of the vulnerability on the target network after being broken, while the exploitability refers to the difficulty or possibility of the vulnerability being broken, and the vulnerability with high impact degree does not necessarily mean high exploitability.

[0165] Further, the natural language processing model built in the recommendation device can be used to extract and analyze the text of the vulnerability detailed information, and compare it with the preset high, medium and low thresholds, so as to determine the corresponding vulnerability impact score and vulnerability exploit score.

[0166] Further, the higher the vulnerability impact score, the greater the impact of the vulnerability on the target network, and the attacker can greatly reduce the overall security of the target network by breaking the vulnerability on the risk host; the higher the vulnerability exploit score, the easier the vulnerability is broken, and the attacker can easily break the vulnerability, but it does not necessarily reduce the security of the target network to a very large extent. Therefore, when determining the risk quantization value corresponding to the risk host, different degrees of emphasis can be given to the two. For example, when the attacker / defender pursues the attack / defense success rate, a higher weight can be assigned to the vulnerability exploit score, so that the attacker can gradually cause actual damage to the target network from easy to difficult, or the defender can repair the target network at the fastest speed, and improve the overall security performance of the target network.

[0167] It should be noted that the potential threat can also be used as a third dimension, and the corresponding score can be obtained by scoring the vulnerability details from the third dimension, or the vulnerability details can be scored from other multiple dimensions according to actual conditions, and the weight values of each dimension can also be set according to actual conditions, and the embodiments of the present application do not make specific restrictions.

[0168] Further, the risk quantization value can be calculated based on the weight values corresponding to different dimensions. The risk quantization value is a quantifiable numerical value obtained by evaluating and analyzing the risk host from multiple dimensions. The comprehensive risk situation of the risk host can be more intuitively observed through the risk quantization value, so as to more accurately determine the target risk host with the greatest threat to the target network according to the risk quantization value.

[0169] Further, the method used in the embodiments of the present application can help the attacker / defender to determine an effective attack / defense path from a large number of risk hosts of the target network based on the grouped attack path and the risk quantization value. For the attacker, the overall damage to the target network can be caused, and the attack effect is better. For the defender, the overall defense performance and response capability of the target network are improved.

[0170] Step 106, forming a target attack path based on the grouped attack path and the plurality of target risk hosts, and generating a target simulation attack scheme corresponding to the target attack path.

[0171] The step 106 is described in detail as follows.

[0172] Among them, the target attack path represents one or more attack paths with the greatest threat. The total risk value of the corresponding attack path can be calculated according to the risk quantization value corresponding to each target risk host, and the number of target attack paths expected to be generated is pre-set. According to the number, one or more attack paths with high total risk value are selected as the target attack path.

[0173] Further, since it is needed to generate the corresponding target simulation attack scheme according to the target risk host on the target attack path, taking the most threatening attack path as the target attack path can make the target simulation attack scheme generated subsequently more meaningful in terms of security attack / defense guidance, so as to recommend the device to concentrate resources to deal with the security vulnerabilities existing in the target network, thus, for the defense party, the most important network assets can be prioritized, and the potential risks and losses can be reduced.

[0174] In some embodiments, generating the target simulation attack scheme corresponding to the target attack path comprises the following steps 601 to 602:

[0175] Step 601, determining the node attack strategy corresponding to each target risk host from the preset security knowledge base according to the vulnerability detailed information.

[0176] Step 602, sequentially splicing each node attack strategy according to the attack order indicated by the target attack path, to generate the target simulation attack scheme corresponding to the target attack path.

[0177] The steps 601 to 602 are described in detail as follows.

[0178] The security knowledge base aims to provide corresponding measures for the target risk host according to the vulnerability detailed information. The measures contained in the security knowledge base usually include two aspects of attack and defense, and the attack party and the defense party can select according to the actual situation, for example, the attack party can only select the node attack and defense strategy providing attack measures, so as to perform simulation attack on the target network according to the target simulation attack scheme formed subsequently.

[0179] Further, the security knowledge base can be a public information security knowledge base (SANS), a self-maintenance security knowledge base (Vendor-specific), or a data security knowledge base (Center for Internet Security, CIS), or other security knowledge bases capable of providing corresponding attack / defense measures for vulnerabilities, and the embodiments of the present application do not make specific limitations thereon.

[0180] The node attack and defense strategy is an attack suggestion formulated for the vulnerability detailed information corresponding to the target risk host. The node attack and defense strategy can include but is not limited to the contents of authorized access strategy, data communication strategy, application update strategy, and log response strategy. Of course, the contents of the node attack and defense strategy included in the security knowledge base are usually more comprehensive, and the recommended device can select according to the actual situation, so as to more targetedly obtain the node attack and defense strategy corresponding to each target risk host.

[0181] Further, after determining the node attack-defense strategy corresponding to each target risk host, a target simulation attack scheme is formed according to the attack order corresponding to each target risk host in the target attack path. For example, a certain target attack path is target risk host D-target risk host E-target risk host F, wherein the target risk host D corresponds to the node attack-defense strategy D, the target risk host E corresponds to the node attack-defense strategy E, and the target risk host F corresponds to the node attack-defense strategy F. It can be determined that the target simulation attack scheme is the node attack-defense strategy D-node attack-defense strategy E-node attack-defense strategy F.

[0182] In some embodiments, after grouping the risk hosts according to the attack state transition information, the following steps 701 to 704 are further included:

[0183] Step 701, determining the host to be evaluated according to the attack node information input by the user.

[0184] Step 702, if the host to be evaluated is one of any risk group, determining that the host to be evaluated is a target risk host.

[0185] Step 703, determining other risk groups associated with the risk group in which the target risk host is located and the group attack path between the risk groups according to the attack state transition information.

[0186] Step 704, determining other target risk hosts in each of the other risk groups according to the risk quantification value, forming a target attack path based on the group attack path and all target risk hosts, and generating a target simulation attack scheme corresponding to the target attack path.

[0187] The steps 701 to 704 are described in detail below.

[0188] In some embodiments, in addition to determining one or more target attack paths with the greatest threat based on the overall security performance of the target network, the target attack path can also be determined according to the different attack / defense requirements of the user for each target risk node.

[0189] Further, the recommendation device can be provided with a visual scheme recommendation interface. After the recommendation device completes the determination of the target risk hosts in the target network, it can prompt the corresponding hosts to be target risk host nodes on the visual scheme recommendation interface, so that the user can select them. As shown in Figure 3 Figure 3 ​is an optional visual scheme recommendation interface schematic diagram of the network attack scheme recommendation method provided by the embodiment of the present application. The visual scheme recommendation interface displays a plurality of groups of the target network division and displays which hosts in each group are risk hosts. Further, the recommendation device receives target node information input by a user so as to determine a corresponding target attack path according to the target node information later. The target node information can be obtained by inputting in a touch screen mode.

[0190] Further, the target node information is used to represent a risk host which the user expects to attack / defend. For example, for Figure 3 , the group 1 and the group 2 respectively include different risk hosts. The target node information A input by the user can be the risk host a. It is determined that the host to be evaluated is the risk host a. Further, the recommendation device can have two different target attack path determination modes according to the input target node information. The first mode is to recommend an attack path containing the selected target risk node for the user according to the target node information. The attack path generated in this mode can be the shortest attack path or the attack path with the highest comprehensive risk quantization value. The specific selection can be made according to the actual demand of the user. For example, the target attack path determined according to the target node information A is the risk host a-risk host b-risk host f. The attack based on this target attack path can cause greater damage to the target network in the simulation attack. The second mode is to recommend an attack path containing only the selected target risk node for the user according to the target node information. For example, the target attack path determined according to the target node information A can be the risk host c-risk host a. In this way, the attacker can break through the expected host node at the fastest speed in the simulation attack.

[0191] Further, after the target simulation attack scheme is determined, the specific content of the target simulation attack scheme can be displayed on the visual scheme recommendation interface. For example, the target simulation attack scheme is split into a plurality of node attack and defense strategies and is displayed after each host to be evaluated / target risk host. Or, the target simulation attack scheme is displayed in the form of a complete scheme on the visual scheme recommendation interface so as to present the attack scheme to the user more intuitively.

[0192] As shown in Figure 4 , the network attack scheme recommendation device provided by the embodiment of the present application can include: Figure 4 The obtaining module 801 is used to obtain the vulnerability description information, the service configuration information and the network configuration information of the target network.

[0193]

[0194] ​The first processing module 802 is configured to filter a plurality of hosts with vulnerabilities from the target network by combining the vulnerability description information, the service configuration information, and a preset derivation rule.

[0195] The second processing module 803 is configured to filter a plurality of risk hosts from the plurality of hosts with vulnerabilities by combining the service configuration information, the network configuration information, and the derivation rule, and obtain attack state transition information between the risk hosts.

[0196] The grouping module 804 is configured to group the risk hosts according to the attack state transition information, and form a group attack path between the risk groups according to the attack state transition information.

[0197] The target risk host determination module 805 is configured to score each risk host in multiple dimensions according to the vulnerability description information to obtain a corresponding risk quantization value, and determine a plurality of target risk hosts according to the risk quantization value.

[0198] The target simulated attack scheme generation module 806 is configured to form a target attack path based on the group attack path and the plurality of target risk hosts, and generate a target simulated attack scheme corresponding to the target attack path.

[0199] The network attack scheme recommendation method, device, electronic equipment, and storage medium provided in the embodiments of the present application obtain vulnerability description information, service configuration information, and network configuration information of a target network; filter a plurality of hosts with vulnerabilities from the target network by combining the vulnerability description information, the service configuration information, and a preset derivation rule; determine the hosts with vulnerabilities by using the content-reduced vulnerability description information, the service configuration information, and the network configuration information, so as to further determine risk hosts based on a hazard propagation rule; then, filter a plurality of risk hosts from the plurality of hosts with vulnerabilities by combining the service configuration information, the network configuration information, and the derivation rule, and obtain attack state transition information between the risk hosts; group the risk hosts according to the attack state transition information, and form a group attack path between the risk groups according to the attack state transition information; group the plurality of risk hosts in the target network based on the attack state transition information, which can accelerate the speed of determining a target attack path; score each risk host in multiple dimensions according to the vulnerability description information to obtain a corresponding risk quantization value, and determine a plurality of target risk hosts according to the risk quantization value; form a target attack path based on the group attack path and the plurality of target risk hosts, and generate a target simulated attack scheme corresponding to the target attack path. Based on the group attack path and the risk quantization value, the user can quickly determine the target attack path from the plurality of risk hosts in the target network with a large number of hosts, thereby improving the efficiency of the finally generated target simulated attack scheme.

[0200] The specific implementation of the network attack scheme recommendation apparatus is basically the same as the specific embodiments of the network attack scheme recommendation method described above, and will not be repeated here.

[0201] The embodiments of the present application further provide an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor implements the network attack scheme recommendation method when executing the computer program. The electronic device can be any intelligent terminal, such as a tablet computer or a vehicle-mounted computer.

[0202] As shown in Figure 5 , Figure 5 is a hardware structure schematic diagram of an electronic device provided by the embodiments of the present application. The electronic device includes:

[0203] The processor 901 can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, and is used to execute related programs to implement the technical solutions provided by the embodiments of the present application.

[0204] The memory 902 can be implemented in the form of a ROM (Read Only Memory), a static storage device, a dynamic storage device, or a RAM (Random Access Memory). The memory 902 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present application are implemented by software or firmware, the related program codes are stored in the memory 902 and are called and executed by the processor 901 to implement the network attack scheme recommendation method of the embodiments of the present application.

[0205] The input / output interface 903 is used to realize information input and output.

[0206] The communication interface 904 is used to realize the communication interaction between the device and other devices. The communication can be realized by a wired manner (for example, a USB, a network cable, etc.) or a wireless manner (for example, a mobile network, WIFI, Bluetooth, etc.).

[0207] The bus 905 is used to transmit information between various components (for example, the processor 901, the memory 902, the input / output interface 903, and the communication interface 904) of the device.

[0208] The processor 901, the memory 902, the input / output interface 903, and the communication interface 904 are connected to each other through the bus 905 to realize the communication connection between them inside the device.

[0209] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the network attack scheme recommendation method.

[0210] The memory, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged relative to the processor, and the remote memory can be connected to the processor through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0211] The embodiments described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0212] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and can include more or fewer steps than those shown in the figures, or combine certain steps, or different steps.

[0213] The device embodiments described above are only schematic, and the units described as separate components can or can not be physically separate, that is, can be located in one place, or can be distributed on multiple network units. According to actual needs, part or all of the modules can be selected to achieve the purpose of the embodiments of the present application.

[0214] Those skilled in the art can understand that all or some steps in the above disclosed method, the functions of the modules / units in the system and the device can be implemented as software, firmware, hardware and their appropriate combinations.

[0215] The terms "first", "second", "third", "fourth", and the like in the description and in the claims of this application, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of the terms so termed is interchangeable under appropriate circumstances such that the embodiments of the application described herein are, for example, capable of orderly or chronological mundane operation, reverse order operation, based on circuitry availability, based on stated preference or the like, and that "default" or other orderings are thus permissible. Further, the terms "comprise", "comprising", "include", "including", and the like, are specifically intended to be open-ended. That is, references to individual steps and the like do not suhstantially exclude the presence of two or more of a given step or its integral presence in the process, method, system, article, or apparatus having been made with a wider scope. The use of notation such as "first", "second", "third", etc. does not generally limit the areas, but can be used for clarity, and merely establishes the order of the steps or placement of components. Moreover, singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise.

[0216] It should be understood that, in the application, "at least one" refers to one or more, and "multiple" refers to two or more. "And / or" is used to describe the relationship between associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that there are three cases: only A, only B, and A and B at the same time, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can mean a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0217] In several embodiments provided in the application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the above-described device embodiments are only illustrative, for example, the division of the above-mentioned units is only a logical functional division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed objects can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0218] The units described above as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0219] In addition, each of the functional units in the embodiments of the present application can be integrated in one processing unit, or each unit can exist alone physically, or two or more units can be integrated in one unit. The integrated unit can be implemented in the form of hardware, or in the form of a software functional unit.

[0220] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such an understanding, the technical solutions of the present application, essentially or partially, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes multiple instructions used to cause a computer device (such as a personal computer, a server, or a network device) to perform all or part of the steps of the methods in the embodiments of the present application. The foregoing storage medium includes: various memories (such as a read-only memory, a random access memory, a flash memory, or the like) and a magnetic disk or an optical disk and the like.

[0221] The preferred embodiments of the embodiments of the present application are described above with reference to the accompanying drawings, and are not intended to limit the scope of the embodiments of the present application. Any modification, equivalent replacement, and improvement made by those skilled in the art without departing from the scope and spirit of the embodiments of the present application shall fall within the scope of the embodiments of the present application.

Claims

1. A network attack plan recommendation method, characterized in that: The method comprises: Obtain vulnerability description information, service configuration information, and network configuration information of the target network; Combining the vulnerability description information, the service configuration information, and a preset derivation rule, screening a plurality of hosts with vulnerabilities from the target network; Combining the service configuration information, the network configuration information, and the derivation rule, screening a plurality of risky hosts from the plurality of hosts with vulnerabilities, and obtaining attack state transition information between the risky hosts; Grouping the risk hosts according to the attack state transfer information, and forming group attack paths between the risk groups according to the attack state transfer information; Performing a multi-dimensional scoring on each risk host according to the vulnerability description information to obtain a corresponding risk quantification value, and determining a plurality of target risk hosts according to the risk quantification value; A target attack path is formed based on the group attack path and the plurality of target risk hosts, and a target simulated attack plan corresponding to the target attack path is generated.

2. The method according to claim 1, characterized in that The combining of the vulnerability description information, the service configuration information and a preset derivation rule to screen and obtain a plurality of hosts with vulnerabilities from the target network includes: parsing the vulnerability description information and the service configuration information respectively to obtain a plurality of vulnerability parsing information and a plurality of service parsing information, wherein the service parsing information includes program information for indicating a currently running host; A vulnerability exploitation rule that matches both the vulnerability parsing information and the service configuration information is determined from the derivation rules, and the host indicated by the vulnerability exploitation rule is determined to be the host having a vulnerability in the target network.

3. The method according to claim 2, characterized in that The combining of the service configuration information, the network configuration information, and the derivation rule to screen out a plurality of risky hosts from the plurality of hosts having vulnerabilities, and obtaining attack state transition information between the risky hosts, includes: Parsing the network configuration information to obtain a plurality of network parsing information, wherein the network parsing information includes topology information indicating a structure of the target network; Determining a hazard propagation rule that matches the service configuration information from the derivation rules, and determining that the host indicated by the hazard propagation rule is a risky host; A multi-hop network access rule matching the network configuration information is determined from the derivation rule, and attack state transfer information between risky hosts is determined according to the multi-hop network access rule.

4. The method according to claim 1, wherein The step of grouping the risky hosts according to the attack state transfer information and forming group attack paths between the risky groups according to the attack state transfer information includes: Determine the incoming associated host and the outgoing associated host corresponding to the risk host according to the attack state transition information, and determine that the risk hosts having the same incoming associated host and the same outgoing associated host are in the same risk group; A preceding attack group and a subsequent attack group of any risk group are determined according to the attack state transfer information, and a corresponding group attack path is formed based on the risk group and the corresponding preceding attack group and subsequent attack group.

5. The method according to claim 1, wherein The multi-dimensional scoring of each risk host according to the vulnerability description information to obtain a corresponding risk quantification value includes: Based on the vulnerability description information corresponding to each risk host, query and obtain corresponding vulnerability detailed information from a preset vulnerability knowledge base; Scoring the vulnerability details from the first dimension to obtain a vulnerability impact score, and scoring the vulnerability details from the second dimension to obtain a vulnerability exploitation score; The vulnerability impact score and the vulnerability exploitation score are weightedly calculated according to a preset first weight value and a second weight value, and a result of the calculation is determined as a risk quantification value of the risk host.

6. The method according to claim 1, characterized in that After grouping the risky hosts according to the attack state transfer information, the method further includes: Determine the host to be evaluated based on the attack node information entered by the user; If the host to be evaluated is one of the risk groups, determining the host to be evaluated as a target risk host; Determining, based on the attack state transfer information, other risk groups associated with the risk group where the target risk host is located, and group attack paths between the risk groups; The other target risk hosts in each of the other risk groups are determined according to the risk quantification value, a target attack path is formed based on the group attack path and all the target risk hosts, and a target simulated attack plan corresponding to the target attack path is generated.

7. The method according to claim 5, characterized in that Generating a target simulated attack plan corresponding to the target attack path includes: Determine the node attack strategy corresponding to each target risk host from a preset security knowledge base based on the vulnerability details; According to the attack sequence indicated by the target attack path, the node attack strategies are sequentially spliced ​​together to generate a target simulation attack plan corresponding to the target attack path.

8. A network attack plan recommendation device, characterized in that: The device comprises: The acquisition module is used to obtain vulnerability description information, service configuration information and network configuration information of the target network; A first processing module is configured to combine the vulnerability description information, the service configuration information, and a preset derivation rule to screen and obtain a plurality of hosts with vulnerabilities from the target network; a second processing module, configured to combine the service configuration information, the network configuration information, and the derivation rule to screen out a plurality of risky hosts from the plurality of hosts with vulnerabilities, and obtain attack state transition information between the risky hosts; a grouping module, configured to group the risk hosts according to the attack state transfer information, and form group attack paths between the risk groups according to the attack state transfer information; a target risk host determination module, configured to perform a multi-dimensional scoring on each risk host according to the vulnerability description information to obtain a corresponding risk quantification value, and determine a plurality of target risk hosts according to the risk quantification value; The target simulated attack plan generating module is used to form a target attack path based on the group attack path and the multiple target risk hosts, and generate a target simulated attack plan corresponding to the target attack path.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the network attack plan recommendation method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the network attack scenario recommendation method according to any one of claims 1 to 7 is implemented.

Images