A method for automatically collecting attack chain data based on TTPs scripts
By using an automated method based on TTPs scripts to build and execute attack chain datasets, the problem of insufficient APT attack detection data is solved, enabling efficient and coherent attack chain simulation and generating more realistic attack chain data.
Patent Information
- Application Number
- CN202411201768.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-29
- Publication Date
- 2025-10-17
- Estimated Expiration
- 2044-08-29
AI Technical Summary
Existing APT attack detection methods lack sufficient data for model training, and existing attack chain simulation methods rely on manual operation, which is time-consuming, labor-intensive, prone to omissions and errors, and difficult to determine attack latency and the coherence of the attack chain.
An automated approach based on TTPs scripts is used to construct an attack chain dataset. Known TTPs attack steps are obtained, sorted chronologically, matched with a technical and tactical execution script library, missing steps are added, script parameters and delay times are set, the final attack chain script is generated, and the collected data is executed in an isolated environment.
It provides a standard reference, generates a more coherent attack chain, simulates attack behavior more closely resembles the real world, improves the efficiency and accuracy of data collection, and supports subsequent research.
Smart Images
Figure CN119094198B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network security, and in particular to a method for automatically constructing an attack chain by using TTPs (Tactics, Techniques and Procedures) scripts and generating data by running the attack chain. BACKGROUND
[0002] APT attack (Advanced Persistent Threat) refers to a sustained and effective attack activity targeting specific targets. This attack activity has strong concealment and targeting, and attackers usually use various means such as infected media, supply chain and social engineering to implement advanced, persistent and effective threats and attacks.
[0003] In order to better analyze and understand this complex attack behavior, the industry has introduced the ATT&CK model of APT. This model further constructs a tactics and techniques matrix by finding common points in attack behavior, providing a reference for more detailed attack behavior analysis. The ATT&CK model covers the techniques and tactics matrix of enterprises, mobile phones and ICS (Industrial Control Systems), which contains 14 tactical stages, covers 202 techniques, 435 sub-techniques and various implementation references. These tactics, techniques and procedures simulate different stages and ways of attack behavior, which helps to determine and analyze attack behavior.
[0004] However, in the current APT attack detection, although the ATT&CK model provides a reference for APT attack behavior, the data-driven detection method still faces some challenges. One of them is the lack of sufficient data for model training. Due to the concealment and targeting of APT attacks, attack capture becomes difficult, resulting in limited amount of data available for model training. In addition, due to the single type of attack or the absence of attack behavior, the generalization ability of the model is also limited. SUMMARY
[0005] The purpose of the present application is to provide an attack chain data automatic generation collection method based on TTPs scripts, which adopts an automatic execution mode to obtain attack chain execution data, and forms data that can be used for scientific research and development function simulation verification.
[0006] To achieve the above purpose, the technical solution adopted by the present application is:
[0007] An attack chain data automatic generation collection method based on TTPs scripts, the attack chain data automatic generation collection method based on TTPs scripts comprises:
[0008] 1) TTP attack process construction: obtain known TTP attack steps, time sequence order the TTP attack steps belonging to the same attack behavior, and obtain the TTP array corresponding to the attack behavior;
[0009] 2) Attack chain script generation: match each TTP attack step in the TTP array with a known technique and tactics execution script library, extract the TTP script matched successfully in the technique and tactics execution script library for the TTP attack step matched successfully, and generate a TTP script according to a preset supplementary measure for the TTP attack step not matched successfully, to obtain a primary attack chain script;
[0010] 3) Attack chain script improvement: set script parameters and establish dependency relationships for each TTP script in the primary attack chain script according to the IOC library, and randomly generate a delay time for each TTP script within a preset reasonable delay range, to obtain a final attack chain script;
[0011] 4) Data collection: input the final attack chain script into an isolated environment for execution, and collect data in the entire execution process as a final automatically generated real attack chain data set.
[0012] Several optional modes are also provided, but not as additional limitations to the above overall scheme, but only as further supplements or preferences. Without technical or logical contradictions, each optional mode can be combined with the above overall scheme, and multiple optional modes can also be combined.
[0013] As a preference, the TTP attack process construction further includes:
[0014] Supplement TTP attack steps between TTP attack steps that are not consecutive in time sequence order according to actual attack cases.
[0015] As a preference, the TTP attack process construction further includes:
[0016] Check the TTP array corresponding to each attack behavior, and delete duplicate and redundant TTP attack steps in the TTP array.
[0017] As a preference, the supplementary measures include automatic replacement, script design, and deletion marking.
[0018] The automatic replacement comprises: for the TTPs attack step that fails to match successfully, all technologies under the tactics to which the TTPs attack step belongs are found according to the TTPs attack step, a technology located in the skill and tactics execution script library is selected from all the technologies to replace the original technology, and the corresponding TTPs script of the replaced technology in the skill and tactics execution script library is extracted; and if there is no replaced technology, the TTPs attack step is added to the artificial design queue.
[0019] The script design comprises: reading the TTPs attack step from the artificial design queue, and generating the TTPs script according to the expert experience.
[0020] The deletion mark comprises: setting a deletion mark for the TTPs attack step in the artificial design queue that cannot generate the TTPs script through the script design.
[0021] Preferably, the setting of the script parameters and the establishment of the dependency relationship for each TTPs script in the primary attack chain script according to the IOC library comprise:
[0022] The script parameters are set for the TTPs script in combination with the sensitive domain name and the sensitive file stored in the IOC library.
[0023] The operation object in the script parameter is unified according to the script parameters of the front and rear TTPs scripts, and the establishment of the dependency association between the TTPs scripts is completed.
[0024] Preferably, the running time of the TTPs script is the sum of the actual execution time and the delay time, and the running time of the attack chain script is the sum of the running times of all the TTPs scripts.
[0025] There is no perfect attack chain dataset and collection method at present, and the existing attack chain simulation method depends on manual operation, which is time-consuming and laborious, and is also easy to miss errors. The existing automatic attack chain generation method has certain limitations, and it is difficult to determine the attack delay and the continuity of the attack chain. Therefore, the present application provides an attack chain data automatic generation and collection method based on TTPs script, collects existing attack information to form attack steps, matches a script library based on the attack steps to obtain a primary attack script of a single executable script combination, and perfects the association of the executable script in combination with an IOC (Indicators of Compromise) library to obtain a complete attack chain script. The present application has the following beneficial effects:
[0026] (1) The running time of a single TTPs script is recorded, the single script running time interval is summarized, the existing range interval of the attack data is provided, and a standard reference basis is provided for application.
[0027] (2) Using the intrusion indicator IOC to associate the scripts contained in the attack chain, so that the generated attack chain is more coherent, and it is also convenient for subsequent research work.
[0028] (3) Introducing delay and condition judgment mechanism, so that the attack chain simulation is more in line with the real world attack behavior, prompting the authenticity of the simulation attack. BRIEF DESCRIPTION OF DRAWINGS
[0029] Figure 1 A flowchart of the attack chain data automatic generation method based on TTPs scripts of the present application is shown in the figure.
[0030] Figure 2 A content example diagram after the timing relationship of the attack activity is constructed.
[0031] Figure 3 A matching example diagram of TTPs attack steps and technical execution script library.
[0032] Figure 4 An example diagram of the attack activity supplementing the TTPs attack steps that are not matched successfully.
[0033] Figure 5 An example diagram of the attack chain script based on the IOC library to associate multiple TTPs scripts inside it. DETAILED DESCRIPTION
[0034] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.
[0035] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used in the specification of the present application are only for the purpose of describing the specific embodiments and are not intended to limit the present application.
[0036] In order to overcome the defects of the prior art, the present embodiment provides an automatic attack chain data generation method based on TTPs scripts, as shown in Figure 1 The method comprises the following steps:
[0037] (1) TTPs attack process construction: known TTPs attack steps are crawled from public channels such as network, threat intelligence, and TTPs attack steps are supplemented according to actual attack cases.
[0038] (1-1) Acquiring known TTPs: Collect information about known attack chains from publicly available information security knowledge bases and datasets (e.g., MITRE ATT&CK) such as cybersecurity and threat intelligence. Search for various attack activities, such as phishing and website attacks, to obtain detailed TTPs descriptions for each attack behavior, also known as the TTPs attack steps.
[0039] Because an attack behavior consists of multiple tactical phases, and one or more techniques in a tactical phase are selected to achieve tactical goals, when recording and describing the TTPs of an attack behavior, not only the TTP number (technique number) and TTP execution description used are recorded, but also the tactical phase and technology category to which the TTP belongs. Taking the C0011 attack activity published by ATT&CK as an example, this attack has multiple operations and involves multiple tactical phases. The following core information can be recorded, as shown in Table 1.
[0040] Table 1 C0011 attack activities
[0041] Domain Technical Number Technical Name Tactical Phase TTP Execution Description Enterprise T1583.001 Acquisition Infrastructure: Domain Resource Development The registered domain name may be related to the student target in India Enterprise T1059.005 Command and Script Interpreter: Visual Basic Execution A malicious VBA macro was used in a lure document as part of the process to install the Crimson malware onto the infected host. Enterprise T1587.003 Development Capability: Digital Certificate Resource Development An SSL certificate was established on a misspelled domain registered by the organization. Enterprise T1566.002 Phishing: Phishing Link Initial Access An email was sent containing a malicious link directed at the student target in India. Enterprise T1608.001 Phase Function: Upload Malware Resource Development A malicious document was hosted on a domain registered by the organization. Enterprise T1204.001 User Execution: Malicious Link Execution The student target relied on clicking a malicious link sent via email.
[0042] (1-2) Establishing the TTPs timing relationship: For each TTP execution description attack step obtained in step (1-1), organize them (including additions, deletions, and arbitrary adjustments) based on the TTP execution description in Table 1 and the dependency relationship of the reference TTPs for tactical execution in the ATT&CK model, and standardize them into a TTPs array in a time sequence to supplement the attack step description in (1-1).
[0043] like Figure 2 As shown, for the attack description of C0011 in step (1-1), combined with the tactical phases (e.g., resource development, which precedes the initial access phase), the following TTPs array [T1583.001, T1587.003, T1608.001, T1566.002, T1204.001, T1059.005] can be established to supplement the attack step description in (1-1). In practice, the TTPs array only transmits the technique number. Because the technique number uniquely corresponds to other information, the array can contain only the technique number. In other embodiments, other information corresponding to the technique number can also be added to the TTPs array as needed.
[0044] (1-3) Attack behavior supplement: In order to improve the coherence of the attack chain, this embodiment also supports supplementing TTPs attack steps between incoherent TTPs attack steps according to actual attack event cases and expert experience judgment, such as adding the attack technology of database intrusion in the TTPs attack step in combination with the database intrusion case, and recording in the description manner of formalizing the attack activity in step (1-1).
[0045] (1-4) Attack behavior check: Check the TTPs array of each attack behavior, delete repeated and redundant steps, and obtain the attack activity database based on TTPs, that is, the attack step description set.
[0046] (2) Attack chain script generation: Sort the collected various TTPs attack steps, match the existing technique and tactics execution script library to realize context binding, and construct a primary attack chain script according to the executable TTPs script.
[0047] (2-1) Match TTPs script: Based on the attack activity database obtained in (1), the TTPs attack steps involved in the attack behavior are matched, the related TTPs attack steps implemented in the existing technique and tactics attack behavior script library are selected, the TTPs scripts corresponding to the TTPs attack steps matched successfully in the technique and tactics attack behavior script library are extracted and the preconditions of the TTPs scripts are set, and a primary attack chain script is obtained.
[0048] As shown in Figure 3 , taking attack behavior C0011 as an example, each TTPs attack step in the TTPs array in the attack step description of attack behavior C0011 is matched with the implemented TTPs script in the technique and tactics execution script library, it can be found that there are two TTPs scripts of T1059.005 and T1608.001 technologies, and then the execution command, parameter and other information of the TTPs script are filled into the attack chain script.
[0049] When matching, the technology number in the TTPs array is matched with the technology number in the technique and tactics execution script library. If the technology number in the TTPs array exists in the technique and tactics execution script library, the matching is successful, the TTPs script corresponding to the matched technology number in the technique and tactics execution script library is extracted into the corresponding TTPs attack step in the TTPs array, and then the attack chain is formed according to the time sequence order of the TTPs array.
[0050] The running of the TTPs script depends on the environment, the precondition is the pre-step required for script running, the extraction of the precondition is related to the setting of the technique and tactics execution script library, and the script can be extracted and its precondition setting script can be filled according to the technique and tactics execution script library.
[0051] (2-2) Supplementing unmatched scripts: For the unmatched TTPs attack steps, three measures are adopted to supplement the unmatched scripts, namely automatic replacement, script design and deletion mark.
[0052] Automatic replacement: Based on the description of the TTPs attack steps in step (1), search for replaceable sub-techniques for the techniques of the tactics to which the unmatched TTPs attack steps belong, select other scripts of the technique in the technique and tactic execution script library to replace the required TTPs script, replace the technique number in the TTPs array at the same time, and update the primary attack chain script; if there is a TTPs attack step that cannot be replaced, add the TTPs attack step to the manual design queue.
[0053] Script design: The missing TTPs attack steps that have not been successfully replaced are obtained from the manually designed queue. Security personnel design TTPs scripts based on the description of the missing TTPs scripts and their experience and update the primary attack chain script.
[0054] Deletion mark: If the TTPs script cannot be designed due to some reasons (such as environment, equipment, expert experience, etc.), a deletion mark is set.
[0055] like Figure 4 As shown in the figure, for the technologies that attack behavior C0011 fails to match (T1583.001, T158.003, T1608.001, T1204.001), taking T1566.002 as an example, the automatic replacement operation is first used. It is found that the tactical phase (initial access) of the phishing technology T1566 to which the sub-technology T1566.002 belongs has four replaceable sub-techniques. Among them, although the phishing link T1566.002 is not implemented in the script library, the phishing attachment T1566.001 has been implemented. In this way, the link method can be replaced, that is, the T1566.001 technology is used to replace the T1566.002 technology; similarly, T1204.001 is also replaced with T1204.002 based on this. At this point, the TTPs script sequence of C0011 is updated to [T1583.001, T1587.003, T1608.001, T1566.001, T1204.002, T1059.005].
[0056] Take T1583.001 as an example, if there is no technology implementation of T1583 (technology acquisition infrastructure) under the tactical phase (resource development) to which it belongs in the technical and tactical script library, it will be added to the artificial design queue and enter the script design stage. The security personnel will design the technology implementation of T1583.001, supplement it to the technical and tactical execution script library, and supplement the TTPs script of T1583.001 technology in the C0011 attack chain script.
[0057] (2-3) Attack chain script construction: scan and delete TTPs attack steps with deletion marks in the TTPs array, construct a primary attack chain script that can execute individual TTPs, and annotate the script.
[0058] (3) Attack chain script completion: consider the existence of delay in real attacks, and associate different step scripts that need to use the same acting entity. Through analysis of the entity, i.e., the IOC library, further associate each TTPs script in the attack chain to form a more complete attack chain script.
[0059] (3-1) TTPs script association: for the TTPs scripts in the primary attack chain script formed in step (2-3), combine the IOC library and the script parameters of TTPs, associate the dependency relationship between scripts based on the IOC library, and optimize the association by modifying the script parameters of TTPs.
[0060] As shown in Figure 5 , it is the attack chain script corresponding to attack behavior C0011 after step (2). The description in the figure is the Chinese description of the script, where {xx} is the script parameter. Set the script parameter in combination with the sensitive domain name and sensitive file stored in the IOC library, such as T1583.001 and T1587.003 in the figure, which act on {URL domain name}; and associate the execution script, mainly for the unification of the operation object (i.e., the parameter in the TTPs script, such as local address and remote address after the scp instruction). Specifically, according to the script parameters of the front and rear TTPs scripts, unify the operation object in the script parameter, complete the establishment of the dependency association between TTPs scripts, such as the script parameter of T1608.001 in the figure being {malicious file}, while the original script parameter of T1566.001 being {malicious link}. Through the association of the front and rear TTPs scripts, the original script parameter of T1566.001 is unified as {malicious file}. After setting, the scripts jointly act on the domain name and produce a connection in the execution process of the behavior.
[0061] (3-2) Setting running time of each TTPs script: according to the primary attack chain script obtained in step (2), for each TTPs script, considering the maximum and minimum delay (i.e. the preset reasonable range of delay), a random delay time is set for it; the running time of the TTPs script is the sum of the actual execution time and the delay time.
[0062] (3-3) Setting running time of each attack chain script: the running time of the attack chain script is the sum of the running times of all TTPs scripts contained therein.
[0063] (3-4) Attack chain script optimization: the attack chain script can be further optimized according to needs, according to the experience of network security personnel, adding logical code such as condition judgment and error handling in the script running process, finally forming a final attack chain script which is more efficient and closer to real attack behavior; this step is operated by network security personnel according to business needs.
[0064] (4) Data collection: the optimized attack chain script is executed in an isolated environment, and detailed data in the entire attack process is automatically collected as the final automatically generated real attack chain dataset.
[0065] (4-1) Environment construction: an isolated and monitored environment, i.e. a virtual target machine, is constructed, and a data monitoring and collection component is deployed on the target machine to monitor the execution activities.
[0066] (4-2) Attack chain script execution: the final attack chain script obtained in step (3) is uploaded to the control end, triggering the control end to automatically execute the attack chain script, and the system monitoring and collection component collects the system events of the target machine during the script execution in real time.
[0067] (4-3) Repeat (4-2) multiple times to constantly enrich and perfect the final attack chain dataset.
[0068] In another embodiment, the present application also provides a TTPs script-based attack chain data automatic generation and collection device, comprising a processor and a memory storing a plurality of computer instructions, which are executed by the processor to realize the steps of the TTPs script-based attack chain data automatic generation and collection method.
[0069] The specific limitations of the TTPs script-based attack chain data automatic generation and collection device can be referred to the limitations of the TTPs script-based attack chain data automatic generation and collection method in the foregoing, which will not be repeated here.
[0070] The memory and the processor are electrically connected directly or indirectly to realize the transmission or interaction of data. For example, the elements can be electrically connected through one or more communication buses or signal lines. The memory stores a computer program executable on the processor. The processor realizes the method of the present application by running the computer program stored in the memory.
[0071] The memory can be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The memory is used to store a program. The processor executes the program after receiving an execution instruction.
[0072] The processor can be an integrated circuit chip with data processing capability. The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. The processor can realize or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.
[0073] The technical features of the above-described embodiments can be combined arbitrarily. To make the description concise, all possible combinations of the technical features in the above-described embodiments are not described, but it should be considered that any combination of the technical features is within the scope of the present application, as long as the combination does not cause contradiction.
[0074] The above-described embodiments only express several embodiments of the present application. The description is more specific and detailed, but it should not be understood as a limitation on the scope of the application. It should be noted that for ordinary skilled in the art, without departing from the concept of the present application, a number of variations and improvements can be made, which are within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.
Claims
1. A method for automatically generating and collecting attack chain data based on TTPs scripts, characterized in that: The method for automatically generating and collecting attack chain data based on TTPs scripts includes: TTPs attack process construction: obtain known TTPs attack steps, sort the TTPs attack steps belonging to the same attack behavior in chronological order, and obtain the TTPs array of the corresponding attack behavior; Attack chain script generation: Each TTPs attack step in the TTPs array is matched with a known technical and tactical execution script library. For successfully matched TTPs attack steps, the matched TTPs script in the technical and tactical execution script library is extracted. For unmatched TTPs attack steps, TTPs scripts are marked or generated according to preset supplementary measures to obtain a primary attack chain script. The supplementary measures include automatic replacement, script design, and deletion mark. Attack chain script improvement: Script parameters are set for each TTPs script in the primary attack chain script based on the IOC library and dependencies are established. A delay time is randomly generated for each TTPs script within a preset reasonable delay range to obtain the final attack chain script. Setting script parameters and establishing dependencies for each TTPs script in the primary attack chain script based on the IOC library includes: setting script parameters for the TTPs script based on sensitive domain names and sensitive files stored in the IOC library; unifying the operation objects in the script parameters based on the script parameters of the previous and subsequent TTPs scripts to complete the establishment of dependency associations between the TTPs scripts. Data collection: The final attack chain script is input into the isolated environment for execution, and the data from the entire execution process is collected as the final automatically generated real attack chain dataset.
2. The method for automatically generating and collecting attack chain data based on TTPs scripts according to claim 1 is characterized in that: The TTPs attack process construction also includes: According to actual attack cases, TTPs attack steps are supplemented between the incoherent TTPs attack steps in the temporal sequence.
3. The method for automatically generating and collecting attack chain data based on TTPs scripts according to claim 1 is characterized in that: The TTPs attack process construction also includes: Check the TTPs array corresponding to each attack behavior and delete repeated and redundant TTPs attack steps in the TTPs array.
4. The method for automatically generating and collecting attack chain data based on TTPs scripts according to claim 1 is characterized in that: Said supplementary measures include automated replacement, scripting, and removal of tags; The automatic replacement includes: for a TTPs attack step that fails to match successfully, searching for all techniques under the tactic to which it belongs according to the TTPs attack step, selecting a technique in the technique and tactic execution script library from among all the techniques to replace the original technique, and extracting the TTPs script corresponding to the replaced technique in the technique and tactic execution script library; if no replacement technique exists, adding the TTPs attack step to the manually designed queue; The script design includes: reading TTPs attack steps from the artificially designed queue and generating a TTPs script based on expert experience; The deletion mark includes setting a deletion mark for a TTPs attack step in a manually designed queue that cannot generate a TTPs script through script design.
5. The method for automatically generating and collecting attack chain data based on TTPs scripts according to claim 1 is characterized in that: The running time of the TTPs script is the sum of the actual execution time and the delay time, and the running time of the attack chain script is the sum of the running times of all the included TTPs scripts.