Network space key terrain identification method

Abstract

The invention relates to a cyberspace key terrain recognition method, and belongs to the technical field of cyberspace surveying and mapping. The method comprises the following steps: constructing a network space key terrain analytic hierarchy model and a network attack task analytic hierarchy model based on a fuzzy analytic hierarchy process; determining the weight of a network attack task according to the network attack task analytic hierarchy model, and determining a weighted value matrix according to the network space key terrain analytic hierarchy model; and calculating the obtained weighted value matrix through an ideal solution sorting method to obtain the closest value of each node in the network space, sorting the closest value, multiplying the weight of the network attack task by the closeness of each network node, and determining the closeness of each network node under different attack tasks so as to identify the key terrain of the network space. According to the method, the influence of the network attack is considered, and the key node is determined through the weight of the network attack task, so that the network attack task is closely connected with the key terrain of the network space, and the recognition precision is improved.

Description

Technical Field

[0001] The invention relates to a method for identifying key terrain in cyberspace, and belongs to the technical field of cyberspace surveying and mapping. Background Art

[0002] As the fifth dimension of human activities, cyberspace breaks the time and space boundaries of traditional space and builds a new field for human activities. However, the general vulnerability of cyberspace also brings increasingly serious security risks to enterprises and countries.

[0003] As a new theoretical and technical field derived from the intersection of surveying and mapping and network, cyberspace surveying and mapping is of great significance in ensuring national network security. Cyberspace surveying and mapping is an effective means to detect cyberspace resources and conduct cyberspace big data mining and application. How to describe the structure and hierarchical information of cyberspace, identify and locate the weak links of cyberspace, and improve cyberspace situational awareness and defense capabilities have become important research contents in the field of cyberspace surveying and mapping.

[0004] Since William Gibson proposed the term cyberspace, it has been widely used by scholars to express various scenarios related to computer technology and network globalization. Cyberspace is divided into broad cyberspace and narrow cyberspace. The narrow cyberspace simply refers to the Internet space that humans can access with the help of computers or mobile devices; the broad cyberspace includes networks of various information technology infrastructures, virtual environments, and the influence between people. The concept of terrain originated from the field of geography and refers to the general term for various undulating forms on the surface of the earth. When studying cyberspace, scholars introduced the concept of "terrain" into cyberspace to describe the hierarchical structure of cyberspace. David Raymond defines cyberspace terrain as systems, devices, protocols, data, software, processes, network roles, and other network entities that constitute, supervise, and control cyberspace. He divides cyberspace terrain into regulatory layer, network role layer, logical layer, physical layer, and geographical layer, and believes that cyberspace terrain is not always directly connected to physical location. Jakobson defines cyber terrain as network assets and services and their internal and interdependent multi-level information structure, including hardware, software, and service sub-terrain. The network terrain defined by Jakobson belongs to the physical layer and logical layer in the broad network space, which can also be called the asset layer network space.

[0005] The classic definition of critical terrain is "any location or area where the capture or retention of combatants on either side has a significant advantage". Similar to geospatial high ground, cyberspace critical terrain is used to describe network connections and nodes in cyberspace that are critical to both friendly and enemy forces. These nodes are usually perceived in the form of network IPs. Cyberspace critical terrain has important strategic significance. For the attacker, cyberspace critical terrain is essential intelligence information for formulating cyber attack plans; for the defender, cyberspace critical terrain is key information to improve cyberspace situational awareness and reduce cyberspace threat risks.

[0006] At present, the key terrain identification methods in cyberspace not only ignore the correlation between multiple attributes of each node when quantitatively describing the differences between network nodes in cyberspace, but also fail to pay attention to the impact of network attack tasks on the key terrain of cyberspace, resulting in inaccurate identification of key terrain in cyberspace, which in turn affects subsequent network security processing. Summary of the invention

[0007] The purpose of the present invention is to provide a method for identifying key terrain in cyberspace to solve the problem that current identification methods ignore the correlation between multiple attributes of nodes and network attack tasks, resulting in low identification accuracy.

[0008] In order to solve the above technical problems, the present invention provides a method for identifying key terrain in cyberspace, and the identification method comprises the following steps:

[0009] 1) Obtaining attribute information of each network node in the cyberspace, wherein the attribute information includes characteristic attributes of the physical layer cyberspace terrain and network information security attributes;

[0010] 2) Based on the obtained physical layer network information security attributes, a network attack task hierarchical analysis model is constructed using the fuzzy hierarchical analysis method, and the network attack task weight is determined based on this; the constructed network attack task hierarchical analysis model includes a target layer, a criterion layer, and an alternative solution layer, wherein the target layer is used to describe the key terrain of cyberspace, the criterion layer is used to describe the network information security attributes of information transmission, and the alternative solution layer is a network attack task determined based on various tactics in the ATT&CK framework;

[0011] 3) According to the characteristic attributes of the obtained physical layer cyberspace terrain, a hierarchical analysis model of cyberspace key terrain is constructed using the fuzzy hierarchical analysis method to determine the corresponding weighted value matrix; the constructed hierarchical analysis model of cyberspace key terrain includes a target layer, a criterion layer and an alternative solution layer, wherein the target layer is used to describe the key terrain of cyberspace, the criterion layer is used to describe the characteristic attributes of the asset layer cyberspace terrain, and the alternative solution layer is used to describe the connection nodes in the cyberspace;

[0012] 4) The weighted value matrix is ​​calculated by the ideal solution sorting method to obtain the closest value of each node in the cyberspace and sort them. The weight of the network attack task is multiplied by the closeness of each network node to determine the closeness of each network node under different attack tasks, so as to identify the key terrain of the cyberspace.

[0013] The present invention constructs a cyberspace key terrain analysis hierarchy model and a cyber attack task analysis hierarchy model based on the fuzzy analytic hierarchy process; determines the weight of the cyber attack task according to the cyber attack task analysis hierarchy model, and determines the weighted value matrix according to the cyberspace key terrain analysis hierarchy model; then calculates the obtained weighted value matrix by the ideal solution sorting method, obtains the closest value of each node in the cyberspace and sorts it, multiplies the weight of the cyber attack task by the closeness of each network node, determines the closeness of each network node under different attack tasks, and thereby identifies the cyberspace key terrain. The present invention takes into account the impact of cyber attacks, determines key nodes by the weight of the cyber attack task, closely links the cyber attack task with the cyberspace key terrain, and improves the accuracy of identification.

[0014] Furthermore, the process of determining the network attack task weight is as follows:

[0015] Obtaining the evaluation value of each network information security attribute in the criterion layer to obtain the fuzzy matrix of the network attack task, and adjusting the obtained fuzzy matrix for consistency to obtain the consistent fuzzy matrix of the network attack task;

[0016] The network information security attributes in the criterion layer are compared pairwise to obtain the weight of the network attack task consistency fuzzy matrix, which is the network attack task weight.

[0017] The present invention uses experts who are familiar with cyberspace and have experience in network attacks to evaluate the network information security attributes in the criterion layer of the hierarchical analysis model, thereby establishing a fuzzy matrix of network attack tasks; by comparing each network information security attribute in the criterion layer, the weight of the network attack task consistency fuzzy matrix is ​​obtained. With the help of the evaluation results of experts, the network attack task weight determined by the present invention can accurately characterize the impact of the network attack task on the node.

[0018] Furthermore, the weighted value matrix determination process is as follows:

[0019] Obtaining evaluation values ​​of cyberspace terrain feature attributes of each physical layer in the criterion layer of the cyberspace key terrain hierarchical analysis model to obtain a fuzzy matrix of the cyberspace key terrain, and performing consistency adjustment on the obtained fuzzy matrix to obtain a consistent fuzzy matrix of the cyberspace key terrain;

[0020] The cyberspace terrain feature attributes of each physical layer in the criterion layer are compared pairwise to obtain the weights of the cyberspace key terrain consistency fuzzy matrix;

[0021] The obtained consistency fuzzy matrix of the key terrain in cyberspace is multiplied by the corresponding weights, and the result is the weighted value matrix.

[0022] The present invention uses experts familiar with cyberspace to evaluate the cyberspace terrain feature attributes of each physical layer in the criterion layer of the hierarchical analysis model, thereby establishing a fuzzy matrix of cyberspace key terrain; by comparing the cyberspace terrain feature attributes of each physical layer in the criterion layer, the weights of the cyberspace key terrain consistency fuzzy matrix are obtained. With the help of the expert evaluation results, the present invention determines a weighted value matrix that can accurately characterize the impact of the cyberspace terrain feature attributes of each physical layer on the node.

[0023] Furthermore, the ideal solution ranking method in step 4) is implemented by using a TOPSIS algorithm corrected by cosine similarity.

[0024] Furthermore, the implementation process of the ideal solution sorting method is as follows:

[0025] the corresponding positive and negative ideal solutions obtained from the weighted value matrix;

[0026] Calculate the distance of each network asset to the positive ideal solution and the negative ideal solution respectively according to the vector cosine distance algorithm;

[0027] The closeness between each alternative solution and the ideal solution is determined based on the distance from the network assets to the positive ideal solution and the negative ideal solution. The smaller the closeness, the farther the alternative solution is from the ideal solution.

[0028] The present invention converts the Euclidean distance calculation in the traditional TOPSIS algorithm into the calculation of the cosine angle in the vector space, which can reduce the correlation between network assets.

[0029] Furthermore, when calculating the distances of each network asset to the positive ideal solution and the negative ideal solution, the average of each indicator to the positive and negative ideal solutions is first calculated, and then the average is subtracted from the network asset.

[0030] Furthermore, the distances of each network asset to the positive ideal solution and the negative ideal solution are calculated using the following formula:

[0031]

[0032]

[0033] Where d(A i ,C + )、d(A i ,C -) are the distances from the network assets to the positive ideal solution and the negative ideal solution, respectively, v i is the ith network asset, c avg is the average, c + is a positive ideal solution, c - is a negative ideal solution.

[0034] When calculating the distances of each network asset to the positive ideal solution and the negative ideal solution, the present invention calculates the average of each indicator to the positive and negative ideal solutions and subtracts the average in all dimensions, thereby amplifying the gaps between the various solutions and improving the recognition accuracy.

[0035] Furthermore, the network attack task is a combination of one or more tactics from the three major categories of tactics in the ATT&CK framework.

[0036] The present invention classifies the tactics in the ATT&CK framework and uses each category or a combination of categories as network attack tasks, taking into account various possible situations during the attack.

[0037] Furthermore, the network information security attributes include confidentiality, integrity, availability, controllability and non-repudiation; the characteristic attributes of the physical layer cyberspace terrain include components, hardware devices, ports, network protocols, and operating systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is the technical roadmap of the method for identifying key terrain in cyberspace of the present invention;

[0039] Figure 2 It is a structural diagram of the key terrain level analysis model of the asset layer network space constructed by the present invention;

[0040] Figure 3 This is a schematic diagram of the tactical composition of the ATT&CK tactical framework;

[0041] Figure 4 It is a classification diagram of the tactics of the ATT&CK tactical framework according to the present invention;

[0042] Figure 5 It is a schematic diagram of the cyber attack tasks that hackers may formulate;

[0043] Figure 6 It is a schematic diagram of the fuzzy judgment degree of the evaluation index adopted by the present invention;

[0044] Figure 7 It is a schematic diagram of the characteristic attributes of the node's physical layer cyberspace terrain;

[0045] Figure 8 is the distribution of each node in the embodiment of the present invention;

[0046] Fig. 9 It is the correlation of each attribute in the hierarchical analysis model of cyberspace key terrain;

[0047] Fig.10 This is the key terrain of the asset layer network space identified by the present invention, TIOSIS method, TOPSIS improved by Mahalanobis distance and network system vulnerability value method based on CVSS3.1 in this experimental process;

[0048] Fig.11 It is the correlation between the present invention and the TIOSIS method and the TOPSIS method improved by the Mahalanobis distance during the experimental process;

[0049] Fig.12 It is the distance between the results obtained by the present invention, the TIOSIS method, and the TOPSIS method improved by the Mahalanobis distance and the system vulnerability value;

[0050] Fig.13 The root mean square error between the results obtained by the present invention, the TIOSIS method, the TOPSIS improved by Mahalanobis distance and the network system vulnerability value method based on CVSS3.1 and the system vulnerability value;

[0051] Fig.14 is the proximity of each node in six different attack tasks in the embodiment of the present invention;

[0052] Fig.15 It is the ranking of network nodes under different tasks in the embodiment of the present invention. DETAILED DESCRIPTION

[0053] The specific implementation of the present invention will be further described below in conjunction with the accompanying drawings.

[0054] The present invention introduces network attack tasks from the perspective of hackers, analyzes the impact of network attack tasks on identifying key terrain in cyberspace, and proposes a method for identifying key terrain in cyberspace. The method constructs a hierarchical analysis model of cyberspace key terrain and a hierarchical analysis model of network attack tasks based on the fuzzy hierarchical analysis method; determines the weight of the network attack task according to the hierarchical analysis model of network attack tasks, and determines the weighted value matrix according to the hierarchical analysis model of network space key terrain; then calculates the obtained weighted value matrix through the ideal solution sorting method to obtain the closest value of each node in the cyberspace and sorts them, multiplies the weight of the network attack task by the proximity of each network node, determines the proximity of each network node under different attack tasks, and thereby identifies the key terrain in cyberspace. The implementation route of this method is as follows: Figure 1 As shown, the specific description is given below.

[0055] The present invention uses fuzzy hierarchical analysis method to construct a network attack task hierarchical analysis model and an asset layer cyberspace key terrain hierarchical analysis model. The established asset layer cyberspace key terrain (KCT) hierarchical analysis model is as follows: Figure 2 As shown in the figure, the first layer is the target layer, i.e., the key terrain of cyberspace; the second layer is the criterion layer, which is the characteristic attribute of the terrain of cyberspace in the asset layer. The characteristic attribute includes components, hardware devices, ports, network protocols, operating system, etc. l , l∈[1,k] represents; the third layer is the alternative solution layer, which refers to the connection node in the network space, which is represented by IP and A m , m∈[1,n]. The established network attack task hierarchical analysis model is similar to the asset layer cyberspace critical terrain hierarchical analysis model, which also includes three layers. Its target layer is also the cyberspace critical terrain. The difference is that the criterion layer is the network information security attribute that describes information transmission, and the alternative solution layer is the network attack task determined based on the ATT&CK framework.

[0056] ATT&CK (Adversarial Tactics, Techeiques And Common Knowledge Tactics Framework, ATT&CK) is a framework for describing network attack paths based on the attacker's perspective proposed by the MITRE organization established by the Massachusetts Institute of Technology Computer Laboratory. The framework includes tactics (14 items) and techniques (177 techniques, 348 sub-techniques) used in each stage of a network attack. Its tactical components are as follows: Figure 3 shown.

[0057] A network attack task should describe the attack effect achieved by using network attack means rather than describing the mission purpose of the network system. The ATT&CK framework is a very mature network attack technology classification framework. It divides tactics into 14 items, but hackers do not use all 14 tactics at the same time when conducting network attacks. A network attack task contains multiple tactics and their combination. Therefore, the 14 tactics in the ATT&CK framework need to be reclassified.

[0058] Based on the impact of cyber attacks, the present invention divides the 14 tactics into three categories, namely resource construction, environment construction and environment destruction. Figure 4As shown. Resource construction tasks include three tactics: reconnaissance, resource development, and collection, which refers to obtaining information and resources from the attacked party; environment construction includes six tactics: initial access, persistence, privilege escalation, defense bypass, credential acquisition, and discovery, which refers to understanding the opponent's network environment, obtaining system permissions, and hiding identity; destruction includes five tactics: execution, lateral movement, command and control, data exfiltration, and influence, which refers to outputting data from the opponent's network or destroying the opponent's network environment. A network attack task is a combination of one or more tactics from the three major categories of tactics. Hackers may formulate six network attack tasks, such as Figure 5 shown.

[0059] The application of fuzzy hierarchical analysis method must construct a criterion layer, which is the criterion for experts or expert systems to evaluate alternative solutions. When constructing a hierarchical analysis model for network attack tasks, the present invention adopts the network information security attributes proposed by the U.S. Cybersecurity and Infrastructure Agency (CISA) to construct a criterion layer, that is, confidentiality, integrity, availability, controllability and non-repudiation are used as the five attributes of network attack tasks to construct a fuzzy consistency judgment matrix. Confidentiality refers to the fact that information in the network is not obtained and used by unauthorized entities; integrity refers to the characteristics of information that remain unmodified, undamaged and lost during storage or transmission; availability refers to the ability of authorized entities or users to access and use information as required; controllability refers to the ability of information to be effectively controlled by legitimate users; non-repudiation refers to the authenticity of both parties in information exchange.

[0060] When constructing the hierarchical analysis model of the key terrain of cyberspace, the present invention takes the components, hardware devices, ports, network protocols, and operating systems of IP as the characteristic attributes of the physical layer cyberspace terrain and constructs the criterion layer accordingly, such as Figure 7 As shown. Components refer to applications, supports, services, etc. that can be detected by IP; hardware devices refer to all hardware devices under IP, including but not limited to routers, switches, workstations, and industrial computers; ports refer to the outlets for devices to communicate with the outside world, and ports in this invention refer to virtual ports; network protocols refer to the set of rules, standards, or agreements established for data exchange in network transmission; operating systems refer to interrelated system software programs that control computer operations, use and run hardware and software resources, and provide public services to organize user interactions.

[0061] The fuzzy hierarchical analysis method allows "all important tangible and intangible, quantitative and qualitative factors" to be included and measured, just like the hierarchical analysis method. The present invention uses experts who are familiar with cyberspace and have experience in cyber attacks to classify the criterion layers F of the hierarchical analysis model. l For evaluation, the fuzzy judgment scale of the evaluation index is as follows Figure 6 As shown. The fuzzy matrix constituting the network space terrain of the asset layer is:

[0062]

[0063]

[0064] where i = (1, 2, ..., n), j = (1, 2, ..., m), represents the kth expert's opinion on network asset A i The evaluation value of the criterion layer, and It has the following properties:

[0065] 1)r ii =0.5

[0066] 2)r ij =1-r ji

[0067] 3)r ij =r it -r jt ,t=(1,2,…,n)

[0068] Fuzzy Matrix Perform consistency adjustment and select the row with the highest credibility from the fuzzy matrix to judge r 11 ,r 12 ,…,r 1m , using this row and the matrix Subtract each row in . If the n differences are all constants, no adjustment is required. Otherwise, the subtracted row needs to be adjusted so that the n differences between the two are constants. The adjusted fuzzy consistency matrix is ​​R.

[0069] The construction process of the fuzzy consistency judgment matrix of the network attack task is similar to that of the network space terrain of the asset layer. The weights of the fuzzy consistency matrix R obtained by pairwise comparison of the network information security attributes of information transmission related to the network attack task are expressed as W α1 ,…,W αk In which W αk It is the network information security attribute that affects information transmission. l The characteristic attributes of the network space terrain of the asset layer are weighted by W β1 ,…,W βk Indicates that the weight can be calculated by fuzzy analytic hierarchy process, such as Fig. 9 shown.

[0070] Based on the fuzzy consistency matrix, the fuzzy weight can be obtained using the geometric mean method. The formula is as follows:

[0071] W αi =r i ×(r1+r2+…+r n ) -1

[0072]

[0073] Where i, j = 1, 2, ..., n. The weight of the characteristic attribute of the network space terrain of the asset layer W βk The same method can be used to obtain .

[0074] Through the fuzzy consistency matrix R after adjustment and the weight W of the characteristic attributes of the network space terrain of the asset layer βk By multiplying them together, we can get the weighted value matrix V, the formula is as follows:

[0075]

[0076] The positive ideal solution is the set of elements with the highest scores in the weighted value matrix V. The negative ideal solution is the set of elements with the lowest scores in the weighted value matrix V.

[0077]

[0078]

[0079] The TOPSIS algorithm based on cosine similarity correction converts the Euclidean distance calculation in the traditional TOPSIS algorithm into the calculation of cosine angle in the vector space, which can reduce the correlation between network assets.

[0080] First, in n-dimensional vector space, the vector and The formula for calculating the cosine of the angle is as follows:

[0081]

[0082] Then, the cosine similarity is corrected by using a logarithmic function with a base of 0.5 and a power of the cosine function. This composite function is a decreasing function within its domain, which means that the greater the similarity, the smaller the distance. i The formulas for positive and negative ideal solutions are as follows:

[0083] A i Distance to the positive ideal solution:

[0084]

[0085] A i Distance to the negative ideal solution:

[0086]

[0087] Finally, the average of each indicator to the positive and negative ideal solutions is calculated, and this average is subtracted from all dimensions to magnify the gap between the various solutions. The formula is as follows:

[0088]

[0089]

[0090] The degree of closeness between each alternative solution and the ideal solution is expressed as the closeness f i It means that the smaller the closeness, the farther the alternative is from the ideal solution. The formula is as follows:

[0091]

[0092] The network attack task weight is denoted by W α1 ,…,W αk Indicates that the closeness can be expressed as f1,…,f i , then the key terrain of the asset layer network can be expressed as:

[0093]

[0094] This matrix represents the proximity of each node under different tasks. The key terrain is determined by comparing the proximity of each node under different tasks (the number of tactics constituting the task is the same, but the tactics are different). The one with the highest proximity is considered to be the key terrain.

[0095] The attributes of network nodes detected by the cyberspace engine are often positively correlated with the vulnerabilities in the node, that is, the more assets, the more vulnerabilities. Therefore, when constructing the criterion layer, multiple attributes are positively correlated with vulnerabilities.

[0096] The present invention starts from the methodology of "criticality is equivalent to destructiveness" in system science, and considers the characteristics that the indicators in the criterion layer have a strong positive correlation with the vulnerability of the network system. The vulnerability value of the network system is used as the experimental control group to evaluate the effectiveness of CosS-TOPSIS.

[0097] The Common Vulnerability Scoring System (CVSS) is an open standard used to describe the characteristics and severity of the vulnerability itself. The CVSS vulnerability scoring system focuses on the attributes of the vulnerability itself and can accurately assess the vulnerability value of a single asset. However, the present invention focuses on nodes (IPs) in cyberspace. An IP may contain multiple network devices and software and hardware, and there are t vulnerabilities. Therefore, the present invention uses the accumulation method to determine the vulnerability value of the IP, that is, the vulnerability scores of multiple devices under a certain IP are accumulated as the vulnerability value of the IP. Assuming that n devices under a certain IP have detected t device vulnerabilities in total, the vulnerability value score is M i , then the vulnerability value of the IP is:

[0098]

[0099] Vulnerabilities can be obtained through cyberspace mapping tools such as ZoomEye, and their vulnerability values ​​are evaluated through the CVSS3.1 vulnerability scoring system. Vulnerability value is a method for evaluating the vulnerability of network nodes. Currently, there are relatively few algorithms for identifying key terrain in cyberspace, and there is a lack of comparative experiments, making it difficult to conduct reliability analysis. Therefore, the present invention uses vulnerability value as a control group (true value) to analyze the differences and superiority of the present invention and other methods.

[0100] The correlation of each attribute in the cyberspace key terrain hierarchical analysis model is as follows: Fig. 9 As shown in the figure, it can be seen that the vulnerability value has a high correlation with components, hardware devices, ports, and network protocols; and has a low correlation with operating systems. There is also a high correlation between hardware devices, ports, network protocols, and components. Therefore, when identifying key terrain in cyberspace, the correlation between attributes must be considered.

[0101] Experimental verification

[0102] In order to better illustrate the effect of the present invention, a certain electric power secondary information system is taken as an example to apply the method of the present invention to identify the key terrain of the asset layer network space, and compare it with the existing TIOSIS method, TOPSIS improved by Mahalanobis distance and the network system vulnerability value method based on CVSS3.1 to identify the key terrain of the asset layer network space. The results are as follows Fig.10 shown.

[0103] Figure 8 The nodes in this example are the top nodes in the network space, which are considered to be the key terrain of the asset layer network space. Fig. 9 It can be seen that the top four network node IPs in the key terrain of the power secondary information system network space identified by the present invention (CosS-TOPSI) are A13, A18, A10, and A8 respectively; the top four network node IPs in the TOPSIS method are A20, A8, A10, and A18 respectively. The top four network node IPs in the MD-TOPSIS method are A13, A3, A18, and A20 respectively.

[0104] Spearman's rank correlation coefficient is a commonly used method to measure the degree of correlation between hierarchical ordinal variables. Both the ideal solution ranking and the improved ideal solution ranking require the calculation of the closest value, so it is appropriate to use the Spearman rank correlation coefficient to calculate the correlation between each method and the network system vulnerability value. The higher the correlation coefficient between each method and the network system vulnerability value calculated based on CVSS 3.1, the better the method effect.

[0105] Although the ideal solution ranking method improved by Mahalanobis distance can also reduce the similarity between multiple attributes, the Mahalanobis distance will amplify the impact of irrelevant attributes on the results. Fig.11 As shown, the present invention has a high correlation with the ideal solution sorting method improved by Mahalanobis distance, but the present invention has the highest similarity with the network system vulnerability value method, which indicates that the accuracy of the present invention in identifying network key terrain is higher than the other two methods.

[0106] The root mean square error and mean absolute error are indicators that measure the deviation between the observed value and the true value. They are widely used in the fields of surveying and mapping and remote sensing. It is also appropriate to use the root mean square error to evaluate the accuracy of each method by taking the results of the ideal solution sorting and the improved ideal solution sorting as the observed value and the system vulnerability value as the true value. The lower the RMSE value of each method compared with the system vulnerability value, the higher the accuracy of the method. Fig.12 It is the distance between the results of each method and the system vulnerability value.

[0107] like Fig.13 As shown, the root mean square error between the present invention and the system vulnerability value is 16% smaller than TOPSIS and 22% smaller than MD-TOPSIS; the mean absolute error is 20% smaller than TOPSIS and 24% smaller than MD-TOPSIS, which indicates that the correlation between the key terrain of cyberspace identified by the present invention and the system vulnerability value is the strongest, indicating that the method of the present invention is superior to the other two methods.

[0108] The dynamics of cyberspace refers to the continuous addition and exit of network nodes, and the rapid updating and disappearance of information, which causes slight or drastic changes in the topography of cyberspace. The present invention expands the dynamics of the topography of cyberspace, and believes that the dynamics of the topography of cyberspace is not only reflected in the addition and disappearance of network nodes, but is also closely related to network attack tasks. The present invention divides the 14 tactics in the ATT&CK framework into three categories. When hackers formulate network attack tasks, they will not use 14 tactics at the same time on the same target, but a combination of tactics in the three categories. Fig.14 As shown, M1 to M6 are randomly selected as possible tasks to discuss the relationship between network attack tasks and key terrain in cyberspace.

[0109] like Fig.15 As shown, when node A8 executes the network attack task coded as M4, its closeness value is smaller than the closeness value when node A10 executes the network attack task coded as M3. Fig.14 It shows the ranking of network nodes under different tasks. This shows that the network attack task has a decisive influence on the identification of key terrain in cyberspace, and the key terrain in cyberspace will change with the network attack task, that is, the ranking of network nodes under different network attack tasks is different.

Claims

1. A method for identifying key terrain in cyberspace, characterized in that: The identification method comprises the following steps: 1) Obtaining attribute information of each network node in the cyberspace, wherein the attribute information includes characteristic attributes of the physical layer cyberspace terrain and network information security attributes; 2) Based on the obtained network information security attributes, a network attack task hierarchical analysis model is constructed using the fuzzy hierarchical analysis method, and the network attack task weight is determined based on this; the constructed network attack task hierarchical analysis model includes a target layer, a criterion layer, and an alternative solution layer, wherein the target layer is used to describe the key terrain of cyberspace, the criterion layer is used to describe the network information security attributes of information transmission, and the alternative solution layer is a network attack task determined based on various tactics in the ATT&CK framework; 3) According to the characteristic attributes of the obtained physical layer cyberspace terrain, a hierarchical analysis model of cyberspace key terrain is constructed using the fuzzy hierarchical analysis method to determine the corresponding weighted value matrix; the constructed hierarchical analysis model of cyberspace key terrain includes a target layer, a criterion layer and an alternative solution layer, wherein the target layer is used to describe the key terrain of cyberspace, the criterion layer is used to describe the characteristic attributes of the asset layer cyberspace terrain, and the alternative solution layer is used to describe the connection nodes in the cyberspace; 4) The weighted value matrix is ​​calculated by the ideal solution sorting method to obtain the closest value of each node in the cyberspace and sort them. The weight of the network attack task is multiplied by the closeness of each network node to determine the closeness of each network node under different attack tasks, so as to identify the key terrain of the cyberspace.

2. The method for identifying key terrain in cyberspace according to claim 1, characterized in that: The process of determining the network attack task weight is as follows: Obtaining the evaluation value of each network information security attribute in the criterion layer to obtain the fuzzy matrix of the network attack task, and adjusting the obtained fuzzy matrix for consistency to obtain the consistent fuzzy matrix of the network attack task; The network information security attributes in the criterion layer are compared pairwise to obtain the weight of the network attack task consistency fuzzy matrix, which is the network attack task weight.

3. The method for identifying key terrain in cyberspace according to claim 1, characterized in that: The weighted value matrix determination process is as follows: Obtaining evaluation values ​​of cyberspace terrain feature attributes of each physical layer in the criterion layer of the cyberspace key terrain hierarchical analysis model to obtain a fuzzy matrix of the cyberspace key terrain, and performing consistency adjustment on the obtained fuzzy matrix to obtain a consistent fuzzy matrix of the cyberspace key terrain; The cyberspace terrain feature attributes of each physical layer in the criterion layer are compared pairwise to obtain the weights of the cyberspace key terrain consistency fuzzy matrix; The obtained consistency fuzzy matrix of the key terrain in cyberspace is multiplied by the corresponding weights, and the result is the weighted value matrix.

4. The method for identifying key terrain in cyberspace according to claim 3, characterized in that: The ideal solution sorting method in step 4) is implemented by using the TOPSIS algorithm corrected by cosine similarity.

5. The method for identifying key terrain in cyberspace according to claim 4, characterized in that: The implementation process of the ideal solution sorting method is as follows: the corresponding positive and negative ideal solutions obtained from the weighted value matrix; Calculate the distance of each network asset to the positive ideal solution and the negative ideal solution respectively according to the vector cosine distance algorithm; The closeness between each alternative solution and the ideal solution is determined based on the distance from the network assets to the positive ideal solution and the negative ideal solution. The smaller the closeness, the farther the alternative solution is from the ideal solution.

6. The method for identifying key terrain in cyberspace according to claim 5, characterized in that: When calculating the distances of each network asset to the positive ideal solution and the negative ideal solution, the average of each indicator to the positive and negative ideal solutions is first calculated, and then the average is subtracted from the network asset.

7. The method for identifying key terrain in cyberspace according to claim 6, characterized in that: The calculation formula used for the distance of each network asset to the positive ideal solution and the negative ideal solution is: Where d(A i ,C + )、d(A i ,C - ) are the distances from the network assets to the positive ideal solution and the negative ideal solution, respectively, v i is the ith network asset, c avg is the average, c + is a positive ideal solution, c - is a negative ideal solution.

8. The method for identifying key terrain in cyberspace according to claim 1, characterized in that: The network attack task is a combination of one or more tactics from the three major categories of tactics in the ATT&CK framework.

9. The method for identifying key terrain in cyberspace according to any one of claims 1 to 8, characterized in that: The network information security attributes include confidentiality, integrity, availability, controllability and non-repudiation; the characteristic attributes of the physical layer cyberspace terrain include components, hardware devices, ports, network protocols and operating systems.

Images