Network killing chain generation method based on atlas entity relation model

Abstract

The invention relates to the field of network security, in particular to a network killing chain generation method based on a graph entity relation model. Comprising the following steps: defining a network killing chain atlas entity relationship model, and configuring an atlas entity relationship model; drawing a network killing chain by using historical data, manually triggering and drawing a configuration-based historical data extraction entity and constructing a relationship; receiving real-time data to draw a network killing chain, continuously receiving configuration data of the graph entity relation model in real time, extracting entities based on configuration and constructing a relation, performing real-time updating when the configuration of the graph entity relation model changes, and extracting the entities to construct the relation through new configuration; and visually analyzing the network killing chain. According to the network killing chain generation method based on the atlas entity relation model, the whole attack link can be completely covered, attack behaviors in different stages are effectively associated, and meanwhile the real-time attack link condition can be continuously displayed.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network kill chain generation method based on a graph entity relationship model. Background Art

[0002] With the rapid development of network technology, network security threats have become increasingly complex and diverse. Network attackers are using increasingly covert, multi-level, and multi-source attack methods, which poses a great challenge to network security. At present, network attack methods are becoming increasingly complex and diverse, and traditional security protection methods are difficult to cope with new threats. Existing network kill chain models such as Cyber ​​Kill Chai have been widely used in security research and defense strategies.

[0003] However, these models mainly rely on static data analysis and empirical judgment, and lack dynamic association and real-time analysis capabilities. For example, in patent application number CN117395072A, the patent name is "A method, device and electronic device for generating a network kill chain", the method includes: generating multi-source logs and security alarm logs according to network traffic and terminal behavior; aggregating the security alarm logs to obtain aggregated security alarm logs, and associating multi-source logs based on the aggregated security alarm logs to obtain user behavior sequences; inputting the user behavior sequence into a pre-trained detection model, and detecting whether there is attack traffic in the user behavior sequence based on the detection model; when there is attack traffic in the user behavior sequence, inputting the user behavior sequence into a pre-trained generation model, and generating a network kill chain corresponding to the attack traffic based on the generation model. The disadvantages are: analysis based on static data cannot reflect changes in the network environment in real time; attack behaviors at different stages cannot be effectively associated and inferred, resulting in incomplete links; the current attack traffic cannot be used for association, resulting in delayed analysis; there is a lack of comprehensive coverage of the entire network kill chain, and complex attacks cannot be effectively prevented and detected; only cleaned attack traffic can be used for analysis, and other data such as network link and asset vulnerability data cannot be used to supplement, resulting in incomplete analysis. Summary of the invention

[0004] In view of the problem that the network kill chain model in the prior art is based on static data analysis and cannot reflect the changes in the network environment in real time, the present invention provides a network kill chain generation method based on a graph entity relationship model, which can completely cover the entire attack chain and effectively associate the attack behaviors at different stages. At the same time, it can continuously display the real-time attack chain situation, discover the weak links in the chain and perform targeted defense to improve the overall network security level.

[0005] To achieve the above technical objectives, the present invention provides a technical solution, which is a method for generating a network kill chain based on a graph entity relationship model, comprising the following steps: S1, define the network kill chain graph entity relationship model and configure the graph entity relationship model; S2, using historical data to draw a cyber kill chain, manually triggering the drawing to extract entities based on the configured historical data and build relationships to form a cyber kill chain; S3, receiving real-time data to draw a network kill chain, continuously receiving configuration data of the graph entity relationship model in real time, extracting entities and building relationships based on the configuration, continuously adding newly generated attack links to the drawn network kill chain, and updating the graph entity relationship model in real time when the configuration changes, extracting entities and building relationships with the new configuration; S4, Visual analysis of the network kill chain.

[0006] In this technical solution, by defining the graph entity relationship model and configuring data extraction and entity relationships, the entire attack chain can be fully covered. While continuously receiving real-time data, entities can be dynamically extracted and relationships can be built, and newly generated attack chains can be continuously added to the drawn network kill chain. When the configuration of the graph entity relationship model changes, the system will also be updated in real time to ensure that entities are extracted and relationships are built with the latest configuration. A dynamic and real-time construction method is formed, which can effectively respond to changes in network environment and attack technology without defining the attack stage in advance, and it is a good supplement to the integrity of the link.

[0007] The present invention is further configured as follows: in step S1, the configuration graph entity relationship model includes data extraction configuration and entity relationship configuration.

[0008] In this technical solution, the configuration graph entity relationship model covers two core links: data extraction configuration and entity relationship configuration. Data extraction configuration carefully designs the selection of data types and the setting of data screening conditions, ensuring the accurate extraction of key information from a variety of data sources, and providing solid data support for building a network kill chain. Entity relationship configuration clarifies the internal connection between data by defining entities and relationships, allowing the attack chain to be clearly presented.

[0009] The present invention is further configured as follows: the data extraction configuration includes data types and data screening conditions, and the data types mainly include risk data output by the policy model, and supplemented by security device logs and asset vulnerability data.

[0010] In this technical solution, the risk data output by the policy model is used as the main basis. These data are directly related to the core links of network attacks and provide direct evidence for analyzing attack behaviors. At the same time, in order to make up for the limitations of risk data, security device logs and asset vulnerability data are also introduced as important supplements. Security device logs record the real-time situation of network activities and can reveal clues of attack behaviors; while asset vulnerability data reveals potential weaknesses in the network system, providing a strong basis for predicting and preventing attacks. This diversified combination of data types not only enhances the flexibility of data extraction configuration, but also significantly improves the accuracy and completeness of network kill chain construction.

[0011] The present invention is further configured as follows: the data screening condition is to use the fields in the data to perform any free combination screening, and configure the historical data range at the same time.

[0012] In this technical solution, the data screening conditions used allow users to use the fields in the data for any free combination of screening. This feature greatly broadens the perspective and depth of data analysis. Users can flexibly select key fields for combination according to actual needs, so as to accurately locate the required data information. At the same time, it also provides configuration options for the historical data range, allowing users to select data within a specific time period for in-depth analysis as needed. This setting of data screening conditions not only improves the pertinence and efficiency of data analysis, but also provides a strong guarantee for building an accurate and comprehensive network kill chain.

[0013] The present invention is further configured as follows: the entity relationship configuration includes entity definition and relationship definition, the entity definition includes entity type and data field to identify a unique entity, the entity type includes common, attribute, merge and extension, the relationship definition includes a dynamic method using the risk identified in the risk data as the relationship name and a static method using the relationship name pre-configured manually.

[0014] In this technical solution, in terms of entity definition, a variety of entity types are cleverly introduced, including common, attribute, merge and extension. These types can comprehensively cover various elements and attributes in the network, providing a rich data foundation for building a network kill chain. At the same time, through the precise configuration of data fields, each entity can be uniquely identified, thereby ensuring the accuracy and consistency of the data. In terms of relationship definition, dynamic and static methods are used to define the relationship between entities. The dynamic method uses the risks identified in the risk data as the relationship name, which can reflect the dynamic changes of network attacks in real time, making the construction of the network kill chain closer to the actual attack scenario. The static method allows manual pre-configuration of relationship names, providing analysts with more flexibility and controllability.

[0015] The present invention is further configured as follows: the risk data includes source IP, target IP, account number and domain name, the source IP, target IP, account number and domain name define common entities, and risk tags are used between the source IP, target IP, account number and domain name to define dynamic relationships.

[0016] In this technical solution, key risk data such as source IP, target IP, account and domain name are directly related to the core elements of network attacks, and are key clues to reveal attack behaviors and track attack paths. Source IP, target IP, account and domain name are cleverly defined as common entities, which constitute the basic framework of the network kill chain. What is even more ingenious is that risk labels are used as the link of dynamic relationships to closely link these entities together. Risk labels not only accurately describe the association mode and attack behavior between entities, but also update in real time with the dynamic changes of network attacks, ensuring the timeliness and accuracy of the network kill chain.

[0017] The present invention is further configured as follows: the asset vulnerability data includes a host IP and a vulnerability name, and a static relationship is defined between the host IP and the vulnerability name as inclusion.

[0018] This technical solution introduces asset vulnerability data, especially host IP and vulnerability names, which are important bases for evaluating network security and predicting potential attack paths. When defining the relationship between host IP and vulnerability name, a static relationship "inclusion" strategy is adopted to clarify the direct association between host IP and the vulnerability it contains, allowing analysts to quickly identify weak links and potential threats in the network. This definition of static relationships not only simplifies the complexity of data processing, but also ensures the accuracy and consistency of information, providing a solid foundation for building a robust network kill chain.

[0019] The present invention is further configured as follows: Step S2 further includes: in the process of drawing the network kill chain, supporting viewing the current progress status, and after the network kill chain is drawn, adjusting the model according to the drawn network kill chain, reconfiguring and drawing again.

[0020] In this technical solution, step S2 includes the function of viewing the current drawing progress, allowing users to grasp the progress of the network kill chain construction in real time, so as to better arrange subsequent work and analysis plans. It also allows users to adjust the model according to the drawing results after the network kill chain is drawn. This function means that users can flexibly optimize the entity relationship model according to changes in the actual network environment and attack mode to ensure the accuracy and timeliness of the network kill chain. By reconfiguring the model and drawing it again, users can continuously iterate and improve the network kill chain to better adapt to the ever-changing network security challenges.

[0021] The present invention is further configured as follows: in step S4, the visual analysis of the network kill chain includes supporting viewing of a complete attack chain diagram of the attacker and a complete attacked chain diagram of the victim.

[0022] In this solution, the visual analysis of the network kill chain in step S4 can clearly show the complete attack link diagram of the attacker and the complete attacked link diagram of the attacked. This design allows users to see the full picture of the network attack at a glance, including the starting point, path, key links and final goal of the attack, so as to more accurately understand the attacker's intentions and strategies. More importantly, this visual analysis function also provides users with flexible operation and exploration space. Users can freely view and select the attack link or attacked link of interest according to their needs for in-depth analysis and research. This degree of freedom and flexibility not only meets the personalized needs of different users, but also brings more convenience and efficiency to network security analysis.

[0023] The present invention is further configured as follows: after step S4, it also includes visual exploration of the network kill chain: including viewing the statistics and details of all attackers and victims included in the entire network kill chain.

[0024] In this technical solution, the visual exploration of the network kill chain can fully display the statistics and details of all attackers and victims included in the entire network kill chain. This design allows users to quickly grasp the overall situation of network attacks, including the number, type, distribution of attackers and victims, and the relationship between them. Through intuitive statistical data and detailed information, users can have a deeper understanding of the patterns, trends and potential risks of network attacks. At the same time, the visual exploration function also provides users with powerful search and filtering tools. Users can quickly locate specific attackers or victims according to their needs, and view their detailed information and attack links. This flexibility and convenience not only meets the user's needs for accurate analysis, but also brings more possibilities and efficiency to network security protection work.

[0025] The beneficial effects of the present invention are as follows: (1) In view of the problem that the network kill chain model in the prior art is based on static data analysis and cannot reflect the changes in the network environment in real time, the present invention provides a network kill chain generation method based on a graph entity relationship model, which can completely cover the entire attack chain and effectively associate the attack behaviors at different stages. At the same time, it can continuously display the real-time attack chain situation, discover the weak links in the chain and carry out targeted defense to improve the overall network security level; (2) The complete network kill chain construction supports the use of various types of data to extract entities to build relationships, and can be continuously drawn in real time, which is a good supplement to the integrity of the chain. The relationship between entities supports the use of risk dynamic construction, without the need to define the attack stage in advance, so as to achieve dynamic response to changes in the network environment and attack technology; (3) The visualization of the network kill chain intuitively displays the attack chain and supports the exploration of the entire graph. The complete intrusion chain of the specified attacker or the complete intrusion chain of the attacked can be viewed, and the attack chain or all attack chains to be viewed can be freely set. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flow chart of the network kill chain generation method based on the graph entity relationship model of the present invention; Figure 2 2 is a capability diagram of the network kill chain visualization analysis module in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation method described herein is only an optimal embodiment of the present invention, which is only used to explain the present invention and does not limit the scope of protection of the present invention. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0028] like Figure 1 and Figure 2 As shown, as a first embodiment of the present invention, a network kill chain generation method based on a graph entity relationship model includes the following steps: S1, define the network kill chain graph entity relationship model and configure the graph entity relationship model.

[0029] The graph entity relationship model configuration includes two parts: data extraction configuration and entity relationship configuration; data extraction configuration includes two parts: data type and data filtering conditions. The data type is mainly based on the risk data output by the policy model, supplemented by security equipment logs and asset data. The data filtering conditions can use the fields in the data for any free combination and filtering, and the historical data range can be configured; entity relationship configuration includes two parts: entity definition and relationship definition. The entity definition includes entity type and data field for identifying unique entities. The entity types include normal, attribute, merge, and extension. There are two ways to define relationships: dynamic and static. The dynamic method uses the risks identified in the risk data as the relationship name, and the static method manually pre-configures the relationship name.

[0030] The data extraction configuration is used to determine the data for drawing the network kill chain, which is mainly attack traffic data, while other data can play a good supplementary role. For example, the forwarding device log can connect the attack links well, and the asset vulnerability data can explain why the attack traffic can come in, etc. In addition, the above data are all structured data that have been governed and cleaned. The entity relationship configuration is used to determine how to build a network kill chain based on the previous data. The core is to extract entities in the data and determine the relationship between entities; ordinary entities use the configured field value as the unique identifier. For example, if the entity configuration field is the source IP, and the value in the data is 1.1.1.1, then the entity identifier value is 1.1.1.1; the attribute entity uses the previous ordinary entity identifier and the configured field value combination as the unique identifier. For example, if the entity field is the target port, the previous ordinary entity is the target IP, the target IP value in the data is 1.1.1.2, and the target port is 22, then the entity identifier value is 1.1.1.1#22; The merged entity uses multiple configured field values ​​as the unique identifier. For example, if the entity configuration fields are domain name and URL, the domain name value in the data is www.baidu.com, and the URL is / s, then the entity identifier value is www.baidu.com# / s; The extended entity is a special case where the configuration field value contains multiple values. For example, if the entity field is an extended account, and the extended account value in the data is "zhangsan, lisi, wangwu", three entities will be constructed, and their entity values ​​are zhangsan, lisi and wangwu respectively; Dynamic or static relationships can be configured between entities, and they are directional, such as source IP entity-[dynamic]>target IP entity, the source IP value in the data is 1.1.1.1, the target IP value is 1.1.1.2, and the risk value is backdoor Trojan horse, then the entity relationship of "1.1.1.1-[backdoor Trojan horse]>1.1.1.2" will be constructed.

[0031] In this embodiment, the source IP, target IP, account number and domain name in the risk data are used to define common entities, and the risk tag is used to define the dynamic relationship between the source IP and the target IP, domain name and account number. At the same time, the host IP and vulnerability name in the asset vulnerability data are used to define common entities, and the static relationship "include" is defined between the host IP and the vulnerability name. Supplementary explanation: If the source IP value in the risk data is 1.1.1.1, the target IP value is 1.1.1.2, and the risk value is information detection, then the entity relationship of "1.1.1.1-[information detection]>1.1.1.2" will be constructed; if the host IP value in the asset vulnerability data is 1.1.1.2, and the vulnerability name is ssl protocol vulnerability, then the entity relationship of "1.1.1.2-[include]>ssl protocol vulnerability" will be constructed; this will form a network kill chain of "1.1.1.1-[information detection]>1.1.1.2-[include]>ssl protocol vulnerability".

[0032] S2, uses historical data to draw a cyber kill chain, manually triggering the drawing to extract entities and build relationships based on the configured historical data to form a cyber kill chain.

[0033] In this embodiment, after the graph entity relationship model is configured, manually triggered drawing can extract entities and build relationships based on the configured historical data, thereby forming a network kill chain and supporting viewing of the current progress; after the drawing is completed, the model can be adjusted according to the drawn network kill chain, reconfigured and drawn again.

[0034] S3, receives real-time data to draw a network kill chain, continuously receives configuration data of the graph entity relationship model in real time, extracts entities and builds relationships based on the configuration, continuously adds newly generated attack links to the drawn network kill chain, and updates the graph entity relationship model in real time when the configuration changes, extracts entities and builds relationships with the new configuration.

[0035] S4, Visual analysis of the network kill chain.

[0036] In this embodiment, it supports viewing the complete attack link graph of the attacker and the complete attacked link graph of the victim.

[0037] For example, the source IP 1.1.1.1 successively conducted information detection, backdoor Trojan, and injection attacks on the target IP 1.1.1.2, obtained the server permissions of 1.1.1.2, then completed lateral movement and boundary breakthrough on 1.1.1.3 through 1.1.1.2, and finally downloaded confidential data from 1.1.1.4 through 1.1.1.3. The complete link diagram of the attacker 1.1.1.1 is 1.1.1.1-[information detection, backdoor Trojan, injection attack]>1.1.1.2-[lateral movement, boundary map]>1.1.1.3-[data download]>1.1.1.4, while the complete link diagram of the attacker 1.1.1.4 is 1.1.1.4<[data download]-1.1.1.3<[lateral movement, boundary map]-1.1.1.2<[information detection, backdoor Trojan, injection attack]-1.1.1.1.

[0038] S5, Visual exploration of the cyber kill chain.

[0039] In this embodiment, the statistics and details of all attackers and victims included in the entire network kill chain can be viewed. For example, there are 75 IP addresses, including 1.1.1.1, 1.1.1.2, 1.1.1.3, etc., and search is supported. The statistics of the number of risks can also be viewed, such as 15 malicious attacks and 103 information detections. Security experts can quickly locate whether there are attackers and risks that need attention.

[0040] In addition, for each attacker / attacked person, you can easily view its attack data, for example, IP1.1.1.1 has information detection behavior on 1.1.1.2, backdoor Trojan and data download behavior on 1.1.1.3, injection attack and malicious attack behavior on 1.1.1.4; at the same time, you can also easily view its attacked data, for example, IP1.1.1.1 has boundary breakthrough and horizontal explosion by 2.1.1.1, horizontal movement by 3.1.1.1, and backdoor Trojan and code execution by 4.1.1.1; for these attack links and attacked links, you can quickly set whether to display them in the link and continue subsequent exploration, such as continuing to view the attack data and attacked data of 1.1.1.2 and whether to display them.

[0041] In view of the problem that the network kill chain model in the prior art is based on static data for analysis and cannot reflect the changes in the network environment in real time, the present invention provides a network kill chain generation method based on a graph entity relationship model, which can completely cover the entire attack chain, effectively associate the attack behaviors at different stages, and continuously display the real-time attack chain status, discover the weak links in the chain and carry out targeted defense to improve the overall network security level; complete network kill chain construction: supports the use of various types of data to extract entities to build relationships, and can continuously draw in real time, which is a good supplement to the integrity of the link; the relationship between entities supports the use of risk dynamic construction, without the need to define the attack stage in advance, so as to dynamically respond to changes in the network environment and attack technology; visualization of the network kill chain: intuitively displays the attack chain and supports exploration of the entire graph, and can view the complete intrusion chain of a specified attacker or the complete intrusion chain of the attacked, and freely sets the attack chain or all attack chains to be viewed.

[0042] The specific description of the present invention in the above embodiments is only used to further illustrate the present invention and cannot be understood as limiting the scope of protection of the present invention. Technical engineers in this field may make some non-essential improvements and adjustments to the present invention based on the contents of the above invention, which fall within the scope of protection of the present invention.

Claims

1. A network kill chain generation method based on a graph entity relationship model, characterized in that: The following steps are involved: S1, define the network kill chain graph entity relationship model and configure the graph entity relationship model; S2, using historical data to draw a cyber kill chain, manually triggering the drawing to extract entities based on the configured historical data and build relationships to form a cyber kill chain; S3, receiving real-time data to draw a network kill chain, continuously receiving configuration data of the graph entity relationship model in real time, extracting entities and building relationships based on the configuration, continuously adding newly generated attack links to the drawn network kill chain, and updating the graph entity relationship model in real time when the configuration changes, extracting entities and building relationships with the new configuration; S4, Visual analysis of the network kill chain.

2. According to claim 1, a network kill chain generation method based on a graph entity relationship model is characterized in that: In step S1, the configuration graph entity relationship model includes data extraction configuration and entity relationship configuration.

3. The method for generating a network kill chain based on a graph entity relationship model according to claim 2, characterized in that: The data extraction configuration includes data types and data screening conditions. The data types include risk data output by the policy model as the main data, and security device logs and asset vulnerability data as the supplementary data.

4. The method for generating a network kill chain based on a graph entity relationship model according to claim 3, characterized in that: The data screening condition is to use the fields in the data to perform any free combination screening and configure the historical data range.

5. The method for generating a network kill chain based on a graph entity relationship model according to claim 2, 3 or 4, characterized in that: The entity relationship configuration includes entity definition and relationship definition. The entity definition includes entity type and data field to identify a unique entity. The entity types include common, attribute, merge and extension. The relationship definition includes a dynamic method using the risks identified in the risk data as the relationship name and a static method using the relationship name pre-configured manually.

6. The method for generating a network kill chain based on a graph entity relationship model according to claim 3, characterized in that: The risk data includes source IP, target IP, account number and domain name, and the source IP, target IP, account number and domain name define common entities. Risk tags are used between the source IP, target IP, account number and domain name to define dynamic relationships.

7. The method for generating a network kill chain based on a graph entity relationship model according to claim 3, characterized in that: The asset vulnerability data includes a host IP and a vulnerability name, and a static relationship is defined between the host IP and the vulnerability name as inclusion.

8. The method for generating a network kill chain based on a graph entity relationship model according to claim 1, characterized in that: The step S2 also includes: in the process of drawing the network kill chain, supporting viewing the current progress, and after the network kill chain is drawn, adjusting the model according to the drawn network kill chain, reconfiguring and drawing again.

9. The method for generating a network kill chain based on a graph entity relationship model according to claim 1, characterized in that: In step S4, the visual analysis of the network kill chain includes supporting viewing of a complete attack chain diagram of the attacker and a complete attacked chain diagram of the victim.

10. The method for generating a network kill chain based on a graph entity relationship model according to claim 1, characterized in that: After step S4, the process also includes visually exploring the network kill chain: including viewing the statistics and details of all attackers and victims included in the entire network kill chain.

Images