Near-body honey spot deployment method based on attack graph

Abstract

The invention provides a close honey spot deployment method based on an attack graph, and relates to the technical field of deception defense resource deployment. The close honey point deployment method based on the attack graph comprises the following steps: scanning a target network, and obtaining attack graph nodes and mutual relation information of the attack graph nodes; initializing and updating the attack success probability of the attack graph nodes; acquiring vulnerability hosts in the target network based on the attack graph nodes, and constructing a topology attack graph based on the vulnerability hosts and the attack graph nodes; and calculating a vulnerability host priority based on the topology attack graph, and deploying a close honey point based on the vulnerability host priority. According to the method, the vulnerability host priority is calculated by researching the probability that the vulnerability hosts are attacked and analyzing the potential paths of transverse movement of the vulnerability hosts in the network topology structure, so that the near honey point is deployed, and the resource utilization efficiency of the near honey point is improved.

Description

Technical Field

[0001] The present invention relates to the field of deception defense resource deployment, and in particular to a close range honey spot deployment method based on an attack graph. Background Art

[0002] Honey spots are security tools built using simulation technology and trap technology. Close honey spots are honey spots deployed in the same network as the protected host. Their main function is to sense suspicious attacks, thereby blocking attackers from entering the protected system without affecting normal users. An attack graph is a model that expresses the vulnerability of a network or information system. Through the attack graph, possible attack paths from border nodes to nodes that need to be protected can be analyzed, and high-risk nodes on the path can be defended to achieve the purpose of protecting important nodes.

[0003] Existing attack graph technology is mainly constructed by analyzing the impact relationship between vulnerabilities. Once a host with a vulnerability is observed, it is considered to be exploitable, resulting in low utilization of deployed honeypot resources. Therefore, it is urgent to provide a solution to improve the above problem. Summary of the invention

[0004] The purpose of the present invention is to provide a close-range honey spot deployment method based on an attack graph, which improves the accuracy of attack path inference in the prior art and the problem of low efficiency of honey spot resource utilization.

[0005] The present invention provides a close-range honey spot deployment method based on an attack graph, which adopts the following technical solution:

[0006] Scan the target network to obtain vulnerability scanning results, and obtain multiple attack graph nodes and mutual relationship information of the attack graph nodes based on the vulnerability scanning results, wherein the attack graph nodes include fact nodes, derivation nodes and rule nodes;

[0007] Initializing the probability of the attack graph node, and updating the attack success probability of the rule node in the attack graph node based on the mutual relationship information;

[0008] Acquire vulnerable hosts in the target network based on the attack graph nodes, construct a topological attack graph based on the vulnerable hosts and the rule nodes, and calculate the probability of successful attack on the vulnerable hosts based on the attack success probability of the rule nodes;

[0009] Based on the topological attack graph, a minimum vertex cover set and the vertex centrality of each vertex are obtained, the vulnerable host priority is calculated based on the probability of successful attack and the vertex centrality, and close honey spots are deployed based on the vulnerable host priority.

[0010] As described above, in the method for deploying close-range honey spots based on an attack graph, in the process of initializing the probability of the attack graph nodes, the probability of the fact nodes and the derivation nodes is assigned a value of 1, and the probability of the rule nodes is obtained by calculating the availability score by a general vulnerability scoring system.

[0011] In the above-mentioned attack graph-based close-range honey spot deployment method, the probability of the rule node is calculated, and the availability score is calculated according to the following formula:

[0012] ES = 8.22 × AV × AC × PR × UI;

[0013] Among them, AV is the attack vector, AC is the attack complexity, PR is the permission requirement, and UI is the user interaction.

[0014] The close-range honey spot deployment method based on the attack graph as described above, wherein the probability of the rule node in the attack graph node is updated based on the mutual relationship information, including: based on the initial probability of the fact node and the mutual relationship information, updating the probability of the rule node according to the Bayesian theorem.

[0015] The above-mentioned close-range honey spot deployment method based on the attack graph, wherein the process of constructing the topological attack graph based on the vulnerable host and the rule node includes:

[0016] The rule nodes are divided into vulnerability rule nodes and protocol rule nodes based on rule information. The protocol rule nodes serve as reachable edges between the vulnerable hosts. The vulnerability rule nodes serve as nodes of the topology attack graph and are connected to the vulnerable hosts where the vulnerability rules exist based on the vulnerability rule information in the vulnerability rule nodes.

[0017] The above-mentioned close-range honey spot deployment method based on the attack graph, wherein the probability of the vulnerable host being successfully attacked is calculated based on the probability of the rule node, comprises:

[0018] The probability of the vulnerable host being successfully attacked is calculated based on the number of nodes in the topology attack graph to which the vulnerable host is connected and the probability of the rule nodes.

[0019] In the above-mentioned close-range honey spot deployment method based on the attack graph, the probability of the vulnerable host being successfully attacked is calculated using the following calculation formula:

[0020] P=1-Π m≥1 (1-P m );

[0021] Where P is the probability of the current vulnerable host being successfully attacked, P m It is the product of the probability of the mth topology attack graph node and the probability of the protocol rule node.

[0022] The close-range honey spot deployment method based on the attack graph as described above, wherein the minimum vertex cover set and the vertex centrality of each vertex are obtained based on the topological attack graph, includes: obtaining the minimum vertex cover set based on a greedy algorithm, wherein the connection between each vertex includes the reachable edges between all vulnerable hosts in the topological attack graph.

[0023] In the attack graph-based close-range honey spot deployment method as described above, the vertex centrality of each vertex is calculated based on a degree centrality algorithm.

[0024] In the above-mentioned close-range honey spot deployment method based on the attack graph, in the process of calculating the vulnerability host priority based on the probability of successful attack and the vertex centrality, the calculation formula is as follows:

[0025] PRI A =P A ×VC;

[0026] PRI A is the vulnerability host priority of vulnerable host A, P A is the probability of a successful attack on vulnerable host A, and VC is the vertex centrality of vertex A.

[0027] The beneficial effects of the close-range honey spot deployment optimization method proposed in the present invention are:

[0028] 1. The topological attack graph of the present invention can accurately predict the path and probability of vulnerability attacks, as well as the probability of successful attacks on vulnerable hosts.

[0029] 2. The vulnerability host priority of the present invention can more comprehensively cover the target network under the condition of limited close-in honeypot resources, thereby improving the resource utilization efficiency of close-in honeypots. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A flow chart of a close-range honey spot deployment method based on an attack graph provided in an embodiment of the present invention; DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0032] The embodiment of the present invention provides a close-range honey spot deployment method based on an attack graph, see Figure 1 ,include:

[0033] S1. Scan the target network to obtain vulnerability scanning results, and obtain multiple attack graph nodes and mutual relationship information of the attack graph nodes based on the vulnerability scanning results, wherein the attack graph nodes include fact nodes, derivation nodes and rule nodes;

[0034] S2, initializing the probability of the attack graph node, and updating the attack success probability of the rule node in the attack graph node based on the mutual relationship information;

[0035] S3, obtaining a vulnerable host in the target network based on the attack graph node, constructing a topological attack graph based on the vulnerable host and the rule node, and calculating the probability of the vulnerable host being attacked successfully based on the attack success probability of the rule node;

[0036] S4. Based on the topological attack graph, a minimum vertex cover set and the vertex centrality of each vertex are obtained, the vulnerable host priority is calculated based on the probability of successful attack and the vertex centrality, and close honey spots are deployed based on the vulnerable host priority.

[0037] In some embodiments, the process of executing step S1 includes:

[0038] Scan the target network using a vulnerability scanning tool to obtain vulnerability information and risk level of each host in the target network;

[0039] The vulnerability scanning result is converted into a Datalog language clause using a Mulval tool and input into the Mulval tool to generate an attack graph, thereby obtaining the attack graph nodes and the relationship information between the attack graph nodes.

[0040] In some embodiments, the process of executing step S2 includes:

[0041] S2.1, initializing the probability of attacking the graph nodes;

[0042] S2.2. Update the attack success probability of the rule node in the attack graph node based on the mutual relationship information.

[0043] Specifically, when executing step S2.1, initializing the probability of attacking the nodes of the graph, it includes:

[0044] The probability of the fact node and the derivation node is assigned a value of 1, and the probability of the rule node is obtained by calculating the availability score using a general vulnerability scoring system.

[0045] Specifically, in the process of calculating the availability score, the calculation formula is:

[0046] ES = 8.22 × AV × AC × PR × UI;

[0047] Among them, AV is the attack vector, AC is the attack complexity, PR is the permission requirement, and UI is the user interaction.

[0048] Specifically, when executing step S2.2, updating the attack success probability of the rule node in the attack graph node based on the mutual relationship information includes:

[0049] Based on the initial probability of the fact node and the mutual relationship information, the probability of the rule node is updated according to the Bayesian theorem.

[0050] In fact, the initial probability of the fact node as the initial parent node does not change, and the probabilities of the derivation node and the rule node are updated according to the mutual relationship information using the Bayesian formula.

[0051] Specifically, the Bayesian formula is as follows:

[0052]

[0053] P(A|B) represents the probability of a child node occurring under the condition that the parent node occurs, that is, the conditional probability;

[0054] P(B|A) represents the probability of the parent node occurring under the condition that the child node occurs;

[0055] P(A) is the initial probability of the child node, and P(B) is the initial probability of the parent node.

[0056] In some embodiments, the process of executing step S3 includes:

[0057] S3.1. Acquire vulnerable hosts in the target network based on the attack graph nodes, and construct a topological attack graph based on the vulnerable hosts and the rule nodes;

[0058] S3.2. Calculate the probability of the vulnerable host being attacked successfully based on the attack success probability of the rule node.

[0059] Specifically, when executing step S3.1, a topology attack graph is constructed based on the vulnerable host and the rule node, including:

[0060] The rule nodes are divided into vulnerability rule nodes and protocol rule nodes based on rule information. The protocol rule nodes serve as reachable edges between the vulnerable hosts. The vulnerability rule nodes serve as nodes of the topology attack graph and are connected to the vulnerable hosts where the vulnerability rules exist based on the vulnerability rule information in the vulnerability rule nodes.

[0061] In fact, the vulnerability rule node serves as the topology attack graph node, that is, assuming that the vulnerable host has been compromised, the topology attack graph node is a node that launches an attack on another vulnerable host with the same vulnerability rule. The topology attack graph can display the possible paths and success probabilities of the attacker's lateral movement.

[0062] Specifically, when executing step S3.2, the probability of the vulnerable host being successfully attacked is calculated based on the attack success probability of the rule node, including:

[0063] The probability of the vulnerable host being successfully attacked is calculated based on the number of nodes in the topology attack graph to which the vulnerable host is connected and the probability of the rule nodes.

[0064] Specifically, the probability of the vulnerable host being successfully attacked is calculated using the following formula:

[0065] P=1-Π m≥1 (1-P m );

[0066] Where P is the probability of the current vulnerable host being successfully attacked, P m It is the product of the probability of the mth topology attack graph node and the probability of the protocol rule node.

[0067] In some embodiments, the process of executing step S4 includes:

[0068] S4.1. Obtaining the vertex centrality of each vertex in the minimum vertex cover set based on the topological attack graph;

[0069] S4.2, calculating the vulnerability host priority based on the probability of successful attack and the vertex centrality;

[0070] S4.3. Deploy close-range honey spots based on the priority of the vulnerable hosts.

[0071] Specifically, when executing step S4.1, obtaining the minimum vertex cover set and the vertex centrality of each vertex based on the topological attack graph includes:

[0072] The minimum vertex cover set is obtained based on a greedy algorithm, wherein the connections between the vertices include reachable edges between all vulnerable hosts in the topological attack graph.

[0073] Furthermore, the vertex centrality of each vertex is calculated based on the degree centrality algorithm.

[0074] Specifically, the degree centrality algorithm calculation formula is:

[0075]

[0076] Among them, VC is the vertex centrality of the current vertex, k is the number of reachable edges connecting the vertex, and N is the total number of vertices.

[0077] Specifically, when executing step S4.2, the vulnerable host priority is calculated based on the probability of successful attack and the vertex centrality, and the calculation formula is as follows:

[0078] PRI A =P A ×VC;

[0079] PRI A is the vulnerability host priority of vulnerable host A, P A is the probability of a successful attack on vulnerable host A, and VC is the vertex centrality of vertex A.

[0080] In fact, the resources for deploying close-range honeypots are often limited. Deploying close-range honeypots based on the calculated vulnerability host priority can more comprehensively cover the target network, improve the target's defense effect, and improve the utilization efficiency of close-range honeypot resources.

[0081] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A close-range honeypot deployment method based on attack graph, It is characterized in that The following steps are involved: Scan the target network to obtain vulnerability scanning results, and obtain multiple attack graph nodes and mutual relationship information of the attack graph nodes based on the vulnerability scanning results, wherein the attack graph nodes include fact nodes, derivation nodes and rule nodes; Initializing the probability of the attack graph node, and updating the attack success probability of the rule node in the attack graph node based on the mutual relationship information; Acquire vulnerable hosts in the target network based on the attack graph nodes, construct a topological attack graph based on the vulnerable hosts and the rule nodes, and calculate the probability of successful attack on the vulnerable hosts based on the attack success probability of the rule nodes; Based on the topological attack graph, a minimum vertex cover set and the vertex centrality of each vertex are obtained, the vulnerable host priority is calculated based on the probability of successful attack and the vertex centrality, and close honey spots are deployed based on the vulnerable host priority.

2. According to the attack graph-based close-range honey spot deployment method of claim 1, It is characterized in that In the process of initializing the probability of the attack graph nodes, the probability of the fact nodes and the derivation nodes is assigned a value of 1, and the probability of the rule nodes is obtained by calculating the exploitability score using the general vulnerability scoring system.

3. According to the attack graph-based close-range honey spot deployment method of claim 2, It is characterized in that The probability of the rule node is calculated, and the availability score is calculated according to the following formula: ES = 8.22 × AV × AC × PR × UI; Among them, AV is the attack vector, AC is the attack complexity, PR is the permission requirement, and UI is the user interaction.

4. According to the attack graph-based close-range honey spot deployment method of claim 1, It is characterized in that Updating the probability of the rule node in the attack graph node based on the mutual relationship information includes: Based on the initial probability of the fact node and the mutual relationship information, the probability of the rule node is updated according to the Bayesian theorem.

5. According to the attack graph-based close-range honey spot deployment method of claim 1, It is characterized in that The process of constructing a topological attack graph based on the vulnerable host and the rule node includes: The rule nodes are divided into vulnerability rule nodes and protocol rule nodes based on rule information. The protocol rule nodes serve as reachable edges between the vulnerable hosts. The vulnerability rule nodes serve as nodes of the topology attack graph and are connected to the vulnerable hosts where the vulnerability rules exist based on the vulnerability rule information in the vulnerability rule nodes.

6. According to claim 5, a close-range honey spot deployment method based on attack graph, It is characterized in that Calculating the probability of the vulnerable host being successfully attacked based on the probability of the rule node includes: The probability of the vulnerable host being successfully attacked is calculated based on the number of nodes in the topology attack graph to which the vulnerable host is connected and the probability of the rule nodes.

7. A close-range honey spot deployment method based on attack graph according to claim 6, It is characterized in that Calculate the probability of the vulnerable host being successfully attacked. The calculation formula is as follows: P=1-∏ m ≥1(1-P m ); Where P is the probability of the current vulnerable host being successfully attacked, P m It is the product of the probability of the mth topology attack graph node and the probability of the protocol rule node.

8. According to claim 1, a close-range honey spot deployment method based on attack graph, It is characterized in that Based on the topological attack graph, a minimum vertex cover set and vertex centrality of each vertex are obtained, including: The minimum vertex cover set is obtained based on a greedy algorithm, wherein the connections between the vertices include reachable edges between all vulnerable hosts in the topological attack graph.

9. A close-range honey spot deployment method based on attack graph according to claim 8, It is characterized in that The process of calculating the vertex centrality of each vertex is based on the degree centrality algorithm.

10. According to the attack graph-based close-range honey spot deployment method of claim 1, It is characterized in that In the process of calculating the vulnerability host priority based on the probability of successful attack and the vertex centrality, the calculation formula is as follows: PRI A =P A ×VC; PRI A is the vulnerability host priority of vulnerable host A, P A is the probability of a successful attack on vulnerable host A, and VC is the vertex centrality of vertex A.

Images