A close-range honeypot deployment method based on attack graph

Abstract

The present invention provides a method for deploying close-range honey spots based on an attack graph, which relates to the technical field of deception defense resource deployment. The method for deploying close-range honey spots based on an attack graph includes the following steps: scanning a target network to obtain attack graph nodes and information about the relationship between the attack graph nodes; initializing and updating the attack success probability of the attack graph nodes; obtaining vulnerable hosts within the target network based on the attack graph nodes, and constructing a topological attack graph based on the vulnerable hosts and the attack graph nodes; calculating the priority of the vulnerable hosts based on the topological attack graph, and deploying close-range honey spots based on the priority of the vulnerable hosts. The present invention improves the efficiency of close-range honey spot resource utilization by studying the probability of a vulnerable host being attacked and analyzing the potential path of a vulnerable host moving laterally in the network topology structure, calculating the priority of the vulnerable host, and thus deploying close-range honey spots.

Description

Technical Field

[0001] The present invention relates to the field of deception defense resource deployment, and in particular to a close-range honeypot deployment method based on an attack graph. Background Art

[0002] A honey spot is a security tool built using simulation and trap technology. A proximity honey spot is deployed within the same network as the protected host. Its primary function is to detect suspicious attacks, thereby blocking attackers from accessing the protected system without impacting normal user experience. An attack graph is a model that represents the vulnerabilities of a network or information system. This graph can be used to analyze possible attack paths from border nodes to nodes requiring key protection, allowing for focused defense of high-risk nodes along the path to protect critical nodes.

[0003] Existing attack graph technology primarily builds by analyzing the impact relationships between vulnerabilities. Once a host with a vulnerability is observed, it is considered vulnerable to attack, resulting in low utilization of deployed honeypot resources. Therefore, a solution is urgently needed to improve this problem. Summary of the Invention

[0004] The purpose of the present invention is to provide a close-range honeypot deployment method based on an attack graph, which improves the accuracy of attack path inference and the problem of low efficiency of honeypot resource utilization in the prior art.

[0005] The present invention provides a close-range honeypot deployment method based on an attack graph, which adopts the following technical solutions:

[0006] Scanning a target network to obtain vulnerability scanning results, and obtaining a plurality of attack graph nodes and information about relationships between the attack graph nodes based on the vulnerability scanning results, wherein the attack graph nodes include fact nodes, derivation nodes, and rule nodes;

[0007] Initializing the probability of the attack graph nodes, and updating the attack success probability of the rule nodes in the attack graph nodes based on the mutual relationship information;

[0008] Acquire vulnerable hosts in the target network based on the attack graph nodes, construct a topological attack graph based on the vulnerable hosts and the rule nodes, and calculate the probability of successful attack on the vulnerable hosts based on the attack success probability of the rule nodes;

[0009] A minimum vertex cover set and the vertex centrality of each vertex are obtained based on the topological attack graph, the vulnerable host priority is calculated based on the probability of successful attack and the vertex centrality, and close honey spots are deployed based on the vulnerable host priority.

[0010] As described above, in the attack graph-based close-range honeypot deployment method, during the process of initializing the probability of the attack graph nodes, the probability of the fact nodes and the derivation nodes is assigned a value of 1, and the probability of the rule nodes is obtained by calculating the exploitability score using a universal vulnerability scoring system.

[0011] In the aforementioned attack graph-based close-range honeypot deployment method, the probability of the rule node is calculated, and the availability score is calculated according to the following formula:

[0012] ES = 8.22 × AV × AC × PR × UI;

[0013] AV is the attack vector, AC is the attack complexity, PR is the permission requirement, and UI is the user interaction.

[0014] As described above, the close-range honeyspot deployment method based on the attack graph, wherein the probability of the rule node in the attack graph node is updated based on the mutual relationship information, includes: based on the initial probability of the fact node and the mutual relationship information, updating the probability of the rule node according to Bayes' theorem.

[0015] The above-mentioned method for deploying close-range honeypots based on an attack graph, wherein the process of constructing a topological attack graph based on the vulnerable host and the rule node includes:

[0016] Based on the rule information, the rule nodes are divided into vulnerability rule nodes and protocol rule nodes. The protocol rule nodes serve as reachable edges between the vulnerability hosts. The vulnerability rule nodes serve as nodes in the topology attack graph and are connected to the vulnerability hosts where the vulnerability rules exist based on the vulnerability rule information in the vulnerability rule nodes.

[0017] The above-mentioned close-range honeypot deployment method based on the attack graph, wherein the probability of the vulnerable host being successfully attacked is calculated based on the probability of the rule node, includes:

[0018] The probability of the vulnerable host being successfully attacked is calculated based on the number of nodes in the topology attack graph to which the vulnerable host is connected and the probability of the rule nodes.

[0019] In the aforementioned attack graph-based close-range honeypot deployment method, the probability of a successful attack on the vulnerable host is calculated using the following formula:

[0020] P=1-Π m≥1 (1-P m );

[0021] Where P is the probability of the current vulnerable host being successfully attacked, P m It is the product of the probability of the mth topology attack graph node and the probability of the protocol rule node.

[0022] The close-range honey spot deployment method based on the attack graph as described above, wherein the minimum vertex cover set and the vertex centrality of each vertex are obtained based on the topological attack graph, includes: obtaining the minimum vertex cover set based on a greedy algorithm, wherein the connection between each vertex includes the reachable edges between all vulnerable hosts in the topological attack graph.

[0023] In the attack graph-based close-range honey spot deployment method, the vertex centrality of each vertex is calculated based on a degree centrality algorithm.

[0024] In the aforementioned attack graph-based close-range honeypot deployment method, in the process of calculating the vulnerability host priority based on the probability of successful attack and the vertex centrality, the calculation formula is as follows:

[0025] PRI A =P A ×VC;

[0026] PRI A is the vulnerability host priority of vulnerable host A, P A is the probability that vulnerable host A is successfully attacked, and VC is the vertex centrality of vertex A.

[0027] The beneficial effects of the close-range honeyspot deployment optimization method proposed in the present invention are:

[0028] 1. The topological attack graph of the present invention can accurately predict the path and probability of vulnerability attacks, as well as the probability of successful attacks on vulnerable hosts.

[0029] 2. The vulnerability host priority of the present invention can more comprehensively cover the target network under the condition of limited close-in honeypot resources, thereby improving the resource utilization efficiency of close-in honeypots. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A flow chart of a close-range honeypot deployment method based on an attack graph provided by an embodiment of the present invention; DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0032] The embodiment of the present invention provides a close honeypot deployment method based on an attack graph, see Figure 1 ,include:

[0033] S1. Scan the target network to obtain vulnerability scanning results, and obtain multiple attack graph nodes and relationship information between the attack graph nodes based on the vulnerability scanning results, wherein the attack graph nodes include fact nodes, derivation nodes, and rule nodes;

[0034] S2. Initialize the probability of the attack graph node, and update the attack success probability of the rule node in the attack graph node based on the mutual relationship information;

[0035] S3. Acquire vulnerable hosts in the target network based on the attack graph nodes, construct a topological attack graph based on the vulnerable hosts and the rule nodes, and calculate the probability of successful attack on the vulnerable hosts based on the attack success probability of the rule nodes;

[0036] S4. Obtain a minimum vertex cover set and the vertex centrality of each vertex based on the topological attack graph, calculate the vulnerable host priority based on the probability of successful attack and the vertex centrality, and deploy close honey spots based on the vulnerable host priority.

[0037] In some embodiments, the process of executing step S1 includes:

[0038] Scan the target network using a vulnerability scanning tool to obtain vulnerability information and risk level of each host in the target network;

[0039] The vulnerability scan result is converted into a Datalog language clause using a Mulval tool and input into the Mulval tool to generate an attack graph, thereby obtaining the attack graph nodes and the relationship information between the attack graph nodes.

[0040] In some embodiments, the process of executing step S2 includes:

[0041] S2.1. Initialize the probability of attacking the nodes of the graph;

[0042] S2.2. Update the attack success probability of the rule node in the attack graph node based on the mutual relationship information.

[0043] Specifically, when executing step S2.1, initializing the probability of attacking the graph nodes, it includes:

[0044] The probability of the fact node and the derivation node is assigned a value of 1, and the probability of the rule node is obtained by calculating the availability score using a universal vulnerability scoring system.

[0045] Specifically, in the process of calculating the availability score, the calculation formula is:

[0046] ES = 8.22 × AV × AC × PR × UI;

[0047] AV is the attack vector, AC is the attack complexity, PR is the permission requirement, and UI is the user interaction.

[0048] Specifically, when executing step S2.2, updating the attack success probability of the rule node in the attack graph node based on the mutual relationship information includes:

[0049] Based on the initial probabilities of the fact nodes and the mutual relationship information, the probabilities of the rule nodes are updated according to Bayes' theorem.

[0050] In fact, the initial probability of the fact node as the initial parent node does not change, and the probabilities of the derivation node and the rule node are updated using the Bayesian formula based on the mutual relationship information.

[0051] Specifically, the Bayesian formula is as follows:

[0052]

[0053] P(A|B) represents the probability of the child node occurring under the condition that the parent node occurs, that is, the conditional probability;

[0054] P(B|A) represents the probability of the parent node occurring under the condition that the child node occurs;

[0055] P(A) is the initial probability of the child node, and P(B) is the initial probability of the parent node.

[0056] In some embodiments, the process of executing step S3 includes:

[0057] S3.1. Obtain vulnerable hosts in the target network based on the attack graph nodes, and construct a topological attack graph based on the vulnerable hosts and the rule nodes;

[0058] S3.2. Calculate the probability of the vulnerable host being successfully attacked based on the attack success probability of the rule node.

[0059] Specifically, in step S3.1, a topology attack graph is constructed based on the vulnerable host and the rule node, including:

[0060] Based on the rule information, the rule nodes are divided into vulnerability rule nodes and protocol rule nodes. The protocol rule nodes serve as reachable edges between the vulnerability hosts. The vulnerability rule nodes serve as nodes in the topology attack graph and are connected to the vulnerability hosts where the vulnerability rules exist based on the vulnerability rule information in the vulnerability rule nodes.

[0061] In fact, the vulnerability rule node serves as the topology attack graph node. That is, assuming that the vulnerable host has been compromised, the topology attack graph node is a node that launches an attack on another vulnerable host with the same vulnerability rule. The topology attack graph can display the possible paths and success probabilities of the attacker's lateral movement.

[0062] Specifically, when executing step S3.2, the probability of the vulnerable host being successfully attacked is calculated based on the attack success probability of the rule node, including:

[0063] The probability of the vulnerable host being successfully attacked is calculated based on the number of nodes in the topology attack graph to which the vulnerable host is connected and the probability of the rule nodes.

[0064] Specifically, the probability of the vulnerable host being successfully attacked is calculated using the following formula:

[0065] P=1-Π m≥1 (1-P m );

[0066] Where P is the probability of the current vulnerable host being successfully attacked, P m It is the product of the probability of the mth topology attack graph node and the probability of the protocol rule node.

[0067] In some embodiments, the process of executing step S4 includes:

[0068] S4.1. Obtaining the vertex centrality of each vertex in the minimum vertex cover set based on the topological attack graph;

[0069] S4.2. Calculating the vulnerability host priority based on the probability of successful attack and the vertex centrality;

[0070] S4.3. Deploy close-range honeypots based on the priority of the vulnerable hosts.

[0071] Specifically, when executing step S4.1, obtaining the minimum vertex cover set and the vertex centrality of each vertex based on the topological attack graph includes:

[0072] A minimum vertex cover set is obtained based on a greedy algorithm, where the connections between vertices include reachable edges between all vulnerable hosts in the topological attack graph.

[0073] Furthermore, the vertex centrality of each vertex is calculated based on the degree centrality algorithm.

[0074] Specifically, the degree centrality algorithm calculation formula is:

[0075]

[0076] Wherein, VC is the vertex centrality of the current vertex, k is the number of reachable edges connecting the vertex, and N is the total number of vertices.

[0077] Specifically, when executing step S4.2, the vulnerable host priority is calculated based on the probability of successful attack and the vertex centrality, and the calculation formula is as follows:

[0078] PRI A =P A ×VC;

[0079] PRI A is the vulnerability host priority of vulnerable host A, P A is the probability that vulnerable host A is successfully attacked, and VC is the vertex centrality of vertex A.

[0080] In fact, the resources for deploying close-range honeypots are often limited. Deploying close-range honeypots based on the calculated priority of vulnerable hosts can more comprehensively cover the target network, improve the target's defense effect, and increase the utilization efficiency of close-range honeypot resources.

[0081] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A close-range honeypot deployment method based on an attack graph, characterized in that: The following steps are involved: Scanning a target network to obtain vulnerability scanning results, and obtaining a plurality of attack graph nodes and information about relationships between the attack graph nodes based on the vulnerability scanning results, wherein the attack graph nodes include fact nodes, derivation nodes, and rule nodes; Initializing the probability of the attack graph nodes, and updating the attack success probability of the rule nodes in the attack graph nodes based on the mutual relationship information; Acquire vulnerable hosts in the target network based on the attack graph nodes, construct a topological attack graph based on the vulnerable hosts and the rule nodes, and calculate the probability of successful attack on the vulnerable hosts based on the attack success probability of the rule nodes; Obtaining a minimum vertex cover set and vertex centrality of each vertex based on the topological attack graph, calculating the vulnerability host priority based on the probability of successful attack and the vertex centrality, and deploying close honeypots based on the vulnerability host priority; The process of constructing a topology attack graph based on the vulnerable host and the rule node includes: Based on the rule information, the rule nodes are divided into vulnerability rule nodes and protocol rule nodes. The protocol rule nodes serve as reachable edges between the vulnerability hosts. The vulnerability rule nodes serve as nodes in the topology attack graph and are connected to the vulnerability hosts where the vulnerability rules exist based on the vulnerability rule information in the vulnerability rule nodes.

2. The method for deploying close-range honeypots based on an attack graph according to claim 1, characterized in that: In the process of initializing the probability of the attack graph nodes, the probability of the fact nodes and the derivation nodes is assigned a value of 1, and the probability of the rule nodes is obtained by calculating the exploitability score using a universal vulnerability scoring system.

3. The method for deploying close-range honeypots based on an attack graph according to claim 2, characterized in that: The probability of the rule node is calculated, and the availability score is calculated according to the following formula: ； AV is the attack vector, AC is the attack complexity, PR is the permission requirement, and UI is the user interaction.

4. The method for deploying close-range honeypots based on an attack graph according to claim 1, characterized in that: Updating the probability of rule nodes in the attack graph nodes based on the mutual relationship information includes: Based on the initial probabilities of the fact nodes and the mutual relationship information, the probabilities of the rule nodes are updated according to Bayes' theorem.

5. The method for deploying close-range honeypots based on an attack graph according to claim 1, characterized in that: Calculating the probability of the vulnerable host being successfully attacked based on the attack success probability of the rule node includes: The probability of the vulnerable host being successfully attacked is calculated based on the number of nodes in the topology attack graph to which the vulnerable host is connected and the attack success probability of the rule node.

6. The method for deploying close-range honeypots based on an attack graph according to claim 5, characterized in that: Calculate the probability of the vulnerable host being successfully attacked. The calculation formula is as follows: ； in is the probability of the current vulnerable host being successfully attacked, It is the product of the probability of the mth topology attack graph node and the probability of the protocol rule node.

7. The method for deploying close-range honeypots based on an attack graph according to claim 1, characterized in that: Obtaining a minimum vertex cover set and vertex centrality of each vertex based on the topological attack graph includes: A minimum vertex cover set is obtained based on a greedy algorithm, where the connections between vertices include reachable edges between all vulnerable hosts in the topological attack graph.

8. The method for deploying close-range honeypots based on an attack graph according to claim 7, characterized in that: The process of calculating the vertex centrality of each vertex is based on the degree centrality algorithm.

9. The method for deploying close-range honeypots based on an attack graph according to claim 1, characterized in that: In the process of calculating the vulnerability host priority based on the probability of successful attack and the vertex centrality, the calculation formula is as follows: ； in is the vulnerability host priority of vulnerable host A, is the probability of a successful attack on vulnerable host A, is the vertex centrality of vertex A.

Images