Dynamic honeypot deployment method and system based on attack graph and Shapley value

Abstract

The present invention provides a dynamic honeypot deployment method and system based on an attack graph and Shapley values. The method comprises: scanning and probing the protected network at first preset intervals; constructing an attack graph corresponding to the current network environment of the protected network based on the scanning and probing results; calculating the probability of exploitation of each vulnerability within each edge in the attack graph based on the CVSS rating, and defining the difficulty of attacking each edge; calculating the probability of realization of the attack path based on the difficulty of attacking each edge, and obtaining the expected loss of each attack path in the attack graph; constructing a game model, and solving the Shapley value of each edge based on the Monte Carlo method; and sorting all edges in the attack graph based on the Shapley value of each edge to generate an optimal honeypot deployment strategy based on the edge sorting results. The present invention can dynamically adjust the honeypot deployment strategy based on the real-time network security situation during the attack and defense process.

Description

Technical Field

[0001] The present invention relates to the field of network security protection technology, and in particular to a dynamic honeypot deployment method and system based on attack graphs and Shapley values. Background Art

[0002] In a network security system centered around a "self-defense mode," attackers and defenders engage in a game of information asymmetry. Attackers gather information about the target network through reconnaissance, analyze it, and develop strategies to infiltrate the network. In this self-defense mode, defenders are largely passive, making it difficult to detect attackers in advance, especially when responding to advanced persistent threat (APT) attacks.

[0003] The "Guardian Mode" cybersecurity system, exemplified by the "Four Honey" system, employs a proactive defense philosophy guided by the principles of "deception, trapping, and detection." This shifts the focus of existing cybersecurity systems from the security of the protected entities to the detection and blocking of attackers, enhancing the ability to detect and deter highly covert attacks.

[0004] In the "Four Honeys" system, honeypots are a key means of threat awareness. By deploying a large number of honeypots, such as traps and tripwires, around protected systems, the system proactively detects security threats in a comprehensive, multi-layered manner. The strategic deployment of honeypots is crucial for improving threat awareness. If honeypots are deployed on commonly used paths, legitimate users can easily access them, leading network operations personnel to misjudge network status and potentially impact legitimate users' access to legitimate systems. If honeypots are deployed too frequently or too densely, they not only consume excessive resources but also lead to excessive and redundant log information, requiring operations personnel to expend significant effort to identify useful information, reducing the effectiveness of the honeypots. Excessive honeypots also complicate their management. If there are too few honeypots, or if they are not deployed on critical paths, threat awareness is low, system defenses are weak, and APT attacks cannot be detected promptly. If the deployment of honeypots is static, attackers, once identified, will attempt to circumvent them to avoid detection. If the target network changes while the honeypots remain unchanged, the honeypots no longer accurately simulate the real system, making them easily identified by attackers. Summary of the Invention

[0005] The purpose of the present invention is to provide a dynamic honeypot deployment method and system based on attack graph and Shapley value, aiming to solve the problem that the static deployment of honeypots can be easily identified by attackers, resulting in poor protection effect of the protected network.

[0006] In a first aspect, the present invention provides a dynamic honeypot deployment method based on an attack graph and Shapley value, the method comprising:

[0007] Scanning and probing the protected network at first preset intervals to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information;

[0008] Constructing an attack graph corresponding to the current network environment of the protected network based on the scanning and probing results, calculating the probability of exploitation of each vulnerability in each edge in the attack graph based on the CVSS evaluation, and defining the difficulty of attacking each edge based on the probability of exploitation of each vulnerability;

[0009] Calculate the probability of an attack path being realized according to the difficulty of attacking each edge, and obtain the expected loss of each attack path in the attack graph based on the probability of an attack path being realized;

[0010] A game model is constructed, and each edge in the attack graph is defined as a player in the game model. The Shapley value of each edge is solved based on the Monte Carlo method, and all edges in the attack graph are sorted according to the Shapley value of each edge to generate an optimal honey spot deployment strategy based on the edge sorting results.

[0011] Furthermore, the step of scanning and probing the protected network at first preset intervals to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information, comprises:

[0012] Perform vulnerability scans on the structure of the protected network to obtain information on open ports, services, operating system types and architectures, asset information, configuration errors, and vulnerabilities in the protected network;

[0013] The scanned information is stored in a JSON file, and the JSON file is converted into an input.in file.

[0014] Furthermore, the steps of constructing an attack graph corresponding to the current network environment of the protected network based on the scanning and probing results, calculating the probability of exploitation of each vulnerability in each edge in the attack graph based on the CVSS evaluation, and defining the difficulty of attacking each edge based on the probability of exploitation of each vulnerability include:

[0015] The probability of each vulnerability being exploited is calculated using the following formula:

[0016] ,

[0017] Among them, P represents the probability of the vulnerability being exploited, represents the attack path evaluation index, represents the attack complexity evaluation index, Indicates the certification evaluation index;

[0018] The probability of exploitation of each vulnerability in each edge is ranked by difficulty, and the maximum probability corresponding to the difficulty of each edge is obtained according to the difficulty ranking result, and the maximum probability is used as the difficulty of attacking each edge.

[0019] Furthermore, the step of calculating the realization probability of the attack path according to the difficulty of attacking each edge, and obtaining the expected loss of each attack path in the attack graph based on the realization probability of the attack path includes:

[0020] The probability of achieving the attack path is calculated according to the following formula:

[0021] ,

[0022] in, represents the realization probability of the j-th attack path, represents the difficulty of attacking the i-th edge in attack path j, and n represents the total number of edges contained in the j-th attack path;

[0023] The expected loss of each attack path is calculated according to the following formula:

[0024] ,

[0025] in, represents the expected loss of the jth attack path, x represents the total number of hosts on a path, represents the expected loss of the i-th host;

[0026] The expected loss of each host is calculated using the following formula:

[0027] ,

[0028] in, represents the expected loss of the i-th host, represents the value of the i-th host, represents the probability that the i-th host is compromised;

[0029] The probability of each host being compromised is calculated using the following formula:

[0030] ,

[0031] in, It represents the probability that the i-th host will not be compromised.

[0032] Furthermore, the steps of obtaining the value of each host include:

[0033] Obtaining asset importance attributes of each host, wherein the asset importance attributes include confidentiality, integrity, and availability;

[0034] Each asset importance attribute is divided into several levels, and an importance value is defined for each level under each asset importance attribute, and the importance value is bound to the level to construct an asset importance attribute value evaluation table;

[0035] Obtain the target host's level identifier in each asset importance attribute, and query the asset importance attribute value evaluation table based on the level identifier to obtain the importance value of each asset importance attribute in the target host, and calculate the host's value according to the following formula:

[0036] ,

[0037] in, represents the importance assigned to the i-th host under confidentiality, represents the importance assigned to the i-th host under integrity, Represents the importance assigned to the i-th host under availability.

[0038] Furthermore, the steps of constructing a game model, defining each edge in the attack graph as a player in the game model, and solving the Shapley value of each edge based on the Monte Carlo method include:

[0039] Set the total number of sampling times. Each time a random function is used to generate a random permutation from 1 to m to represent the order in which edges are added. Then, these edges are added to the attack graph in sequence. During the addition process, the marginal contribution of each edge in the sequence is calculated.

[0040] For each participant, its marginal contribution in all samples is accumulated and the average is finally taken as the Shapley value.

[0041] Furthermore, the step of sorting all edges in the attack graph according to the Shapley value of each edge to generate an optimal honey spot deployment strategy according to the edge sorting result includes:

[0042] Sort the Shapley value of each edge from large to small to get the edge ranking from high to low;

[0043] Deploy honeypot resources in descending order of edge hazard severity.

[0044] In a second aspect, the present invention provides a dynamic honeypot deployment system based on an attack graph and Shapley value, the system comprising:

[0045] a scanning and probing module, configured to scan and probe the protected network at a first preset time interval to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information;

[0046] a CVSS evaluation module, configured to construct an attack graph corresponding to the current network environment of the protected network based on the scanning and probing results, calculate the probability of exploitation of each vulnerability within each edge in the attack graph based on the CVSS evaluation, and define the difficulty of attacking each edge based on the probability of exploitation of each vulnerability;

[0047] An expected loss calculation module, configured to calculate the probability of achieving an attack path according to the difficulty of attacking each edge, and obtain the expected loss of each attack path in the attack graph based on the probability of achieving the attack path;

[0048] A decision module is used to construct a game model, define each edge in the attack graph as a player in the game model, solve the Shapley value of each edge based on the Monte Carlo method, and sort all edges in the attack graph according to the Shapley value of each edge to generate an optimal honey spot deployment strategy based on the edge sorting results.

[0049] In a third aspect, the present invention provides a readable storage medium storing one or more programs, which, when executed by a processor, implement the above-mentioned dynamic honey spot deployment method based on attack graph and Shapley value.

[0050] In a fourth aspect, the present invention provides a computer device, comprising a memory and a processor, wherein:

[0051] The memory is used to store computer programs;

[0052] When the processor is used to execute the computer program stored in the memory, the above-mentioned dynamic honey spot deployment method based on the attack graph and Shapley value is implemented.

[0053] Compared with the prior art, the present invention has the following advantages:

[0054] 1. The present invention uses an attack graph to model the protected network. From the global perspective of the protected network, the difficulty of exploiting the vulnerabilities on the edges in the attack graph, the key assets that the edges can reach, and the topological position in the network are comprehensively considered to analyze the global destructiveness of the edges in the attack graph. The protected network is modeled using cooperative games, and honeypot deployment decisions are made based on the degree of damage the edges cause to the overall system. Based on the attacker's perspective, the expected benefits of the attacker are quantified by combining asset distribution and host probability attack graphs. In cooperative games, the edges in the attack graph are regarded as players in the game, and they cooperate to achieve the attacker's expected benefits. The Shapley value is used to calculate the contribution of each edge to the expected benefits. This value is the degree of damage the edge causes to the system as a whole.

[0055] 2. Since the Shapley value is the only method for calculating profit distribution that possesses the four properties of symmetry, efficiency, redundancy, and linearity, this method can unbiasedly calculate the degree of damage each edge causes to the system as a whole by using the Shapley value in the cooperative game to calculate the profit of each edge in the attack graph to the attacker.

[0056] 3. The present invention unbiasedly calculates the degree of damage each edge causes to the entire system. In scenarios with limited resources, it can patch vulnerabilities on the most harmful edges and deploy honeypots on the most harmful edges based on limited resources, thereby maximizing the utility of existing resources.

[0057] 4. The present invention can dynamically adjust the host summary attack graph based on the discovered attacker traces, and dynamically adjust the honey spots based on the degree of damage to the system as a whole by the edges in the real-time attack graph according to the changes in the network situation, thereby achieving adaptive strategy optimization. Specifically, since there may be vulnerabilities in the network that are not discovered during active vulnerability scanning, such as zero-day vulnerabilities, when the attacker infiltrates the system through these vulnerabilities, the relative position of each edge in the attack graph will also change, and the degree of damage to the system by each edge may also change. Therefore, when the attacker's traces are found in the system, the present invention can determine the host that has been infiltrated by the attacker based on the status of the alarm information, adjust the attacker graph based on this information, recalculate the degree of damage to the system by the edges, optimize the deployment of honey spots, and achieve adaptive adjustment of the deployment of honey spots based on the real-time network security situation. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is a flow chart of a dynamic honeypot deployment method based on attack graph and Shapley value proposed in one embodiment of the present invention;

[0059] Figure 2 A detailed diagram of step S104 in one embodiment of the present invention;

[0060] Figure 3 Schematic diagram of the structure of a dynamic honeypot deployment system based on attack graph and Shapley value proposed in one embodiment of the present invention.

[0061] The following specific embodiments will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0063] The technical term "deception defense" refers to a proactive defense strategy that lures attackers into fake environments or tricks them into taking specific actions, enabling timely detection and response to potential cyber threats. Compared to traditional defenses, it goes beyond passively monitoring and blocking attacks. Instead, it actively tricks attackers into revealing their intentions and techniques by creating fake network resources, decoy systems, or decoy documents.

[0064] Regarding technical terms, an "attack graph" is a graphical tool commonly used in network security to depict potential attack paths and vulnerabilities in computer networks. Starting from the perspective of an intruder, it analyzes the network environment and vulnerability information to enumerate all intrusion paths in a graph, visually demonstrating the causal relationships between different attack steps and the potential threats posed by vulnerability exploitation. An attack graph typically consists of nodes and edges. Nodes represent various entities in the network, such as hosts, servers, and routers, while edges represent the connections or dependencies between them. It can help security professionals identify weaknesses and vulnerabilities in the network, understand potential attack paths that attackers may exploit, and evaluate the impact of different attack strategies. A probabilistic attack graph adds probability values ​​to the nodes and edges of a traditional attack graph to quantify the likelihood of an attack success, thereby calculating the probability of an attack path occurring and the probability of a node being compromised.

[0065] Furthermore, the attack graph can be represented by G = {N,E,P,V}, where N represents the set of nodes in the graph, including the initial attack node Nattack and the hosts Nhost in the network. E = {E1,E2,…,Em} represents the set of edges, representing possible attack paths, and m represents the number of edges. If there is at least one vulnerability that allows an attacker to penetrate from host1 to host2, there will be an edge from host1 to host2. P = {p1,p2,…,pm} represents the set of edge probabilities, indicating the likelihood of penetrating from one host to another; larger values ​​indicate greater ease. V = {v1,v2,…,vn} represents the set of host values, representing the quantified asset value of a host. Larger values ​​indicate greater importance of the host, and n represents the number of hosts. In particular, v1 = 0 because the attacker's host has no asset value to the protected network.

[0066] Regarding the technical term "cooperative game," also known as a positive-sum game, it refers to a game in which, under certain rules or constraints, the parties reach a consensus through negotiation and consultation, resulting in a mutually beneficial solution. This type of game is characterized by participants recognizing that cooperation can create greater overall benefits and being willing to sacrifice some of their own personal interests. In cooperative games, participants typically form alliances or groups to maximize their shared interests through collective action. The Shapley value is a concept in cooperative game theory, first proposed by Lloyd Shapley in 1951 and awarded the Nobel Prize in Economics in 2012. It is a method for measuring the contribution of each participant to the overall success of a cooperative game. The core concept of the Shapley value is to distribute rewards or benefits based on the contribution of each participant to the overall cooperative process. The advantage of the Shapley value is that it accurately measures the contribution of each participant to the overall cooperative process, thereby ensuring a fair distribution of rewards or benefits. Weber proved that the Shapley value is the only attribution method with the following properties: 1) Symmetry: The distribution of cooperative gains does not change with the sign or order of each person in the cooperation. 2) Efficiency: The sum of the gains of the cooperating parties is equal to the cooperative gain. 3) Redundancy: If a member does not contribute to any cooperative alliance in which he participates, he should not benefit from the overall cooperation. 4) Linearity: If the reward of a game u satisfies u(S) = v(S) + w(S), where v and w are two other games, then the Shapley value of each player i in game u is the sum of the Shapley values ​​of player i in games v and w. The Shapley value formula is as follows:

[0067] ,

[0068] in represents the Shapley value of participant i, represents the set of participants, Represents the number of set elements of participants, yes A subset of yes The number of subsets of Indicates cooperative combination The Shapley Value calculation steps are as follows: 1) Consider all possible alliances: Alliances are different combinations of cooperating members, including subsets containing different members. 2) Calculate the marginal contribution: For each member i, the Shapley Value calculates the marginal contribution of member i to the alliance. Marginal contribution represents the incremental contribution of member i to the alliance. 3) Weighted sum: The marginal contribution of each member is weighted and summed using a weighting factor.

[0069] Regarding the technical term "honeypot," as a deception defense technology, it is fundamentally different from traditional honeypots. Honeypots have some obvious known vulnerabilities to lure attackers to launch attacks. The templates they generate are relatively simple and cannot meet the needs of high-threat scenarios and environments with high security requirements. Honeypots can perform highly realistic simulations based on the target system's network environment and surrounding service configurations. They do not contain vulnerabilities themselves and are not intended to attract attackers. Instead, they set a trap for attackers. For those more subtle attackers, once they touch a honeypot, it is an act that requires high alert. At the same time, it improves the ability to perceive risks in advance and timely prepare for the next step of defense.

[0070] The applicant discovered that existing research on the deployment of deception defense resources often involves deploying a large number of honeypots, honeynet probes, etc. in the protected network to increase the possibility of discovering attacker traces. However, blindly pursuing the number of deception defense resources deployed will not only cause excessive resource consumption and increased costs for the defender, but also a large amount of repeated and redundant alarm information will increase pressure on network operation and maintenance and increase management complexity. Network operation and maintenance personnel need to spend extra time to identify useful information. Moreover, not all cases allow the deployment of a large number of deception defense resources. When resources are limited, the defender can only maximize the effectiveness of deploying deception defense within limited resources.

[0071] Furthermore, existing deception defense products are limited in their ability to simulate services, making them easily identified by attackers after long-term deployment in a network. Advanced APT groups can even use honeypots to stage feints, using traces left behind by the honeypots to confuse defenders. Therefore, when deploying deception defense systems to detect hidden attackers, they must continuously adjust and adapt their strategies based on the network security landscape during both attack and defense.

[0072] Based on this, the present invention proposes a dynamic honey spot deployment method based on attack graph and Shapley value, which can not only calculate the overall damage degree of the system for each edge in the attack graph from a global perspective and optimize the honey spot deployment, but also dynamically adjust the honey spot deployment strategy according to the network security situation.

[0073] See also Figure 1 , which is a flow chart of a dynamic honey spot deployment method based on attack graph and Shapley value according to an embodiment of the present invention, includes steps S101 to S104, wherein:

[0074] Step S101: Scan and probe the protected network at a first preset time interval to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information;

[0075] It should be noted that the purpose of setting the first preset time is to continuously scan the protected network in real time, so as to continuously update the honey spot deployment strategy, thereby realizing a dynamic cycle of the honey spot deployment strategy.

[0076] In addition, the scanning and detection results mainly include open port information, services, operating system type and architecture, asset information, configuration error information, vulnerability information and other information in the protected network.

[0077] In some embodiments, network scanning tools are used to explore the network structure, and network defense devices such as intrusion detection systems are used to obtain known attacker information. This can be achieved using mainstream network exploration tools such as OpenVAS, Nmap, Nessus, and other vulnerability scanners. Scanning and exploration can obtain information about open ports, services, operating system types and architectures, asset information, configuration errors, and vulnerabilities in the protected network.

[0078] After probing the protected network, the collected information is stored in a JSON file and converted into an input.in file using a script. This file contains information about the protected network's hosts, the topological relationships between hosts, and vulnerability information, serving as input for generating the attack graph.

[0079] Step S102: constructing an attack graph corresponding to the current network environment of the protected network based on the scanning and probing results, calculating the probability of exploitation of each vulnerability in each edge of the attack graph based on the CVSS evaluation, and defining the difficulty of attacking each edge based on the probability of exploitation of each vulnerability;

[0080] It should be pointed out that in this step, after obtaining the probability of each vulnerability in each edge being exploited, the probability of each vulnerability in each edge being exploited is sorted by difficulty, and the maximum probability corresponding to the difficulty of each edge is obtained based on the difficulty sorting result, and the maximum probability is used as the difficulty of each edge being attacked, thereby completing the definition of the difficulty of each edge being attacked.

[0081] Step S103: Calculate the realization probability of the attack path according to the difficulty of attacking each edge, and obtain the expected loss of each attack path in the attack graph based on the realization probability of the attack path;

[0082] Step S104: Construct a game model, define each edge in the attack graph as a player in the game model, solve the Shapley value of each edge based on the Monte Carlo method, and sort all edges in the attack graph according to the Shapley value of each edge to generate an optimal honey spot deployment strategy based on the edge sorting results.

[0083] It's important to note that the Shapley value of an edge calculated in this step represents the attacker's contribution to the expected gain from penetrating the target. From the defender's perspective, it represents the degree of damage an edge causes to the entire system. Because the Shapley value is the only contribution calculation method that possesses the properties of symmetry, effectiveness, redundancy, and linearity, it can be used to unbiasedly calculate the degree of damage each edge causes to the entire system. Sorting edges by their Shapley value clearly displays their degree of damage from high to low. Finally, the optimal defense strategy (honeyspot deployment strategy) is generated based on available resources and edge damage levels.

[0084] Finally, based on this optimal honeypot deployment strategy, the honeypot policy is implemented and deployed within the network. Furthermore, by sorting edges and subsequently ranking their criticality, this optimal honeypot deployment strategy prioritizes repairing edges that pose the greatest risk to the system. Thanks to the lightweight and flexible deployment of honeypots, the environment near the desired honeypot can be simulated and seamlessly integrated into the network, implementing proactive defense.

[0085] In addition, after the deployment is completed, after the first preset time interval, it enters the next cycle, that is, continuously repeating the scanning and detection of the protected network so that the dynamically deployed deception defense devices can perceive the highly hidden threats in the system. In other words, the next stage can continue to optimize the honey spot deployment strategy based on the detection results, and then realize the dynamic deployment of honey spots.

[0086] In addition, in some optional embodiments, after obtaining the input.in file, the attack graph generation tool MulVAL can be used in combination with the CVE / NVD vulnerability information library to generate an attack graph in the current network environment.

[0087] In some optional embodiments, the specific process of evaluating the probability of each vulnerability being exploited based on CSAA is as follows:

[0088] First, using the CVSS scoring framework, we use the three metrics of Access Vector (AV), Access Complexity (AC), and Authentication (AU) to calculate the probability of a successful atomic attack using the atomic attack difficulty formula. In the host probabilistic attack graph, directed edges between attribute nodes represent the process of exploiting an atomic attack. The greater the difficulty of an atomic attack, the lower its probability of exploitation, with the two being inversely proportional. Therefore, the atomic attack difficulty can be represented by the calculation formula between attribute nodes (vulnerabilities) as follows:

[0089] ,

[0090] Among them, P represents the probability of the vulnerability being exploited, represents the attack path evaluation index, represents the attack complexity evaluation index, Indicates the certification evaluation index;

[0091] Furthermore, because the attack graph is constructed using vulnerability information, topology, and inter-host communication rules collected from the target network, in real networks, there may be more than one atomic attack capable of launching an attack from one host to another. According to the shortest plank effect, the vulnerability with the lowest attack difficulty among all the vulnerabilities that enable an attack from one host to another is the shortest plank and the attacker's most likely attack intention. Therefore, the atomic attack with the lowest attack difficulty is used as the difficulty level for launching an attack from one host to another.

[0092] Specifically, the probability of exploitation of each vulnerability within each edge is ranked by difficulty. Based on the difficulty ranking results, the maximum probability corresponding to each edge is obtained, and this maximum probability is used as the attack difficulty of each edge. It should be noted that a greater probability of exploitation indicates a lower attack difficulty. Based on this, the maximum probability among the exploitation probabilities of each vulnerability corresponds to the lowest attack difficulty. The maximum probability selected for each edge is then used as the attack difficulty of each edge, thereby achieving the difficulty of attacking from one host to another using the atomic attack with the lowest attack difficulty.

[0093] In some optional embodiments, the specific process of obtaining the expected loss of each attack path in the attack graph is as follows:

[0094] (1) Since the host attack graph intuitively displays all possible attack paths for an attacker to reach each host, the realization of a complete attack path requires the attacker to complete all inter-host penetrations in the path. Therefore, the probability of the attack path being realized is calculated according to the following formula:

[0095] ,

[0096] in, represents the realization probability of the j-th attack path, represents the difficulty of attacking the i-th edge in attack path j, and n represents the total number of edges contained in the j-th attack path;

[0097] (2) For a single host, an attacker only needs to implement one attack path to penetrate the host. Therefore, the probability of each host being compromised is calculated according to the following formula:

[0098] ,

[0099] in, It represents the probability that the i-th host will not be compromised.

[0100] (3) The ultimate goal of the attacker is to cause losses to the protected system. The expected loss is the possible loss caused by the risk assessment. The expected loss of a single host is related to its probability of being attacked and its own value. Therefore, the expected loss of each host is calculated according to the following formula:

[0101] ,

[0102] in, represents the expected loss of the i-th host, represents the value of the i-th host, represents the probability that the i-th host is compromised;

[0103] (4) For an attack path on the host attack graph, the expected loss is the sum of the expected losses of all hosts on the path. Therefore, the expected loss of each attack path is calculated according to the following formula:

[0104] ,

[0105] in, represents the expected loss of the jth attack path, x represents the total number of hosts on a path, represents the expected loss of the i-th host;

[0106] Furthermore, in some embodiments, the steps of obtaining the value of each host are as follows:

[0107] (1) In order to obtain the value of each host, it is also necessary to obtain the asset importance attributes of each host, which include confidentiality, integrity, and availability;

[0108] (2) Divide each asset importance attribute into several levels, define an importance value for each level under each asset importance attribute, and bind the importance value to the level to construct an asset importance attribute value evaluation table;

[0109] (3) Obtain the target host's level identification in each asset importance attribute, and query the asset importance attribute value evaluation table based on the level identification to obtain the importance value of each asset importance attribute in the target host, and calculate the value of the host according to the following formula:

[0110] ,

[0111] in, represents the importance assigned to the i-th host under confidentiality, represents the importance assigned to the i-th host under integrity, Represents the importance assigned to the i-th host under availability.

[0112] As an example, not a limitation, based on the security requirements of different hosts and in accordance with the national standard "Information Security Risk Assessment Specification," each host's asset importance attribute is divided into five levels: L1, L2, L3, L4, and L5. The asset importance attribute value evaluation table is shown in Table 1 below.

[0113] Table 1 Asset importance attribute value evaluation table

[0114] ,

[0115] Furthermore, it should be noted that in the network risk analysis method based on attack graphs and Shapley values ​​involved in this embodiment, while the attack graph can display the attacker's possible attack paths, it can only be constructed based on known vulnerabilities in the system. When an attacker uses zero-day vulnerabilities or other means to infiltrate the system, adjustments are made based on clues discovered in the protected system to dynamically assess the threat in the system. Specifically, when a defense device such as a HIDS detects traces of an attacker on a host in the system and determines that the host has been compromised, the attacker assumes that subsequent attacks can directly use this point as a starting point to infiltrate other nodes. The host found to have been compromised is then marked as an evidence host and added to the starting point set. Nodes in the starting point set, like node 1, can be directly used as starting points for attack paths in subsequent risk analysis. Furthermore, the value of these hosts in the attack graph is reduced to 0.

[0116] In some optional embodiments, see Figure 2 , step S104 specifically includes:

[0117] Step S1041: Set the total number of sampling times. Each time a random function is used to generate a random permutation from 1 to m to represent the order in which edges are added. These edges are then added to the attack graph in sequence. During the addition process, the marginal contribution of each edge in the sequence is calculated.

[0118] Step S1042: For each participant, accumulate its marginal contribution in all samples, and finally take the average value as the Shapley value.

[0119] It should be noted that calculating the Shapley value of each edge requires determining its contribution to the boundaries of all sequences. This has exponential time complexity and is an NP-Complete problem. Therefore, in practice, the Monte Carlo method is used to estimate the Shapley value.

[0120] Specifically, the attack graph is used to model the game, calculating the Shapley value of each edge's contribution to the attacker's payoff, thereby generating an optimal honeypot deployment strategy. The main implementation details are as follows: First, a cooperative game model is constructed for the entire system. Each edge represents a player in the game, who collaborate to enable the attacker to infiltrate the target node and thereby obtain the expected payoff. Each player's contribution to the cooperation is calculated using the Shapley value in the cooperative game. The algorithm for solving the Shapley value has a time complexity of O(N*2N), which cannot be solved within polynomial time. Therefore, it can only be solved for small networks. To make this method applicable to networks of any size, it uses the Monte Carlo method to approximate the Shapley value of each edge. The specific estimation method is: for each edge, random samples are taken X times. Each sample generates a random permutation, and the marginal utility of the current edge in that permutation is calculated. For example, if a set of five elements has the permutation {1,5,4,3,2} generated by a sampling, the marginal utility of element 3 in this permutation is v({1,5,4,3})-v({1,5,4}). The Shapley value of a node is the average of the marginal benefits calculated for each random sampling. From the attacker's perspective, the Shapley value of an edge represents the expected benefit of each edge in penetrating the target. From the defender's perspective, it represents the degree of damage a vulnerability poses to the entire system. Because the Shapley value is the only contribution calculation method that possesses the properties of symmetry, efficiency, redundancy, and linearity, it can be used to unbiasedly calculate the degree of damage each edge poses to the overall system. Sorting edges according to their Shapley value clearly displays the degree of damage from high to low. Finally, the optimal defense strategy is generated based on available resources and the degree of damage to the edge.

[0121] In summary, the above-mentioned dynamic honeypot deployment method based on attack graph and Shapley value has the following advantages:

[0122] 1. The present invention uses an attack graph to model the protected network. From the global perspective of the protected network, the difficulty of exploiting the vulnerabilities on the edges in the attack graph, the key assets that the edges can reach, and the topological position in the network are comprehensively considered to analyze the global destructiveness of the edges in the attack graph. The protected network is modeled using cooperative games, and honeypot deployment decisions are made based on the degree of damage the edges cause to the overall system. Based on the attacker's perspective, the expected benefits of the attacker are quantified by combining asset distribution and host probability attack graphs. In cooperative games, the edges in the attack graph are regarded as players in the game, and they cooperate to achieve the attacker's expected benefits. The Shapley value is used to calculate the contribution of each edge to the expected benefits. This value is the degree of damage the edge causes to the system as a whole.

[0123] 2. Since the Shapley value is the only method for calculating profit distribution that possesses the four properties of symmetry, efficiency, redundancy, and linearity, this method can unbiasedly calculate the degree of damage each edge causes to the system as a whole by using the Shapley value in the cooperative game to calculate the profit of each edge in the attack graph to the attacker.

[0124] 3. The present invention unbiasedly calculates the degree of damage each edge causes to the entire system. In scenarios with limited resources, it can patch vulnerabilities on the most harmful edges and deploy honeypots on the most harmful edges based on limited resources, thereby maximizing the utility of existing resources.

[0125] 4. The present invention can dynamically adjust the host summary attack graph based on the discovered attacker traces, and dynamically adjust the honey spots based on the degree of damage to the system as a whole by the edges in the real-time attack graph according to the changes in the network situation, thereby achieving adaptive strategy optimization. Specifically, since there may be vulnerabilities in the network that are not discovered during active vulnerability scanning, such as zero-day vulnerabilities, when the attacker infiltrates the system through these vulnerabilities, the relative position of each edge in the attack graph will also change, and the degree of damage to the system by each edge may also change. Therefore, when the attacker's traces are found in the system, the present invention can determine the host that has been infiltrated by the attacker based on the status of the alarm information, adjust the attacker graph based on this information, recalculate the degree of damage to the system by the edges, optimize the deployment of honey spots, and achieve adaptive adjustment of the deployment of honey spots based on the real-time network security situation.

[0126] See also Figure 3 , which is a schematic diagram of the structure of a dynamic honeypot deployment system based on attack graph and Shapley value in one embodiment of the present invention, the system includes:

[0127] a scanning and probing module, configured to scan and probe the protected network at a first preset time interval to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information;

[0128] a CVSS evaluation module, configured to construct an attack graph corresponding to the current network environment of the protected network based on the scanning and probing results, calculate the probability of exploitation of each vulnerability within each edge in the attack graph based on the CVSS evaluation, and define the difficulty of attacking each edge based on the probability of exploitation of each vulnerability;

[0129] An expected loss calculation module, configured to calculate the probability of achieving an attack path according to the difficulty of attacking each edge, and obtain the expected loss of each attack path in the attack graph based on the probability of achieving the attack path;

[0130] A decision module is used to construct a game model, define each edge in the attack graph as a player in the game model, solve the Shapley value of each edge based on the Monte Carlo method, and sort all edges in the attack graph according to the Shapley value of each edge to generate an optimal honey spot deployment strategy based on the edge sorting results.

[0131] Another aspect of the present invention further provides a readable storage medium having one or more programs stored thereon, which, when executed by a processor, implements the above-mentioned dynamic honey spot deployment method based on attack graph and Shapley value.

[0132] On the other hand, the present invention also proposes a computer device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the above-mentioned dynamic honey spot deployment method based on attack graph and Shapley value.

[0133] Those skilled in the art will appreciate that the logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device), or in conjunction with such instruction execution system, apparatus, or device. For purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transmit a program for use by an instruction execution system, apparatus, or device, or in conjunction with such instruction execution system, apparatus, or device.

[0134] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting, or processing it in another suitable manner as necessary, and then storing it in a computer memory.

[0135] It should be understood that various components of the present invention may be implemented using hardware, software, firmware, or a combination thereof. In the aforementioned embodiments, multiple steps or methods may be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one or a combination of the following technologies known in the art may be used: a discrete logic circuit having logic gate circuits for implementing logic functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field-programmable gate array (FPGA), etc.

[0136] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A dynamic honeypot deployment method based on attack graph and Shapley value, characterized in that: The method comprises: Scanning and probing the protected network at first preset intervals to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information; Constructing an attack graph corresponding to the current network environment of the protected network based on the scanning and probing results, calculating the probability of exploitation of each vulnerability in each edge in the attack graph based on the CVSS evaluation, and defining the difficulty of attacking each edge based on the probability of exploitation of each vulnerability; Calculate the probability of an attack path being realized according to the difficulty of attacking each edge, and obtain the expected loss of each attack path in the attack graph based on the probability of an attack path being realized; Constructing a game model, defining each edge in the attack graph as a player in the game model, solving the Shapley value of each edge based on the Monte Carlo method, and sorting all edges in the attack graph according to the Shapley value of each edge, so as to generate an optimal honey spot deployment strategy according to the edge sorting result; The steps of calculating the realization probability of the attack path according to the difficulty of attacking each edge, and obtaining the expected loss of each attack path in the attack graph based on the realization probability of the attack path include: The probability of achieving the attack path is calculated according to the following formula: ， in, represents the realization probability of the j-th attack path, represents the difficulty of attacking the i-th edge in attack path j, and n represents the total number of edges contained in the j-th attack path; The expected loss of each attack path is calculated using the following formula: ， in, represents the expected loss of the jth attack path, x represents the total number of hosts on a path, represents the expected loss of the i-th host; The expected loss of each host is calculated using the following formula: ， in, represents the expected loss of the i-th host, represents the value of the i-th host, represents the probability that the i-th host is compromised; The probability of each host being compromised is calculated using the following formula: ， in, It represents the probability that the i-th host will not be compromised.

2. The dynamic honeypot deployment method based on attack graph and Shapley value according to claim 1 is characterized in that: The step of scanning and probing the protected network at first preset intervals to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information, comprises: Perform vulnerability scans on the structure of the protected network to obtain information on open ports, services, operating system types and architectures, asset information, configuration errors, and vulnerabilities in the protected network; The scanned information is stored in a JSON file, and the JSON file is converted into an input.in file.

3. The dynamic honeypot deployment method based on attack graph and Shapley value according to claim 1, characterized in that: The steps of constructing an attack graph corresponding to the current network environment of the protected network based on the scanning and probing results, calculating the probability of exploitation of each vulnerability in each edge in the attack graph based on the CVSS evaluation, and defining the difficulty of attacking each edge based on the probability of exploitation of each vulnerability include: The probability of each vulnerability being exploited is calculated using the following formula: ， Among them, P represents the probability of the vulnerability being exploited, represents the attack path evaluation index, represents the attack complexity evaluation index, Indicates the certification evaluation index; The probability of exploitation of each vulnerability in each edge is ranked by difficulty, and the maximum probability corresponding to the difficulty of each edge is obtained according to the difficulty ranking result, and the maximum probability is used as the difficulty of attacking each edge.

4. The dynamic honeypot deployment method based on attack graph and Shapley value according to claim 1, characterized in that: The steps to obtain the value of each host include: Obtaining asset importance attributes of each host, wherein the asset importance attributes include confidentiality, integrity, and availability; Each asset importance attribute is divided into several levels, and an importance value is defined for each level under each asset importance attribute, and the importance value is bound to the level to construct an asset importance attribute value evaluation table; Obtain the target host's level identifier in each asset importance attribute, and query the asset importance attribute value evaluation table based on the level identifier to obtain the importance value of each asset importance attribute in the target host, and calculate the host's value according to the following formula: ， in, represents the importance assigned to the i-th host under confidentiality, represents the importance assigned to the i-th host under integrity, Represents the importance assigned to the i-th host under availability.

5. The dynamic honeypot deployment method based on attack graph and Shapley value according to claim 4 is characterized in that: The steps of constructing a game model, defining each edge in the attack graph as a player in the game model, and solving the Shapley value of each edge based on the Monte Carlo method include: Set the total number of sampling times. Each time a random function is used to generate a random permutation from 1 to m to represent the order in which edges are added. Then, these edges are added to the attack graph in sequence. During the addition process, the marginal contribution of each edge in the sequence is calculated. For each participant, its marginal contribution in all samples is accumulated and the average is finally taken as the Shapley value.

6. The dynamic honeypot deployment method based on attack graph and Shapley value according to claim 5, characterized in that: The step of sorting all edges in the attack graph according to the Shapley value of each edge to generate an optimal honey spot deployment strategy according to the edge sorting result includes: Sort the Shapley value of each edge from large to small to get the edge ranking from high to low; Deploy honeypot resources in descending order of edge hazard severity.

7. A dynamic honeypot deployment system based on attack graph and Shapley value, characterized in that: The system comprises: a scanning and probing module, configured to scan and probe the protected network at a first preset time interval to obtain scanning and probing results, wherein the scanning and probing results include asset information, configuration error information, and vulnerability information; a CVSS evaluation module, configured to construct an attack graph corresponding to the current network environment of the protected network based on the scanning and probing results, calculate the probability of exploitation of each vulnerability within each edge in the attack graph based on the CVSS evaluation, and define the difficulty of attacking each edge based on the probability of exploitation of each vulnerability; An expected loss calculation module, configured to calculate the probability of achieving an attack path according to the difficulty of attacking each edge, and obtain the expected loss of each attack path in the attack graph based on the probability of achieving the attack path; a decision module, configured to construct a game model, define each edge in the attack graph as a player in the game model, calculate the Shapley value of each edge based on the Monte Carlo method, and sort all edges in the attack graph according to the Shapley value of each edge, so as to generate an optimal honey spot deployment strategy based on the edge sorting result; The steps of calculating the realization probability of the attack path according to the difficulty of attacking each edge, and obtaining the expected loss of each attack path in the attack graph based on the realization probability of the attack path include: The probability of achieving the attack path is calculated according to the following formula: ， in, represents the realization probability of the j-th attack path, represents the difficulty of attacking the i-th edge in attack path j, and n represents the total number of edges contained in the j-th attack path; The expected loss of each attack path is calculated using the following formula: ， in, represents the expected loss of the jth attack path, x represents the total number of hosts on a path, represents the expected loss of the i-th host; The expected loss of each host is calculated using the following formula: ， in, represents the expected loss of the i-th host, represents the value of the i-th host, represents the probability that the i-th host is compromised; The probability of each host being compromised is calculated using the following formula: ， in, It represents the probability that the i-th host will not be compromised.

8. A readable storage medium, characterized in that: The readable storage medium stores one or more programs, which, when executed by a processor, implement the dynamic honey spot deployment method based on attack graph and Shapley value according to any one of claims 1 to 6.

9. A computer device, characterized in that: The computer device comprises a memory and a processor, wherein: The memory is used to store computer programs; When the processor is used to execute the computer program stored in the memory, it implements the dynamic honey spot deployment method based on attack graph and Shapley value described in any one of claims 1-6.

Images