Depth-first search attack graph generation method and system based on node asset weight

Abstract

The invention relates to the technical field of network security, in particular to a depth-first search attack graph generation method and system based on node asset weight, which introduces a deep learning priority algorithm of dynamic adjustment of node weight and intelligent node weight calculation, reduces the scale and complexity of an attack graph as much as possible while ensuring the accuracy of the attack graph, and improves the security of the attack graph. The attack graph generation efficiency is improved; comprising the following steps: calculating a comprehensive importance score of each node by comprehensively evaluating characteristics of each node in a network, and obtaining an initial weight value according to the comprehensive importance score; the method comprises the following steps: dynamically adjusting an initial weight value of each node in a network through real-time flow monitoring and regular polling of a network state to obtain a corrected weight value; traversing the nodes in a descending order according to the corrected weight values, and recording accessed nodes and paths; the current node has no adjacent unaccessed node or has reached the preset search depth limit; and stopping after all possible paths are searched, and generating an attack graph.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and system for generating a depth-first search attack graph based on node asset weights. Background Art

[0002] There are always certain security vulnerabilities in the network, and there may be certain correlations between these vulnerabilities. That is, when one vulnerability is successfully exploited, it may create favorable conditions for the exploitation of another vulnerability. Although it is impractical to eliminate all vulnerabilities, ignoring the remaining vulnerabilities in the network environment may cause serious damage to key resources. In order to thoroughly find out all the correlations, the most effective method is to simulate the attacker's attack process on the network with security vulnerabilities, find all attack paths that can reach the target, and express these paths in the form of a graph. This graph is a network attack graph, or attack graph for short. Attack graph is a model-based network vulnerability assessment method. Attack graph technology can associate the vulnerabilities on each host in the network for in-depth analysis, discover the attack paths that threaten network security and display them in the form of a graph. Security managers can use attack graphs to intuitively observe the relationship between various vulnerabilities in the network and choose the lowest cost to compensate for the network vulnerabilities.

[0003] However, the current attack graph generation has some problems. The attack graph is too large in scale, and the spatial complexity and time complexity are high, which is not conducive to intuitive analysis by security managers. It is very difficult to directly find the path with a relatively high degree of harm from the attack graph. The attack graph lacks pertinence and the generation efficiency is relatively low. It cannot provide more valuable guidance for security managers to compensate for network vulnerabilities. In the prior art, a system and method for generating an attack graph based on setting the maximum value of parameters are described in patent CN115242507A. The attack graph generation method of this technology is as follows: This technology proposes an attack graph generation method based on setting the maximum value of parameters. By limiting the number of attack steps, the difficulty index of vulnerability exploitation, and the acceptable number of high-difficulty vulnerabilities, the attack path is detected and screened, and a relatively low-cost attack path is generated to find the relatively weak links in the target network.

[0004] The above prior art has the following disadvantages:

[0005] As the size and complexity of the network increases, the size of the generated attack graph expands dramatically;

[0006] When the network status changes, the node weight remains fixed and cannot adapt to changes in different network environments. Summary of the invention

[0007] 1. Technical issues to be resolved

[0008] In view of the shortcomings of the prior art, the present invention provides a method and system for generating a depth-first search attack graph based on node asset weights, which introduces a deep learning priority algorithm for dynamic adjustment of node weights and intelligent node weight calculation. While ensuring the accuracy of the attack graph, it reduces the scale and complexity of the attack graph as much as possible and improves the efficiency of attack graph generation.

[0009] (II) Technical solution

[0010] To achieve the above object, the present invention provides the following technical solution: a method for generating a depth-first search attack graph based on node asset weights, comprising the following steps:

[0011] By comprehensively evaluating the characteristics of each node in the network, the comprehensive importance score of each node is calculated, and the initial weight value is obtained based on the comprehensive importance score;

[0012] By real-time traffic monitoring and periodic polling of network status, the initial weight value of each node in the network is dynamically adjusted to obtain a corrected weight value;

[0013] Traverse the nodes in descending order of modified weight values, and record the visited nodes and paths;

[0014] When the current node has no adjacent unvisited nodes or has reached the preset search depth limit, the search terminates. At this time, the current path is used as an attack path and the search continues back to the previous node until all possible attack paths are found.

[0015] After searching all possible paths, the process terminates and generates an attack graph.

[0016] Furthermore, the present invention is improved in that the characteristics of each node include: vulnerability impact value, topology importance and asset importance

[0017] The method of calculating the comprehensive importance score of each node by comprehensively evaluating the characteristics of each node in the network comprises the following steps:

[0018] The vulnerability impact value assessment method includes the following steps:

[0019] The impact evaluation reflects the direct consequences of the successful exploitation of the vulnerability and indicates the status of the affected components. The impact score calculation formula is:

[0020] When scope = fixed: impact score = 6.42 × ISCbase;

[0021] When scope = change: impact score = 7.52×(ISCbase-0.029)-3.25×(ISCbase-0.02)^15;

[0022] Where: ISCbase is a temporary variable, ISCbase = 1-[(1-confidentiality impact) × (1-integrity impact) × (1-availability impact)];

[0023] The exploitability evaluation reflects the ease of exploitation of the exploitable vulnerability and the difficulty of technical means, indicating the difficulty of the vulnerable component being attacked. The exploitability score calculation formula is:

[0024] Exploitability score = 8.22 × attack vector × attack complexity × permission requirement × user interaction;

[0025] The topological importance is determined by the connectivity, influence, and community structure of nodes;

[0026] The importance of an asset is quantified by the confidentiality, integrity, and availability of a node;

[0027] Weights are set for vulnerability impact value, topology importance, and asset importance respectively, and then a weighted sum is used to obtain a comprehensive importance score for each node.

[0028] Furthermore, the present invention is improved in that the real-time traffic monitoring also includes the step of setting a traffic threshold, and reference factors of the traffic threshold include: historical data, business requirements, industry standards and best practices.

[0029] Furthermore, the present invention is improved in that the method for dynamically adjusting the initial weight value of each node in the network includes: when the real-time traffic of a node exceeds a threshold, increasing its weight value; when the real-time traffic of a node returns to normal, reducing its weight value.

[0030] Furthermore, the present invention is improved in that the method for periodically polling the network status comprises the following steps:

[0031] Set the polling period;

[0032] Node status query;

[0033] Performance parameter collection;

[0034] Perform status analysis and judgment based on the collected node status and performance parameters;

[0035] Exception handling and adjustment;

[0036] Records and reports.

[0037] Furthermore, the present invention is improved in that after the attack graph is generated, the generated attack path is evaluated.

[0038] A depth-first search attack graph generation system based on node asset weights of the present invention comprises:

[0039] Feature evaluation module: used to comprehensively evaluate the features of each node in the network, calculate the comprehensive importance score of each node, and obtain the initial weight value based on the comprehensive importance score;

[0040] Weight adjustment module: used to monitor network traffic in real time and poll the network status regularly, adjust the initial weight value of the node according to the monitoring results, and obtain the corrected weight value;

[0041] Depth-first search module: used to traverse nodes in descending order according to the modified weight values ​​and record the visited nodes and paths;

[0042] Path termination determination module: used to determine whether the current node has any unvisited adjacent nodes or whether the preset search depth limit has been reached; if there are no adjacent unvisited nodes or the depth limit has been reached, the search is terminated;

[0043] Attack path recording module: used to record the current path as an attack path whenever the search is terminated;

[0044] Attack graph generation module: used to summarize all recorded attack paths and generate the final attack graph.

[0045] (III) Beneficial effects

[0046] Compared with the prior art, the present invention provides a method and system for generating a depth-first search attack graph based on node asset weights, which has the following beneficial effects: by introducing a dynamic adjustment mechanism of node weights, the present invention can adaptively adjust the node weight settings and screening conditions, thereby overcoming the limitations of fixed parameter settings in the prior art. The enhanced adaptability and flexibility enable the attack graph generation method to better adapt to changes in different network environments and improve the system's coping capabilities; by generating an attack graph through a depth-first search algorithm calculated by intelligent node weights, the present invention can accurately evaluate the asset weights of each node in the network, and give priority to selecting nodes with high weights for depth-first search, which is more accurate and efficient than traditional methods, and effectively improves the accuracy and efficiency of attack graph generation; by dynamically adjusting node weights and giving priority to selecting high-weight nodes for search, the present invention can effectively control the scale and complexity of the attack graph, and compared with the problem of attack graph scale expansion that may be caused by fixed parameter settings in the prior art, the present invention can better avoid unnecessary nodes and paths, thereby reducing the scale and complexity of the attack graph. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flowchart of the node weight calculation method;

[0048] Figure 2 It is a flowchart of the dynamic adjustment of node weights;

[0049] Figure 3 It is the evaluation score graph of the vulnerability;

[0050] Figure 4 It is an asset importance value evaluation diagram;

[0051] Figure 5 It is a flowchart of the depth-first search algorithm based on node weight allocation;

[0052] Figure 6 is a schematic diagram of the structure of an enterprise network in an embodiment;

[0053] Figure 7 In the embodiment, each node determines an initial weight value graph;

[0054] Figure 8 It is the attack graph generated in the embodiment. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] The present invention is a method for generating a depth-first search attack graph based on node asset weights, which includes three steps: intelligent node weight calculation, dynamic node weight adjustment, and a depth-first search algorithm based on node weight allocation;

[0057] The intelligent node weight calculation method determines the appropriate weight value for each node by comprehensively evaluating factors such as the node's vulnerability impact value, topology importance, and asset importance, such as Figure 1 As shown;

[0058] The specific steps of the intelligent node weight calculation method are as follows:

[0059] 1) Vulnerability impact value assessment:

[0060] The vulnerability situation of each node is evaluated, including the number of known vulnerabilities and the degree of harm of the vulnerabilities. This evaluation process can obtain the vulnerability information of the node with the help of the vulnerability database, and determine the impact value of the vulnerability based on factors such as the impact range and vulnerability of the vulnerability; then calculate the evaluation score of each vulnerability, such as Figure 3 As shown, factors such as impact and availability are taken into account;

[0061] Impact evaluation: The impact evaluation reflects the direct consequences of the vulnerability being successfully exploited and indicates the status of the affected components. The impact score calculation formula is:

[0062] When scope = fixed: impact score = 6.42 × ISCbase;

[0063] When scope = change: impact score = 7.52×(ISCbase-0.029)-3.25×(ISCbase-0.02)^15;

[0064] Where: ISCbase is a temporary variable, ISCbase = 1-[(1-confidentiality impact) × (1-integrity impact) × (1-availability impact)];

[0065] Confidentiality impact: This metric measures the impact of a successful exploit on the confidentiality of information resources managed by the software component. Confidentiality refers to information that is restricted to authorized users and protected from access or disclosure by unauthorized users.

[0066] Integrity impact: This metric measures the impact of a successful exploit on integrity, which refers to the reliability and accuracy of information.

[0067] Availability impact: This metric measures the degree to which a successful exploit of a vulnerability affects the availability of the affected component. While confidentiality and integrity impact metrics apply to the loss of confidentiality or integrity of data used by the affected component (e.g., information, files), this metric refers to the loss of availability of the affected component itself, such as network services (e.g., Web, database, email). Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space can affect the availability of the affected component.

[0068] Exploitability evaluation: Exploitability evaluation reflects the ease of exploitation of the exploitable vulnerability and the difficulty of technical means, indicating the difficulty of vulnerable components being attacked. The formula for calculating the exploitability score is:

[0069] Exploitability score = 8.22 × attack vector × attack complexity × permission requirement × user interaction;

[0070] Attack Path: This metric reflects the environmental possibility of attacking the vulnerable component. The larger the value of this metric (and the corresponding base score) will be, the farther the attacker has to go (logically and physically) to attack the vulnerable component.

[0071] Attack complexity: Attack complexity is the conditions that the attacker cannot control that must exist to attack the vulnerable component. As described below, these conditions may require the prior collection of more information about the target or system configuration or computational anomalies;

[0072] Permission Requirement: This metric describes the level of permissions an attacker must have before successfully attacking a vulnerable component.

[0073] User interaction: This metric describes the requirement for user involvement other than the attacker to attack the vulnerable component, i.e., determines whether the vulnerable component can be exploited at will by the attacker alone, or requires the user (or user process) to participate in some way.

[0074] 2) Topological structure importance assessment:

[0075] Analyze the network topology, including the connection relationship between nodes, network hierarchy, etc. Identify key nodes in the network, such as core nodes, edge nodes, etc.; give higher topological importance scores to the identified key nodes, which are important for the connectivity and normal operation of the network and should be regarded as important nodes; when identifying important nodes in the network, the following factors need to be considered:

[0076] 1. Connectivity:

[0077] Evaluating the connection of nodes in the network is an important indicator in network topology analysis. Among them, degree centrality and betweenness centrality are commonly used connectivity indicators. Degree centrality measures the number of connections (i.e., degree) of a node. The higher the degree of a node, the more connections it has with other nodes, thus reflecting the importance of the node in the network. For example, in a social network, a node with high degree centrality may represent a person with more social relationships and a wider influence, while betweenness centrality measures the importance of a node as a bridge in the network, that is, the frequency of occurrence of a node in all shortest paths. Nodes with high betweenness centrality play a key role in information transmission between nodes, and their influence and dissemination capabilities are stronger. Through the evaluation of degree centrality and betweenness centrality, important nodes and key communication hubs in the network can be identified, and the pattern and structure of connections in the network can be further understood.

[0078] 2. Influence:

[0079] In the field of network analysis, PageRank algorithm and HITS algorithm are often used to evaluate the influence of nodes.

[0080] The PageRank algorithm is a classic influence evaluation method. It calculates and measures the importance and influence of nodes by analyzing the link relationship between nodes in the network. The algorithm iteratively calculates the weight of the node to reflect the communication influence of the node in the network. The PageRank value of the node reflects its position and influence in the network, and is widely used in the fields of web page ranking and important node identification in social networks. In practical applications, the PageRank algorithm can help us identify the core nodes and key paths of information dissemination in the network, and provide guidance and reference for information flow and influence dissemination.

[0081] HITS algorithm (Hypertext Induced Topic Selection) is another important method for evaluating node influence. This algorithm ranks nodes by iteratively calculating the Hub value and Authority value of the nodes. The Hub value reflects the importance of the node's out-degree connection to other nodes, while the Authority value represents the importance of the node's in-degree connection. HITS algorithm is suitable for discovering important nodes and authoritative information in the network, especially playing an important role in determining important information exchange nodes and key information disseminators in the network.

[0082] 3. Community structure:

[0083] Community structure is an important indicator used in network analysis to evaluate the community and modularity of nodes in the network, mainly including clustering coefficient and modularity;

[0084] Clustering coefficient: The clustering coefficient measures the tightness of the connection between node neighbors and is used to evaluate the tightness of the connection within the community where the node is located. The higher the clustering coefficient of a node, the tighter the connection between its neighbors. In the community structure, nodes with a higher clustering coefficient often play an important role because they are more closely connected to other nodes in the community and can more effectively spread information and influence other nodes. By calculating the clustering coefficient of a node, the importance of the node in the community structure and its position can be evaluated, thereby better understanding the role and influence of the node in the network;

[0085] Modularity: Modularity is an indicator for evaluating the community structure of a network. It is used to discover important nodes and organizational structures in the entire network. By evaluating the community structure in the network, modularity can measure the difference between actual connections and random connections, thereby quantifying the significance of the community in the network. Nodes with higher modularity values ​​may have important connection functions in a specific community structure. The modularity method can help us discover important nodes and organizational structures in the network and further understand the functional modules and information propagation mechanisms in the network.

[0086] By comprehensively considering factors such as the degree of connection, influence, and community structure of the node in the network, the importance and status of the node can be comprehensively evaluated;

[0087] 3)Asset importance assessment:

[0088] The asset importance of a node is quantified by the confidentiality, integrity and availability of the node. Based on the security requirements of different nodes and in accordance with the national standard "Information Security Risk Assessment Specification", the asset importance of each node is divided into five levels: L1, L2, L3, L4, and L5. A finer-grained division will increase the difficulty of a priori scoring, making it difficult to define the asset importance level. Therefore, the asset importance level is no longer further divided. Figure 4 shown.

[0089] 4) Comprehensive evaluation:

[0090] Comprehensively evaluate factors such as vulnerability impact value, topological structure importance and asset importance to obtain a comprehensive importance score for each node. A weighted summation method can be used to give corresponding weights according to the importance of different factors. Nodes with higher comprehensive scores are regarded as important nodes, which are more important and should be given special attention and protection. Finally, the initial weight value of the node is determined according to the comprehensive importance score of the node. Nodes with higher scores are assigned higher initial weight values, while nodes with lower scores are assigned lower initial weight values. The determination of the initial weight value can be adjusted according to actual conditions and security requirements to ensure the overall security and reliability of the network.

[0091] Through the above steps, a comprehensive assessment of the importance of each node can be achieved, providing an important reference for subsequent node weight allocation and security strategy formulation.

[0092] Node weights are adjusted dynamically, such as Figure 2 As shown, the following steps are included:

[0093] 1) Real-time traffic monitoring

[0094] Traffic monitoring is a system that monitors the traffic conditions of nodes in the network in real time in order to detect abnormal traffic conditions in a timely manner. This can be achieved through network traffic monitoring tools. The object of monitoring is the entire network. The monitoring frequency can be adjusted as needed. Traffic monitoring can detect active nodes and traffic levels in the network, which helps to identify abnormal nodes. The following is the detailed process of traffic monitoring:

[0095] Choose the right network traffic monitoring tool: First, you need to choose a suitable network traffic monitoring tool, such as Wireshark, Ntopng, PRTG Network Monitor, etc. These tools provide the function of real-time monitoring of network traffic and can display traffic data in a graphical interface to facilitate analysis and identification of anomalies.

[0096] Configure monitoring objects and parameters: In the network traffic monitoring tool, configure the monitoring object to be the entire network to ensure coverage of all nodes and traffic. According to actual conditions, set the parameters of the network traffic monitoring tool, such as monitoring frequency, monitored port range, etc.; these parameters can be adjusted according to the network scale and needs.

[0097] Real-time monitoring of traffic conditions: Network traffic monitoring tools capture and analyze network traffic data in real time. Through the graphical interface or reporting function of the monitoring tool, the traffic conditions of each node can be viewed in real time.

[0098] 2) Set traffic threshold

[0099] Set corresponding traffic thresholds based on network characteristics and requirements. When the traffic of a node exceeds the threshold, it may mean that the node is under attack or in an abnormal state. The setting of the threshold needs to comprehensively consider historical data, business requirements, industry standards and other factors;

[0100] Analysis based on historical data: First, it is necessary to collect historical network traffic data, including the traffic conditions, peak time, fluctuation range, etc. of each node. These data can be obtained through network monitoring tools, log recording systems, etc., and then sorted and analyzed. Then, by analyzing the characteristics of historical data, a suitable baseline can be determined, which is the average value of the traffic.

[0101] Setting based on business needs: Different businesses have different requirements for network traffic, so it is necessary to set corresponding traffic monitoring thresholds based on the characteristics and needs of specific businesses. For example, video websites may require higher bandwidth to support the transmission of large amounts of video streams, while email servers are more concerned with transmission rates and delays; business departments communicate and conduct demand surveys to understand their specific requirements for network performance and traffic needs; this ensures that the set traffic thresholds can fully meet business needs and ensure the normal operation of the business.

[0102] Refer to industry standards and best practices: Refer to NIST's security framework and CIS's recommendations to understand industry standards and best practices; these standards generally provide guidelines and methods for traffic monitoring and threshold setting. Based on the guidance of NIST and CIS, develop a traffic monitoring strategy and threshold setting that is appropriate for your organization.

[0103] 3) Weight adjustment strategy

[0104] The weight adjustment strategy includes determining the way to adjust the weight, that is, increase, decrease or keep it unchanged; according to the actual situation of the node and the system requirements, a corresponding adjustment strategy needs to be formulated; the weight adjustment strategy is as follows: when the real-time traffic of a node exceeds the threshold, increase its weight value to improve its importance in the attack graph generation; and when the traffic returns to normal, reduce its weight value to reflect its actual importance in the attack path.

[0105] 4) Real-time adjustment

[0106] By polling the network status regularly, the system can respond to changes in the network environment in real time and adjust the node weight value immediately when necessary. It must be real-time and responsive so as to respond to abnormal situations in the network in a timely manner and ensure that the generated attack graph is accurate and practical. Regularly polling the network status means that the system periodically queries and detects the status and performance parameters of each node in the network to achieve real-time monitoring and response to the network environment. The following is the process of regularly polling the network status:

[0107] Set the polling cycle: First, set a polling cycle, that is, the time interval for regularly performing network status queries. This cycle can be determined based on the characteristics of the network, business needs, and the real-time requirements of the system. Generally speaking, the more common polling cycle ranges from a few seconds to a few minutes.

[0108] Node status query: At the beginning of each polling cycle, the status information of each node in the network is queried in turn; this status information may include the node's operating status, load, traffic, delay, packet loss rate, etc.

[0109] Performance parameter collection: For each node, the system will collect and record its relevant performance parameters. These parameters can be obtained through network management protocols (such as SNMP), API calls or other monitoring tools; common performance parameters include bandwidth utilization, CPU utilization, memory utilization, network latency, etc.

[0110] Status analysis and judgment: The system will analyze and judge based on the collected node status and performance parameters; for example, check whether the node traffic exceeds the preset threshold.

[0111] Exception handling and adjustment: If the system finds that a node's status is abnormal or its performance parameters exceed the set threshold range, it will trigger the corresponding exception handling mechanism to adjust the node's weight value;

[0112] Recording and reporting: The system will record the results of each poll and generate corresponding status reports; these reports can be used for subsequent analysis, optimization, and decision-making to help improve system performance and stability.

[0113] The specific implementation steps of the depth-first search process based on node weight allocation are as follows: Figure 5 As shown:

[0114] 1) Node weight initialization

[0115] The initial weight value of the node is determined according to its comprehensive importance score. Nodes with higher scores are assigned higher initial weight values, while nodes with lower scores are assigned lower initial weight values. The determination of the initial weight value can be adjusted according to actual conditions and security requirements to ensure the overall security and reliability of the network;

[0116] 2) Depth-first search

[0117] Use the depth-first search algorithm to traverse the nodes in the network, starting from a starting node and exploring in depth along the path until it can no longer go forward; when performing a depth-first search, the system will prioritize the next node to be explored based on the node weight value; specifically, explore the nodes in order from high to low node weight to ensure that the most important nodes are explored first. Doing so can improve the efficiency of attack graph generation, ensure that nodes with greater impact on network security risks are explored first, and thus generate a more accurate and comprehensive attack graph.

[0118] 3) Node access tag

[0119] When performing a depth-first search, the nodes that have been visited are marked to avoid repeated visits and infinite loops. A Boolean array can be used to record the access status of the nodes. Whenever the system visits a node, it is marked as visited to ensure that the node will not be visited again in subsequent searches. This can effectively manage the search process and avoid duplication of work and unnecessary waste of resources.

[0120] 4) Path record

[0121] When performing depth-first search, the system needs to record the nodes and paths that have been visited for subsequent analysis and attack graph generation. A list can be used to record the current search path. Whenever the system explores a node downward, the node is added to the path and popped out when returning. This can effectively record the nodes and paths during the search process and provide necessary data support for subsequent analysis.

[0122] 5) Search termination conditions

[0123] When the exploration cannot continue, that is, when the current node has no adjacent unvisited nodes or the preset search depth limit has been reached, the search terminates; at this time, the system records the current path as an attack path and goes back to the previous node to continue searching until all possible attack paths are found. This ensures that the system terminates after searching all possible paths and generates a comprehensive and accurate attack graph;

[0124] 6) Path evaluation

[0125] Finally, the system evaluates the generated attack paths. Based on the actual situation and security requirements, the system can analyze and score the importance of the attack paths. For example, it can consider factors such as the coverage, impact, and difficulty of the attack paths and assign a corresponding score to each attack path. This can help the system determine the final attack graph and provide an important reference for subsequent security decisions and response measures.

[0126] A depth-first search attack graph generation system based on node asset weights of the present invention, a feature evaluation module: used to comprehensively evaluate the features of each node in the network, calculate the comprehensive importance score of each node, and obtain an initial weight value according to the comprehensive importance score;

[0127] Weight adjustment module: used to monitor network traffic in real time and poll the network status regularly, adjust the initial weight value of the node according to the monitoring results, and obtain the corrected weight value;

[0128] Depth-first search module: used to traverse nodes in descending order according to the modified weight values ​​and record the visited nodes and paths;

[0129] Path termination determination module: used to determine whether the current node has any unvisited adjacent nodes or whether the preset search depth limit has been reached; if there are no adjacent unvisited nodes or the depth limit has been reached, the search is terminated;

[0130] Attack path recording module: used to record the current path as an attack path whenever the search is terminated;

[0131] Attack graph generation module: used to summarize all recorded attack paths and generate the final attack graph.

[0132] Example:

[0133] In this example, we will show how to generate an attack graph using a depth-first search algorithm based on node asset weights. Figure 6 As shown, assume that there is an enterprise network, including 4 terminal devices, one of which is a key asset terminal, and seven servers, namely domain server, database, file server, workstation, mail server, web application server, and access control system;

[0134] First, the initial weight value is determined for each node according to the intelligent node weight calculation algorithm. Factors such as node vulnerability, topological structure importance, and asset importance are comprehensively considered. Figure 7 As shown;

[0135] Next, use the depth-first search algorithm to traverse the nodes in the network, starting from the attacker's attack machine, and explore possible attack paths according to the priority of node weights. During the search process, give priority to exploring nodes with higher weights to ensure that the most important nodes are explored first. In order to avoid repeated visits and falling into an infinite loop, it is necessary to mark the nodes that have been visited; use a Boolean array to record the access status of the nodes. Whenever a node is visited, mark it as visited. During the search process, it is necessary to record the nodes and paths that have been visited. Use a list to record the current search path. Whenever a node is explored downward, add it to the path and pop it out when returning. When the current node has no adjacent unvisited nodes or has reached the preset search depth limit, the search terminates, and the current path is recorded as an attack path, and the search is continued back to the previous node until all possible attack paths are found.

[0136] Finally, the generated attack paths are evaluated. According to the actual situation and security requirements, the importance of the attack paths can be analyzed and scored. Through the above steps, a depth-first search attack graph based on node asset weights can be generated, such as Figure 8 As shown in the figure, the attacker's attack machine is used as the starting node to explore possible attack paths according to the priority of node weights. Since the database is assigned the highest initial weight value, the database node and domain control server node are explored first; then, the attacker can further attack the mail server and Web application server through these two nodes. This attack graph shows possible attack paths, which helps to understand the security risks of the network and formulate corresponding security policies. The actual attack graph may be more complex, depending on the combined influence of network topology, node weights and other factors.

[0137] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for generating a depth-first search attack graph based on node asset weights, characterized in that: The following steps are involved: By comprehensively evaluating the characteristics of each node in the network, the comprehensive importance score of each node is calculated, and the initial weight value is obtained based on the comprehensive importance score; By real-time traffic monitoring and periodic polling of network status, the initial weight value of each node in the network is dynamically adjusted to obtain a corrected weight value; Traverse the nodes in descending order of modified weight values, and record the visited nodes and paths; When the current node has no adjacent unvisited nodes or has reached the preset search depth limit, the search terminates. At this time, the current path is used as an attack path and the search continues back to the previous node until all possible attack paths are found. After searching all possible paths, the process terminates and generates an attack graph.

2. A method for generating a depth-first search attack graph based on node asset weights according to claim 1, characterized in that: The characteristics of each node include: vulnerability impact value, topology importance and asset importance The method of calculating the comprehensive importance score of each node by comprehensively evaluating the characteristics of each node in the network comprises the following steps: The vulnerability impact value assessment method includes the following steps: The impact evaluation reflects the direct consequences of the successful exploitation of the vulnerability and indicates the status of the affected components. The impact score calculation formula is: When scope = fixed: impact score = 6.42 × ISCbase; When scope = change: impact score = 7.52×(ISCbase-0.029)-3.25×(ISCbase-0.02)^15; Where: ISCbase is a temporary variable, ISCbase = 1-[(1-confidentiality impact) × (1-integrity impact) × (1-availability impact)]; The exploitability evaluation reflects the ease of exploitation of the exploitable vulnerability and the difficulty of technical means, indicating the difficulty of the vulnerable component being attacked. The exploitability score calculation formula is: Exploitability score = 8.22 × attack vector × attack complexity × permission requirement × user interaction; The topological importance is determined by the connectivity, influence, and community structure of nodes; The importance of an asset is quantified by the confidentiality, integrity, and availability of a node; Weights are set for vulnerability impact value, topology importance, and asset importance respectively, and then a weighted sum is used to obtain a comprehensive importance score for each node.

3. A method for generating a depth-first search attack graph based on node asset weights according to claim 1, characterized in that: The real-time traffic monitoring also includes the step of setting a traffic threshold, and reference factors of the traffic threshold include: historical data, business requirements, industry standards and best practices.

4. A method for generating a depth-first search attack graph based on node asset weights according to claim 3, characterized in that: The method for dynamically adjusting the initial weight value of each node in the network includes: when the real-time traffic of a node exceeds a threshold, increasing its weight value; when the real-time traffic of a node returns to normal, reducing its weight value.

5. A method for generating a depth-first search attack graph based on node asset weights according to claim 4, characterized in that: The method for periodically polling network status comprises the following steps: Set the polling period; Node status query; Performance parameter collection; Perform status analysis and judgment based on the collected node status and performance parameters; Exception handling and adjustment; Records and reports.

6. A method for generating a depth-first search attack graph based on node asset weights according to claim 5, characterized in that: After the attack graph is generated, the generated attack path is evaluated.

7. A depth-first search attack graph generation system based on node asset weights, characterized in that: include: Feature evaluation module: used to comprehensively evaluate the features of each node in the network, calculate the comprehensive importance score of each node, and obtain the initial weight value based on the comprehensive importance score; Weight adjustment module: used to monitor network traffic in real time and poll the network status regularly, adjust the initial weight value of the node according to the monitoring results, and obtain the corrected weight value; Depth-first search module: used to traverse nodes in descending order according to the modified weight values ​​and record the visited nodes and paths; Path termination determination module: used to determine whether the current node has any unvisited adjacent nodes or whether the preset search depth limit has been reached; if there are no adjacent unvisited nodes or the depth limit has been reached, the search is terminated; Attack path recording module: used to record the current path as an attack path whenever the search is terminated; Attack graph generation module: used to summarize all recorded attack paths and generate the final attack graph.

Images