A method and system for generating a depth-first search attack graph based on node asset weights

Abstract

The present invention relates to the technical field of network security, and specifically relates to a method and system for generating a depth-first search attack graph based on node asset weights. The method introduces a deep learning priority algorithm for dynamic adjustment of node weights and intelligent node weight calculation, thereby minimizing the scale and complexity of the attack graph while ensuring the accuracy of the attack graph and improving the efficiency of attack graph generation. The method comprises the following steps: comprehensively evaluating the characteristics of each node in the network, calculating the comprehensive importance score of each node, and obtaining an initial weight value based on the comprehensive importance score; dynamically adjusting the initial weight value of each node in the network through real-time traffic monitoring and periodic polling of the network status to obtain a revised weight value; traversing nodes in descending order according to the revised weight values, and recording visited nodes and paths; searching when the current node has no adjacent unvisited nodes or has reached a preset search depth limit; and terminating after searching all possible paths to generate an attack graph.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and system for generating a depth-first search attack graph based on node asset weights. Background Art

[0002] Networks always have security vulnerabilities, and these vulnerabilities may be interconnected. This means that the successful exploitation of one vulnerability may create favorable conditions for the exploitation of another. While eliminating all vulnerabilities is unrealistic, leaving remaining vulnerabilities unaddressed in a network environment can severely harm critical resources. To thoroughly identify all these interconnections, the most effective approach is to simulate an attacker's attack on a vulnerable network, identifying all attack paths that could reach the target and representing these paths in a graphical form. This graph is called a network attack graph, or attack graph for short. An attack graph is a model-based network vulnerability assessment method. Attack graph technology correlates vulnerabilities across hosts in a network for in-depth analysis, identifying attack paths that threaten network security and displaying them graphically. Using attack graphs, security managers can visually observe the relationships between network vulnerabilities and mitigate them with minimal effort.

[0003] However, current attack graph generation suffers from several issues. The large size of attack graphs and their high spatial and temporal complexity hinder intuitive analysis by security managers. Directly identifying the most damaging paths from the attack graph is extremely difficult, and the graphs lack specificity. Furthermore, their generation efficiency is relatively low, failing to provide valuable guidance for security managers in addressing network vulnerabilities. Prior art describes an attack graph generation system and method based on setting parameter maximums, as described in patent application CN115242507A. The attack graph generation method of this technology is as follows: This technology proposes an attack graph generation method based on setting parameter maximums. By limiting the number of attack steps, the difficulty index of vulnerability exploitation, and the acceptable number of high-difficulty vulnerabilities, the attack paths are simultaneously detected and screened, generating relatively low-cost attack paths and identifying relatively weak links in the target network.

[0004] The above-mentioned prior art has the following disadvantages:

[0005] As the network size and complexity increase, the size of the generated attack graph expands dramatically;

[0006] When the network status changes, the node weight remains fixed and cannot adapt to changes in different network environments. Summary of the Invention

[0007] (1) Technical problems solved

[0008] In response to the shortcomings of the existing technology, the present invention provides a depth-first search attack graph generation method and system based on node asset weights, which introduces a deep learning priority algorithm for dynamic adjustment of node weights and intelligent node weight calculation. While ensuring the accuracy of the attack graph, it minimizes the scale and complexity of the attack graph and improves the efficiency of attack graph generation.

[0009] (2) Technical solution

[0010] To achieve the above objectives, the present invention provides the following technical solution: a method for generating a depth-first search attack graph based on node asset weights, comprising the following steps:

[0011] By comprehensively evaluating the characteristics of each node in the network, the comprehensive importance score of each node is calculated, and the initial weight value is obtained based on the comprehensive importance score;

[0012] By real-time traffic monitoring and periodic polling of network status, the initial weight value of each node in the network is dynamically adjusted to obtain the corrected weight value;

[0013] Traverse the nodes in descending order of the modified weight values ​​and record the visited nodes and paths;

[0014] When the current node has no adjacent unvisited nodes or the preset search depth limit has been reached, the search terminates. At this time, the current path is used as an attack path and the search continues back to the previous node until all possible attack paths are found.

[0015] The process terminates after searching all possible paths and generates an attack graph.

[0016] Furthermore, the present invention is improved in that the characteristics of each node include: vulnerability impact value, topology importance and asset importance

[0017] The method for calculating the comprehensive importance score of each node by comprehensively evaluating the characteristics of each node in the network includes the following steps:

[0018] The vulnerability impact value assessment method includes the following steps:

[0019] The impact evaluation reflects the direct consequences of a successful exploitation of a vulnerability and indicates the status of the affected components. The impact score is calculated as follows:

[0020] When scope = fixed: impact score = 6.42 × ISCbase;

[0021] When scope = change: impact score = 7.52×(ISCbase-0.029)-3.25×(ISCbase-0.02)^15;

[0022] Where: ISCbase is a temporary variable, ISCbase = 1-[(1-confidentiality impact) × (1-integrity impact) × (1-availability impact)];

[0023] The exploitability evaluation reflects the ease of exploitation and technical difficulty of the exploitable vulnerability, indicating the difficulty of attacking the vulnerable component. The exploitability score calculation formula is:

[0024] Exploitability score = 8.22 × attack vector × attack complexity × permission requirement × user interaction;

[0025] The importance of topological structure is determined by the connectivity, influence, and community structure of nodes;

[0026] The importance of an asset is determined by quantifying the confidentiality, integrity, and availability of a node;

[0027] Weights are set for vulnerability impact value, topology importance, and asset importance respectively, and then a weighted summation method is used to obtain the comprehensive importance score of each node.

[0028] Furthermore, the present invention is improved in that the real-time traffic monitoring also includes the step of setting a traffic threshold, and reference factors of the traffic threshold include: historical data, business needs, industry standards and best practices.

[0029] Furthermore, the present invention is improved in that the method for dynamically adjusting the initial weight value of each node in the network includes: when the real-time traffic of a node exceeds a threshold, increasing its weight value; when the real-time traffic of a node returns to normal, reducing its weight value.

[0030] Furthermore, the present invention is improved in that the method for periodically polling the network status comprises the following steps:

[0031] Set the polling period;

[0032] Node status query;

[0033] Performance parameter collection;

[0034] Perform status analysis and judgment based on the collected node status and performance parameters;

[0035] Exception handling and adjustment;

[0036] Records and reports.

[0037] Furthermore, the present invention is improved in that, after the attack graph is generated, the generated attack path is evaluated.

[0038] The present invention provides a depth-first search attack graph generation system based on node asset weights, comprising:

[0039] Feature evaluation module: used to comprehensively evaluate the features of each node in the network, calculate the comprehensive importance score of each node, and obtain the initial weight value based on the comprehensive importance score;

[0040] Weight adjustment module: used to monitor network traffic in real time and poll the network status regularly, adjust the initial weight value of the node according to the monitoring results, and obtain the corrected weight value;

[0041] Depth-first search module: used to traverse nodes in descending order according to the modified weight values ​​and record the visited nodes and paths;

[0042] Path termination determination module: used to determine whether the current node has any unvisited adjacent nodes or whether the preset search depth limit has been reached; if there are no adjacent unvisited nodes or the depth limit has been reached, the search is terminated;

[0043] Attack path recording module: used to record the current path as an attack path whenever the search ends;

[0044] Attack graph generation module: used to summarize all recorded attack paths and generate the final attack graph.

[0045] (3) Beneficial effects

[0046] Compared with the prior art, the present invention provides a method and system for generating a depth-first search attack graph based on node asset weights, which has the following beneficial effects: by introducing a dynamic adjustment mechanism for node weights, the present invention can adaptively adjust the node weight settings and screening conditions, thereby overcoming the limitations of fixed parameter settings in the prior art. This enhanced adaptability and flexibility enables the attack graph generation method to better adapt to changes in different network environments and improve the system's response capabilities; by generating an attack graph through a depth-first search algorithm based on intelligent node weight calculation, the present invention can accurately assess the asset weights of each node in the network and give priority to nodes with high weights for depth-first search, which is more accurate and efficient than traditional methods, effectively improving the accuracy and efficiency of attack graph generation; by dynamically adjusting node weights and giving priority to searching high-weight nodes, the present invention can effectively control the scale and complexity of the attack graph. Compared with the problem of attack graph scale expansion that may be caused by fixed parameter settings in the prior art, the present invention can better avoid unnecessary nodes and paths, thereby reducing the scale and complexity of the attack graph. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flowchart of the node weight calculation method;

[0048] Figure 2 It is a flowchart of the dynamic adjustment of node weights;

[0049] Figure 3 It is the evaluation score graph of the vulnerability;

[0050] Figure 4 It is an asset importance value evaluation diagram;

[0051] Figure 5 This is a flowchart of the depth-first search algorithm based on node weight allocation;

[0052] Figure 6 is a schematic diagram of the structure of an enterprise network in an embodiment;

[0053] Figure 7 In the embodiment, each node determines an initial weight value graph;

[0054] Figure 8 is the attack graph generated in the embodiment. DETAILED DESCRIPTION

[0055] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0056] The present invention is a method for generating a depth-first search attack graph based on node asset weights, which includes three steps: intelligent node weight calculation, dynamic adjustment of node weights, and a depth-first search algorithm based on node weight distribution;

[0057] The intelligent node weight calculation method determines the appropriate weight value for each node by comprehensively evaluating factors such as the node's vulnerability impact value, topology importance, and asset importance. Figure 1 As shown;

[0058] The specific steps for calculating the smart node weight are as follows:

[0059] 1) Vulnerability impact assessment:

[0060] The vulnerability situation of each node is evaluated, including the number of known vulnerabilities and the degree of harm of the vulnerabilities. This evaluation process can obtain the vulnerability information of the node with the help of the vulnerability database, and determine the impact value of the vulnerability based on factors such as the scope of impact of the vulnerability and the degree of vulnerability to attack; then calculate the evaluation score of each vulnerability, such as Figure 3 As shown, factors such as impact and availability are taken into account;

[0061] Impact evaluation: The impact evaluation reflects the direct consequences of a successful exploitation of a vulnerability and indicates the status of the affected components. The impact score is calculated as follows:

[0062] When scope = fixed: impact score = 6.42 × ISCbase;

[0063] When scope = change: impact score = 7.52×(ISCbase-0.029)-3.25×(ISCbase-0.02)^15;

[0064] Where: ISCbase is a temporary variable, ISCbase = 1-[(1-confidentiality impact) × (1-integrity impact) × (1-availability impact)];

[0065] Confidentiality impact: This metric measures the impact of a successful exploit on the confidentiality of information resources managed by the software component. Confidentiality refers to information that is restricted to authorized users and protected from access or disclosure by unauthorized users.

[0066] Integrity Impact: This metric measures the impact of a successful exploit on integrity, which refers to the reliability and accuracy of information.

[0067] Availability Impact: This metric measures the extent to which a successful exploit would affect the availability of the affected component. While confidentiality and integrity impact metrics apply to the loss of confidentiality or integrity of data used by the affected component (e.g., information, files), this metric refers to the loss of availability of the affected component itself, such as network services (e.g., Web, database, email). Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space can affect the availability of the affected component.

[0068] Exploitability evaluation: The exploitability evaluation reflects the ease of exploitation and technical difficulty of the exploitable vulnerability, indicating the difficulty of attacking the vulnerable component. The exploitability score calculation formula is:

[0069] Exploitability score = 8.22 × attack vector × attack complexity × permission requirement × user interaction;

[0070] Attack vector: This metric reflects the likelihood of an attack against a vulnerable component. The larger the value of this metric (and the corresponding base score), the farther away (logically and physically) an attacker has to go to attack the vulnerable component.

[0071] Attack complexity: Attack complexity refers to the conditions beyond the attacker's control that must exist to attack the vulnerable component. As described below, these conditions may require the prior collection of more information about the target or system's configuration or computational anomalies.

[0072] Permission Requirement: This metric describes the level of permissions an attacker must have before successfully attacking a vulnerable component.

[0073] User interaction: This metric describes the need for user participation other than the attacker to attack the vulnerable component. That is, it determines whether the vulnerable component can be exploited at will by the attacker alone, or requires the user (or user process) to participate in some way.

[0074] 2) Topology importance assessment:

[0075] Analyze the network topology, including the connection relationships between nodes and the network hierarchy. Identify key nodes in the network, such as core nodes and edge nodes. Give the identified key nodes a higher topological importance score. These nodes play an important role in the connectivity and normal operation of the network and should be considered as important nodes. When identifying important nodes in the network, consider the following factors:

[0076] 1. Connectivity:

[0077] Evaluating the connectivity of nodes in a network is an important indicator in network topology analysis. Degree centrality and betweenness centrality are commonly used connectivity indicators. Degree centrality measures the number of connections (i.e., degree) of a node. The higher the degree of a node, the more connections it has with other nodes, thus reflecting the importance of the node in the network. For example, in a social network, a node with high degree centrality may represent a person with more social relationships and a wider influence, while betweenness centrality measures the importance of a node as a bridge in the network, that is, the frequency of a node's appearance in all shortest paths. Nodes with high betweenness centrality play a key role in information transmission between nodes and have a stronger ability to spread influence. By evaluating degree centrality and betweenness centrality, we can identify important nodes and key communication hubs in the network and further understand the pattern and structure of connections in the network.

[0078] 2. Influence:

[0079] In the field of network analysis, PageRank algorithm and HITS algorithm are often used to evaluate the influence of nodes.

[0080] The PageRank algorithm is a classic influence evaluation method. It calculates and measures the importance and influence of nodes by analyzing the link relationship between nodes in the network. The algorithm iteratively calculates the weight of the node to reflect the communication influence of the node in the network. The PageRank value of the node reflects its status and influence in the network. It is widely used in fields such as web page ranking and identification of important nodes in social networks. In practical applications, the PageRank algorithm can help us identify the core nodes and key paths of information dissemination in the network, providing guidance and reference for information flow and influence dissemination.

[0081] The Hypertext Induced Topic Selection (HITS) algorithm is another important method for evaluating node influence. This algorithm ranks nodes by iteratively calculating their Hub and Authority values. The Hub value reflects the importance of a node's out-degree connections to other nodes, while the Authority value indicates the importance of a node's in-degree connections. The HITS algorithm is suitable for discovering important nodes and authoritative information in a network, and is particularly important for identifying key information exchange nodes and key information disseminators.

[0082] 3. Community structure:

[0083] Community structure is an important indicator used in network analysis to evaluate the community and modularity of nodes in the network, mainly including clustering coefficient and modularity;

[0084] Clustering coefficient: The clustering coefficient measures the tightness of connections between node neighbors and is used to assess the tightness of connections within the node's community. The higher the clustering coefficient of a node, the tighter the connections between its neighbors. In a community structure, nodes with a higher clustering coefficient often play an important role because they are more closely connected to other nodes in the community and can more effectively spread information and influence other nodes. By calculating the clustering coefficient of a node, we can assess the importance and position of the node in the community structure, thereby better understanding the role and influence of the node in the network.

[0085] Modularity: Modularity is an indicator for evaluating network community structure and is used to discover important nodes and organizational structures in the entire network. By evaluating the community structure in the network, modularity can measure the difference between actual connections and random connections, thereby quantifying the significance of the community in the network. Nodes with high modularity values ​​may play an important role in connecting specific community structures. Modularity methods can help us discover important nodes and organizational structures in the network and further understand the functional modules and information dissemination mechanisms in the network.

[0086] By comprehensively considering factors such as the node's degree of connection in the network, influence, and community structure, the importance and status of the node can be comprehensively evaluated;

[0087] 3) Asset importance assessment:

[0088] The asset importance of a node is quantified by the confidentiality, integrity and availability of the node. Based on the security requirements of different nodes and in accordance with the national standard "Information Security Risk Assessment Specification", the asset importance of each node is divided into five levels: L1, L2, L3, L4, and L5. A finer granularity will increase the difficulty of prior scoring, making it difficult to define the asset importance level. Therefore, the asset importance level is no longer further divided. Figure 4 shown.

[0089] 4) Comprehensive evaluation:

[0090] A comprehensive evaluation is conducted on factors such as vulnerability impact value, topology importance, and asset importance to obtain a comprehensive importance score for each node. A weighted summation method can be used to give corresponding weights according to the importance of different factors. Nodes with higher comprehensive scores are regarded as important nodes, which are more important and should be given special attention and protection. Finally, the initial weight value of the node is determined based on the comprehensive importance score of the node. Nodes with higher scores are assigned higher initial weight values, while nodes with lower scores are assigned lower initial weight values. The determination of the initial weight value can be adjusted according to actual conditions and security requirements to ensure the overall security and reliability of the network.

[0091] Through the above steps, a comprehensive assessment of the importance of each node can be achieved, providing an important reference for subsequent node weight allocation and security policy formulation.

[0092] Node weights are adjusted dynamically, such as Figure 2 As shown, the following steps are included:

[0093] 1) Real-time traffic monitoring

[0094] Traffic monitoring is a system that monitors the traffic conditions of nodes in the network in real time to detect abnormal traffic conditions in a timely manner. This can be achieved through network traffic monitoring tools. The monitoring object is the entire network, and the monitoring frequency can be adjusted as needed. Traffic monitoring can detect active nodes and traffic levels in the network, helping to identify abnormal nodes. The following is a detailed process of traffic monitoring:

[0095] Choose the right network traffic monitoring tool: First, you need to choose a suitable network traffic monitoring tool, such as Wireshark, Ntopng, or PRTG Network Monitor. These tools provide real-time network traffic monitoring capabilities and can display traffic data in a graphical interface, making it easier to analyze and identify anomalies.

[0096] Configure monitoring objects and parameters: Configure the monitoring object in the network traffic monitoring tool to be the entire network to ensure coverage of all nodes and traffic. According to actual conditions, set the parameters of the network traffic monitoring tool, such as monitoring frequency, monitored port range, etc.; these parameters can be adjusted according to the network scale and needs.

[0097] Real-time monitoring of traffic conditions: Network traffic monitoring tools capture and analyze network traffic data in real time. Through the monitoring tool's graphical interface or reporting function, you can view the traffic conditions of each node in real time;

[0098] 2) Set traffic threshold

[0099] Set traffic thresholds based on network characteristics and requirements. When a node's traffic exceeds the threshold, it may indicate that the node is under attack or is in an abnormal state. The threshold setting should take into account historical data, business requirements, and industry standards.

[0100] Analysis based on historical data: First, historical network traffic data needs to be collected, including traffic conditions at each node, peak times, and fluctuation ranges. This data can be obtained through network monitoring tools and logging systems, and then organized and analyzed. Then, by analyzing the characteristics of historical data, an appropriate baseline can be determined, which is the average traffic value.

[0101] Setting based on business needs: Different businesses have different network traffic requirements, so traffic monitoring thresholds need to be set accordingly based on the specific characteristics and needs of the business. For example, a video website may require higher bandwidth to support the transmission of large video streams, while an email server is more concerned with transmission rate and latency. Business departments should communicate and conduct needs surveys to understand their specific requirements for network performance and traffic demand. This ensures that the set traffic thresholds fully meet business needs and ensure the normal operation of the business.

[0102] Reference industry standards and best practices: Consult NIST's security framework and CIS's recommendations to understand industry standards and best practices. These standards often provide guidelines and methods for traffic monitoring and threshold setting. Based on NIST and CIS guidance, develop a traffic monitoring strategy and threshold settings that are appropriate for your organization.

[0103] 3) Weight adjustment strategy

[0104] The weight adjustment strategy includes determining the method of weight adjustment, that is, increase, decrease or remain unchanged; according to the actual situation of the node and system requirements, a corresponding adjustment strategy needs to be formulated; the weight adjustment strategy is as follows: when the real-time traffic of a node exceeds the threshold, its weight value is increased to improve its importance in attack graph generation; and when the traffic returns to normal, its weight value is reduced to reflect its actual importance in the attack path.

[0105] 4) Real-time adjustment

[0106] By periodically polling the network status, the system can respond to changes in the network environment in real time and adjust the node weights immediately when necessary. It must be real-time and responsive to respond to abnormal situations in the network in a timely manner and ensure that the generated attack graph is accurate and practical. Periodic polling of the network status means that the system periodically queries and detects the status and performance parameters of each node in the network to achieve real-time monitoring and response to the network environment. The following is the process of periodic polling of the network status:

[0107] Set the polling cycle: First, set a polling cycle, which is the time interval for regularly performing network status queries. This cycle can be determined based on network characteristics, business needs, and the real-time requirements of the system. Generally speaking, the more common polling cycle ranges from a few seconds to a few minutes.

[0108] Node status query: At the beginning of each polling cycle, the status information of each node in the network is queried in turn; this status information may include the node's operating status, load, traffic, delay, packet loss rate, etc.

[0109] Performance parameter collection: For each node, the system collects and records its relevant performance parameters. These parameters can be obtained through network management protocols (such as SNMP), API calls, or other monitoring tools. Common performance parameters include bandwidth utilization, CPU utilization, memory utilization, network latency, etc.

[0110] Status analysis and judgment: The system will analyze and judge based on the collected node status and performance parameters; for example, check whether the node traffic exceeds the preset threshold.

[0111] Exception handling and adjustment: If the system finds that a node's status is abnormal or its performance parameters exceed the set threshold range, it will trigger the corresponding exception handling mechanism to adjust the node's weight value;

[0112] Recording and reporting: The system records the results of each poll and generates corresponding status reports; these reports can be used for subsequent analysis, optimization, and decision-making to help improve system performance and stability.

[0113] The specific implementation steps of the depth-first search process based on node weight allocation are as follows: Figure 5 As shown:

[0114] 1) Node weight initialization

[0115] The initial weight of a node is determined based on its comprehensive importance score. Nodes with higher scores are assigned higher initial weights, while nodes with lower scores are assigned lower initial weights. The initial weight can be adjusted based on actual conditions and security requirements to ensure the overall security and reliability of the network.

[0116] 2) Depth-first search

[0117] A depth-first search algorithm is used to traverse nodes in the network, starting from a starting node and exploring further along the path until no further progress is possible. During a depth-first search, the system prioritizes the next node to explore based on its weight. Specifically, nodes are explored in descending order of weight to ensure that the most important nodes are explored first. This improves the efficiency of attack graph generation, ensuring that nodes with the greatest impact on network security risks are explored first, resulting in a more accurate and comprehensive attack graph.

[0118] 3) Node access tag

[0119] When performing a depth-first search, nodes that have been visited are marked to avoid repeated visits and infinite loops. A Boolean array can be used to record the access status of nodes. Whenever the system visits a node, it is marked as visited to ensure that the node will not be visited again in subsequent searches. This can effectively manage the search process and avoid duplication of work and unnecessary waste of resources.

[0120] 4) Path record

[0121] When performing depth-first search, the system needs to record the nodes and paths that have been visited for subsequent analysis and attack graph generation. A list can be used to record the current search path. Whenever the system explores a node downward, the node is added to the path and popped out when returning. This can effectively record the nodes and paths during the search process and provide necessary data support for subsequent analysis.

[0122] 5) Search termination condition

[0123] The search terminates when the exploration cannot continue, that is, when the current node has no adjacent unvisited nodes or the preset search depth limit has been reached. At this point, the system records the current path as an attack path and backtracks to the previous node to continue searching until all possible attack paths are found. This ensures that the system terminates after searching all possible paths and generates a comprehensive and accurate attack graph.

[0124] 6) Path evaluation

[0125] Finally, the system evaluates the generated attack paths. Based on the actual situation and security requirements, the system can analyze and score the importance of the attack paths. For example, it can consider factors such as the coverage, impact, and difficulty of the attack paths and assign a corresponding score to each attack path. This can help the system determine the final attack graph and provide an important reference for subsequent security decisions and response measures.

[0126] The present invention provides a depth-first search attack graph generation system based on node asset weights, wherein the feature evaluation module is used to comprehensively evaluate the features of each node in the network, calculate the comprehensive importance score of each node, and obtain the initial weight value according to the comprehensive importance score;

[0127] Weight adjustment module: used to monitor network traffic in real time and poll the network status regularly, adjust the initial weight value of the node according to the monitoring results, and obtain the corrected weight value;

[0128] Depth-first search module: used to traverse nodes in descending order according to the modified weight values ​​and record the visited nodes and paths;

[0129] Path termination determination module: used to determine whether the current node has any unvisited adjacent nodes or whether the preset search depth limit has been reached; if there are no adjacent unvisited nodes or the depth limit has been reached, the search is terminated;

[0130] Attack path recording module: used to record the current path as an attack path whenever the search ends;

[0131] Attack graph generation module: used to summarize all recorded attack paths and generate the final attack graph.

[0132] Example:

[0133] In this example, we will show how to use the depth-first search algorithm based on node asset weights to generate an attack graph. Figure 6 As shown, assume there is an enterprise network, including 4 terminal devices, one of which is a key asset terminal, and 7 servers, namely domain server, database, file server, workstation, mail server, web application server, and access control system;

[0134] First, the initial weight value is determined for each node according to the intelligent node weight calculation algorithm. Factors such as node vulnerability, topological structure importance, and asset importance are comprehensively considered. Figure 7 As shown;

[0135] Next, use the depth-first search algorithm to traverse the nodes in the network, starting from the attacker's attack machine, and explore possible attack paths according to the priority of node weight. During the search process, give priority to exploring nodes with higher weights to ensure that the most important nodes are explored first. In order to avoid repeated visits and falling into an infinite loop, it is necessary to mark the nodes that have been visited; use a Boolean array to record the access status of the nodes. Whenever a node is visited, it is marked as visited. During the search process, it is necessary to record the nodes and paths that have been visited. Use a list to record the current search path. Whenever a node is explored downward, it is added to the path and popped out when returning. When the current node has no adjacent unvisited nodes or the preset search depth limit has been reached, the search terminates, the current path is recorded as an attack path, and the search is continued by backtracking to the previous node until all possible attack paths are found.

[0136] Finally, the generated attack paths are evaluated. According to the actual situation and security requirements, the importance of the attack paths can be analyzed and scored. Through the above steps, a depth-first search attack graph based on node asset weights can be generated, such as Figure 8 As shown in the figure, the attacker's attack machine is used as the starting node, and possible attack paths are explored according to the priority of node weights. Since the database is assigned the highest initial weight value, the database node and domain control server node are explored first; then, the attacker can further attack the mail server and web application server through these two nodes. This attack graph shows possible attack paths, which helps to understand the security risks of the network and formulate corresponding security policies. The actual attack graph generated may be more complex, depending on the combined influence of network topology, node weights and other factors.

[0137] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A depth-first search attack graph generation method based on node asset weights, characterized in that: The following steps are involved: By comprehensively evaluating the characteristics of each node in the network, the comprehensive importance score of each node is calculated, and the initial weight value is obtained based on the comprehensive importance score; By real-time traffic monitoring and periodic polling of network status, the initial weight value of each node in the network is dynamically adjusted to obtain the corrected weight value; Traverse the nodes in descending order of the modified weight values ​​and record the visited nodes and paths; When the current node has no adjacent unvisited nodes or the preset search depth limit has been reached, the search terminates. At this time, the current path is used as an attack path and the search continues back to the previous node until all possible attack paths are found. The process terminates after searching all possible paths and generates an attack graph.

2. A depth-first search attack graph generation method based on node asset weights according to claim 1, characterized in that: The characteristics of each node include: vulnerability impact value, topology importance and asset importance The method of calculating the comprehensive importance score of each node by comprehensively evaluating the characteristics of each node in the network includes the following steps: The vulnerability impact value assessment method includes the following steps: The impact evaluation reflects the direct consequences of a successful exploitation of a vulnerability and indicates the status of the affected components. The impact score is calculated as follows: When scope = fixed: impact score = 6.42 × ISCbase; When scope = change: impact score = 7.52×(ISCbase-0.029)-3.25×(ISCbase-0.02)^15; Where: ISCbase is a temporary variable, ISCbase = 1-[(1-confidentiality impact) × (1-integrity impact) × (1-availability impact)]; The exploitability evaluation reflects the ease of exploitation and technical difficulty of the exploitable vulnerability, indicating the difficulty of attacking the vulnerable component. The exploitability score calculation formula is: Exploitability score = 8.22 × attack vector × attack complexity × permission requirement × user interaction; The importance of topological structure is determined by the connectivity, influence, and community structure of nodes; The importance of an asset is determined by quantifying the confidentiality, integrity, and availability of a node; Weights are set for vulnerability impact value, topology importance, and asset importance respectively, and then a weighted summation method is used to obtain the comprehensive importance score of each node.

3. A depth-first search attack graph generation method based on node asset weights according to claim 1, characterized in that: Real-time traffic monitoring also includes the step of setting traffic thresholds. The reference factors of traffic thresholds include: historical data, business needs, industry standards and best practices.

4. A depth-first search attack graph generation method based on node asset weights according to claim 3, characterized in that: The method for dynamically adjusting the initial weight value of each node in the network includes: when the real-time traffic of a node exceeds a threshold, increasing its weight value; when the real-time traffic of a node returns to normal, reducing its weight value.

5. A depth-first search attack graph generation method based on node asset weights according to claim 4, characterized in that: The method for regularly polling network status comprises the following steps: Set the polling period; Node status query; Performance parameter collection; Perform status analysis and judgment based on the collected node status and performance parameters; Exception handling and adjustment; Records and reports.

6. A depth-first search attack graph generation method based on node asset weights according to claim 5, characterized in that: After generating the attack graph, the generated attack paths are evaluated.

7. A depth-first search attack graph generation system based on node asset weights, characterized in that: include: Feature evaluation module: used to comprehensively evaluate the features of each node in the network, calculate the comprehensive importance score of each node, and obtain the initial weight value based on the comprehensive importance score; Weight adjustment module: used to monitor network traffic in real time and poll the network status regularly, adjust the initial weight value of the node according to the monitoring results, and obtain the corrected weight value; Depth-first search module: used to traverse nodes in descending order according to the modified weight values ​​and record the visited nodes and paths; Path termination determination module: used to determine whether the current node has any unvisited adjacent nodes or whether the preset search depth limit has been reached; if there are no adjacent unvisited nodes or the depth limit has been reached, the search is terminated; Attack path recording module: used to record the current path as an attack path whenever the search ends; Attack graph generation module: used to summarize all recorded attack paths and generate the final attack graph.

Images