Method and system for improving network security defense capability, and computer readable storage medium

Abstract

The invention discloses a method and a system for improving network security defense capability, and a computer readable storage medium. The method comprises the steps of determining vulnerabilities of a target node; analyzing attack indexes corresponding to the vulnerabilities; based on the attack index, determining a comprehensive index generated for the vulnerability attack; based on the comprehensive index, determining the probability that the target node is attacked; and migrating the attack state of the target node based on the probability. According to the method, through simulation and analysis of vulnerabilities possibly utilized by attackers and quantitative analysis of attack indexes of the vulnerabilities, potential behavior threats of the attackers can be restored more truly and more accurately, and a defense deployment strategy can be implemented through vulnerability optimization; and one or more defense points are randomly selected to block or interfere the action of an attacker, so that the network security defense capability is improved. According to the method, the quantitative analysis algorithm for the attack indexes of the vulnerabilities is simple, the quantitative operation complexity can be reduced, the computing power consumption can be saved, and the response speed of the network security defense capability can be improved.

Description

[0001] This application is a divisional application with application date of 2024.07.26, application number 202411011209.8, and invention name of network security defense method and system based on vulnerability exploitation, and computer-readable storage medium. Technical Field

[0002] The present invention generally relates to the field of network security technology, and in particular to a method for improving network security defense capability, a system for improving network security defense capability, and a computer-readable storage medium. Background Art

[0003] In the process of digital twin deduction, the behavior threat of potential attackers cannot be accurately restored based on limited information, and the defense deployment strategy cannot be optimized. Traditional random processes lack quantitative calculation of indicators and lack credibility in the process of simulating attackers' decision-making on attack targets. Numerical calculations in high-dimensional space will generate large consumption, and the standardization and quantification of simulation signal indicators are complex.

[0004] The contents of the background technology section are merely the technologies known to the inventors and do not necessarily represent the prior art in the field. Summary of the invention

[0005] In view of one or more of the problems existing in the prior art, the present invention provides a network security defense method based on vulnerability exploitation, comprising:

[0006] Determine the vulnerabilities of the target node;

[0007] Analyze the attack indicators corresponding to the vulnerabilities;

[0008] Based on the attack indicator, determine a comprehensive indicator generated by the vulnerability attack;

[0009] Based on the comprehensive indicator, determining the probability of the target node being attacked; and

[0010] Based on the probability, the attack state of the target node is migrated.

[0011] Optionally, the attack indicators include: one or more of attack capability, attack cost, attack concealment, attack weapon adaptability, defense facility confrontation capability, defense bypass capability, attack benefit, and attack payload delivery times.

[0012] Optionally, the step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the attack capability of the vulnerability; the step of analyzing the attack capability of the vulnerability includes: analyzing the attack capability of the vulnerability based on the sub-score of the exploitability indicator in the general vulnerability scoring system.

[0013] Optionally, the step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the attack cost of the vulnerability; the step of analyzing the attack cost of the vulnerability includes: analyzing the attack cost of the vulnerability based on the attack complexity, attack path and permission requirements of the vulnerability.

[0014] Optionally, the step of analyzing the attack cost of the vulnerability based on the attack complexity, attack path and permission requirement of the vulnerability includes:

[0015] Determining a weight vector of the attack complexity, attack vectors, and authority requirements;

[0016] Quantify the attack complexity, attack vectors, and permission requirements based on the Common Vulnerability Scoring System; and

[0017] Based on the weight vector and the quantized value, the attack cost of the vulnerability is determined.

[0018] Optionally, the step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the attack concealment of the vulnerability;

[0019] The step of analyzing the attack concealment of the vulnerability includes:

[0020] Determine the user interactivity and usability of the vulnerability based on the Common Vulnerability Scoring System;

[0021] The attack concealment of the vulnerability is determined based on the user interactivity and usability.

[0022] Optionally, the step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the suitability of the attack weapon of the vulnerability;

[0023] The step of analyzing the suitability of the attack weapon of the vulnerability includes:

[0024] Based on the vulnerabilities, match the attacker’s weapon knowledge base;

[0025] Based on the maturity of the exploit code of the attack weapon in the weapon knowledge base, the compatibility of the attack weapon with the vulnerability is determined.

[0026] Optionally, the step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the defense facility confrontation capability of the vulnerability;

[0027] The step of analyzing the defense facility confrontation capability of the vulnerability includes:

[0028] Detect whether the vulnerability has defense facilities;

[0029] When it is detected that the vulnerability has a defense facility, determining the confrontation level of the defense facility;

[0030] Based on the confrontation level, the confrontation capability of the defense facilities of the vulnerability is determined.

[0031] Optionally, the defense facility countermeasure capability R adversary The following relations are satisfied:

[0032]

[0033] Among them, R adversary Indicates the defense facility's countermeasure capability, S adversary Indicates the rating of the confrontation level.

[0034] Optionally, the step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the defense bypass capability of the vulnerability;

[0035] The step of analyzing the defense bypass capability of the vulnerability comprises:

[0036] Detect whether the vulnerability has defense facilities;

[0037] When it is detected that the vulnerability has a defense facility, determining a defense type of the defense facility;

[0038] Based on the defense type, a defense bypass capability of the vulnerability is determined.

[0039] Optionally, the network security defense method further includes:

[0040] Determine the number of said defense types;

[0041] When it is determined that there are multiple defense types, the defense bypass capability of the vulnerability is determined based on the product of the defense bypass capabilities of the multiple defense types.

[0042] Optionally, the step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the attack benefits of the vulnerability;

[0043] The step of analyzing the attack benefits of the vulnerability includes:

[0044] Determining the asset type of the target node;

[0045] Based on the asset type, determining the asset value of the target node;

[0046] The attack benefit of the vulnerability is determined based on the asset value of the target node and the confidentiality, integrity and availability of the vulnerability.

[0047] Optionally, the network security defense method further includes:

[0048] Determine the number of said vulnerabilities;

[0049] When it is determined that there are multiple vulnerabilities, the ratio of the attack benefit of each vulnerability to the maximum attack benefit of all vulnerabilities is determined.

[0050] Optionally, the step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the number of times the attack payload of the vulnerability is delivered;

[0051] The step of analyzing the attack payload delivery times of the vulnerability includes:

[0052] Determine the number of times the target attack path of the vulnerability needs to deliver the attack payload, and the number of target nodes involved in the attack;

[0053] Determine the ratio of the attack payload delivery times to the number of attack target nodes.

[0054] Optionally, the step of determining a comprehensive indicator generated for the vulnerability attack based on the attack indicator includes:

[0055] Based on the attack indicator, determine the attack indicator component value of the vulnerability:

[0056] Based on the attack indicator component values ​​of the vulnerability, a comprehensive indicator generated by the attack on the vulnerability is determined.

[0057] Optionally, the attack index component value R of the i-th vulnerability Vuli The following relations are satisfied:

[0058]

[0059] in, Indicates the attack benefit, Indicates the stealthiness of the attack. Indicates attack capability. Indicates weapon compatibility. represents the attack cost, Indicates defense bypass capability, Indicates the confrontation capability of defense facilities.

[0060] Optionally, the step of determining the probability of the target node being attacked based on the comprehensive indicator includes:

[0061] Based on the ratio of the attack index component value of the vulnerability to the comprehensive index, the probability of the target node being attacked is determined.

[0062] Optionally, the step of migrating the attack state of the target node based on the probability includes:

[0063] The attack index component values ​​of the vulnerability are normalized as the probability basis for the decision of the target node being attacked, so as to transfer the state of the target node.

[0064] Optionally, the step of transferring the state of the target node includes: changing a state mark of the target node and / or a device associated with the target node.

[0065] The present invention also provides a network security defense system based on vulnerability exploitation, comprising:

[0066] Memory; and

[0067] processor,

[0068] The memory includes computer executable instructions stored thereon, and when the executable instructions are executed by the processor, the network security defense method described above is implemented.

[0069] The present invention also provides a computer-readable storage medium, including computer-executable instructions stored thereon, and the executable instructions implement the network security defense method as described above when executed by a processor.

[0070] Compared with the prior art, the network security defense method of the present invention can restore the behavioral threats of potential attackers more realistically and accurately by simulating and analyzing the vulnerabilities that attackers may exploit and quantifying the attack indicators of the vulnerabilities. It can optimize the implementation of defense deployment strategies by using the vulnerabilities, and randomly select one or more defense points to block or interfere with the actions of attackers, thereby improving network security defense capabilities. The quantitative analysis algorithm of the attack indicators of the vulnerabilities of the present invention is simple, which can reduce the complexity of quantitative calculations, save computing power consumption, and is conducive to improving the response speed of network security defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0072] Figure 1 A flow chart of a network security defense method based on vulnerability exploitation according to some embodiments of the present invention is shown.

[0073] Figure 2 A flow chart of step S120 according to some embodiments of the present invention is shown.

[0074] Figure 3 A schematic diagram of a network security defense system based on vulnerability exploitation according to some embodiments of the present invention is shown. DETAILED DESCRIPTION

[0075] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0076] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, which are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first" and "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0077] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", and "coupled" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection, an electrical connection, or mutual communication; it can be directly connected, or indirectly connected through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0078] In the present invention, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may include that the first and second features are in direct contact, or may include that the first and second features are not in direct contact but are in contact through another feature between them. Moreover, a first feature being "above", "above" and "above" a second feature includes that the first feature is directly above and obliquely above the second feature, or simply means that the first feature is higher in level than the second feature. A first feature being "below", "below" and "below" a second feature includes that the first feature is directly below and obliquely below the second feature, or simply means that the first feature is lower in level than the second feature.

[0079] Many different embodiments or examples are provided below to realize different structures of the present invention. In order to simplify the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or reference letters in different examples, and this repetition is for the purpose of simplicity and clarity, which itself does not indicate the relationship between the various embodiments and / or settings discussed. In addition, the present invention provides various specific processes and examples of materials, but those of ordinary skill in the art can be aware of the application of other processes and / or the use of other materials.

[0080] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0081] The present invention provides a network security defense method based on vulnerability exploitation, comprising: determining the vulnerability of a target node; analyzing attack indicators corresponding to the vulnerability; determining comprehensive indicators generated by the vulnerability attack based on the attack indicators; determining the probability of the target node being attacked based on the comprehensive indicators; and migrating the attack state of the target node based on the probability.

[0082] Compared with the prior art, the network security defense method of the present invention can restore the behavioral threats of potential attackers more realistically and accurately by simulating and analyzing the vulnerabilities that attackers may exploit and quantifying the attack indicators of the vulnerabilities. It can optimize the implementation of defense deployment strategies by using the vulnerabilities, and randomly select one or more defense points to block or interfere with the actions of attackers, thereby improving network security defense capabilities. The quantitative analysis algorithm of the attack indicators of the vulnerabilities of the present invention is simple, which can reduce the complexity of quantitative calculations, save computing power consumption, and is conducive to improving the response speed of network security defense capabilities.

[0083] Figure 1 FIG. 1 is a flowchart of a network security defense method based on vulnerability exploitation according to some embodiments of the present invention. Figure 1 As shown, the network security defense method 100 based on vulnerability exploitation includes steps S110 to S150. Figure 2 FIG. 4 is a flow chart showing step S120 according to some embodiments of the present invention. Figure 2 As shown, step S120 includes sub-steps S121 to S128. Figure 1 and Figure 2 Each step of the network security defense method 100 is introduced in detail.

[0084] In step S110, the vulnerability of the target node is determined. For example, the vulnerability of the target node can be determined using an intrusion detection system, a vulnerability scanning tool, etc. It should be understood that the vulnerability is attached to the application, the application is attached to the operating system, and the operating system is attached to network devices, routers, servers and other devices. The operating system has an independent IP, and an IP can be used as a node. By determining the corresponding relationship between the node and the IP, the vulnerability of the node can be determined.

[0085] In step S120, the attack indicators corresponding to the vulnerability are analyzed. The attack indicators include: attack capability, attack cost, attack concealment, attack weapon adaptability, defense facility confrontation capability, defense bypass capability, attack benefit, and attack payload delivery times. By quantitatively analyzing the attack indicators of the vulnerability, the behavioral threats of potential attackers can be restored more accurately, and the defense deployment strategy can be optimized.

[0086] In some embodiments, the step of analyzing the attack indicators corresponding to the vulnerability (step S120) includes: sub-step S121, analyzing the attack capability of the vulnerability. The attack capability of the vulnerability is related to the exploitability of the vulnerability. The higher the exploitability of the vulnerability, the higher the feasibility of the attack of the vulnerability. Analyzing the attack capability of the vulnerability can be converted into analyzing the exploitability of the vulnerability. Specifically, the vulnerability attack capability can be analyzed based on the sub-score of the exploitability indicator in the Common Vulnerability Scoring System (CVSS).

[0087] The attack capability of the vulnerability can be expressed by formula (1):

[0088] R ability =S exploit ……(1)

[0089] Among them, R ability is the attack capability of the vulnerability, S exploit A subscore for the exploitability metric of the vulnerability.

[0090] The attack capability of a vulnerability is positively correlated with the sub-score of the exploitability index. The higher the sub-score of the exploitability index, the higher the exploitability of the vulnerability and the stronger the attack capability of the vulnerability. The lower the sub-score of the exploitability index, the lower the exploitability of the vulnerability and the weaker the attack capability of the vulnerability.

[0091] In some embodiments, the step of analyzing the attack indicators corresponding to the vulnerability (step S120) includes: sub-step S122, analyzing the attack cost of the vulnerability. Specifically, the attack complexity (AC), attack path (AV) and permission requirement (PR) of the vulnerability can be evaluated. Based on the attack complexity, attack path and permission requirement of the vulnerability, the attack cost of the vulnerability is analyzed. It should be understood that higher attack complexity and local attack paths and physical exploitation situations mean higher attack costs.

[0092] In network attacks, for attackers, the attack path determines whether most attacks can be implemented, compared with the attack complexity and permission requirements. For example, if a vulnerability requires a local attack path, the attacker cannot directly exploit it through the remote network (Internet). The attacker can directly access the target assets and related vulnerabilities before considering the attack complexity and permission requirements. In other words, when analyzing the attack cost of a vulnerability, you can first analyze the attack path of the vulnerability, and then analyze the attack complexity and permission requirements of the vulnerability.

[0093] In some embodiments, based on the attack complexity, attack paths and permission requirements of the vulnerability, the step of analyzing the attack cost of the vulnerability includes: determining the weight vectors of the attack complexity, attack paths and permission requirements. It should be noted that the present invention does not limit the specific determination method of the weight vectors of the attack complexity, attack paths and permission requirements, and the following is introduced by taking the hierarchical analysis method as an example.

[0094] For example, according to the conditions (e.g., the CVE vector of the vulnerability, which can be determined comprehensively based on the vulnerability, attack means, attack intensity, etc.), each indicator in the vulnerability attack complexity AC, attack path AV, and permission requirement PR can be compared with the other two indicators to construct a hierarchical analysis matrix M. AHP ,as follows:

[0095]

[0096] The hierarchical analysis matrix M AHP Perform normalized calculations to obtain the weight vectors of attack complexity AC, attack path AV, and permission requirement PR:

[0097]

[0098] Among them, the weight vector w1 of attack complexity is 0.081, the weight vector w2 of attack path is 0.739, and the weight vector w3 of permission requirement is 0.179. It should be noted that the matrix M here AHP The weight w is merely an exemplary introduction and does not constitute a limitation to the present invention.

[0099] In some embodiments, the step of analyzing the attack cost of the vulnerability based on the attack complexity, attack vectors, and permission requirements of the vulnerability also includes: quantifying the attack complexity, attack vectors, and permission requirements based on a common vulnerability scoring system.

[0100] Specifically, based on the common vulnerability scoring system, the attack complexity (AC) can be quantified for the CVSS indicator to obtain the attack complexity score S AC , as shown in Table 1: L, M, and H represent the levels of attack complexity, L represents low (Low), M represents medium (Medium), and H represents high (High).

[0101] Table 1

[0102]

[0103] Similarly, for the CVSS indicator, the attack path (AV) is quantified and the attack path score S is obtained. AV , as shown in Table 2: N, A, L, and P represent attack paths respectively, N represents the Internet (Network), A represents the adjacent network (AdjacentNetwork), L represents the local (Local), and P represents the physical (Physical).

[0104] Table 2

[0105]

[0106] Similarly, in CVSS2, authentication requirements (AU) are used to replace permission requirements (PR) in CVSS3. The permission requirements (PR) are quantified and the score S of the permission requirements is obtained. PR As shown in Table 3: In CVSS3 (PR), N means no permission requirement (None), L means low permission requirement (Low), and H means high permission requirement (High); in CVSS3 (AU), N means no authentication required (None), S means one authentication is required (Single), and M means multiple authentications are required (Multiple).

[0107] Table 3

[0108]

[0109] In some embodiments, based on the attack complexity, attack path and permission requirements of the vulnerability, the step of analyzing the attack cost of the vulnerability also includes: determining the attack cost of the vulnerability based on the weight vector and the quantized value (ie, the score).

[0110] The attack cost of the vulnerability can be expressed by formula (2):

[0111] R cost =S AC w1+S AV w2+S PR w3……(2)

[0112] Among them, R cost is the attack cost of the vulnerability, S AC is the score of attack complexity (i.e., quantitative value), w1 is the weight of attack complexity, S AV is the score of the attack path, w2 is the weight of the attack path, S PR is the score of the permission requirement, and w3 is the weight of the permission requirement.

[0113] In some embodiments, the step of analyzing the attack indicators corresponding to the vulnerability (step S120) includes: sub-step S123, analyzing the attack concealment of the vulnerability. Specifically, the user interactivity (UI) and availability (A) of the vulnerability can be determined based on the general vulnerability scoring system. The attack concealment of the vulnerability is determined based on the user interactivity and availability. It should be understood that higher user interaction and higher availability will reduce the concealment of the attack. In other words, the attack concealment of the vulnerability is negatively correlated with user interaction and availability.

[0114] Generally speaking, when an attacker launches an attack, the attacker must participate in order to complete it. Compared with the fact that an attack has a certain degree of usability impact on the user system, whether user interaction is required has a greater impact on the concealment of the attack. Since the CVSS2.0 scoring system does not introduce user interaction indicators, the user interaction indicator can be adapted to the attack complexity (AC), and the complexity higher than Medium is considered to require user interaction.

[0115] According to the CVSS indicator, the user interaction is quantified and the user interaction score S is obtained. UI As shown in Table 4: In CVSS3 (UI), N means no user interaction is required, and R means user interaction is required; in CVSS2 (AC), L means low (Low), which is considered as no user interaction is required, M means medium (Medium), and H means high (High), that is, M / H is considered as requiring user interaction.

[0116] Table 4

[0117]

[0118] Similarly, for the CVSS indicator, the availability (A) is quantified and the availability score S is obtained. AAs shown in Table 5: In CVSS3(A), N, L, and H represent the availability levels, respectively. N represents None, L represents Low, and H represents High. In CVSS2(A), N represents no impact, P represents partial impact, and C represents complete impact.

[0119] Table 5

[0120]

[0121] The attack concealment of the vulnerability can be expressed by formula (3):

[0122]

[0123] Among them, R hidden is the attack concealment of the vulnerability, S UI is the score of user interaction (i.e., quantitative value), S A Rating for usability.

[0124] In some embodiments, the step of analyzing the attack indicators corresponding to the vulnerability (step S120) includes: sub-step S124, analyzing the suitability of the attack weapon of the vulnerability. Specifically, the attacker's weapon knowledge base can be matched based on the vulnerability. Based on the maturity of the exploit code of the attack weapon in the weapon knowledge base, the suitability of the attack weapon and the vulnerability is determined.

[0125] The compatibility between attack weapons and vulnerabilities is positively correlated with the maturity of the exploit code of the attack weapons. The target vulnerability is matched with the attacker's own weapon knowledge base. For exploitable vulnerabilities, the higher the maturity of the exploit code, the higher the matching degree of the weapon used in this attack. Correspondingly, the lower the maturity of the exploit code, the lower the matching degree of the weapon used in this attack. The analysis of the compatibility of the attack weapon of the vulnerability can be converted into the analysis of the maturity of the exploit code.

[0126] Using code maturity, we can quantify the code maturity and get the code maturity score S. E , as shown in Table 6:

[0127] Table 6

[0128] Exploiting Code Maturity (E) <![CDATA[S E ]]> Not available (U) 0 Proof of Concept 0.2 Functional use available (F) 0.5 Mature (H) 0.9

[0129] The vulnerability attack weapon suitability can be expressed by formula (4):

[0130] R exploit =S E ……(4)

[0131] Among them, R exploitis the compatibility between the attack weapon and the vulnerability, S E To exploit code maturity.

[0132] In some embodiments, the step of analyzing the attack indicators corresponding to the vulnerability (step S120) includes: sub-step S125, analyzing the defense facility confrontation capability of the vulnerability. Specifically, detecting whether the vulnerability has defense facilities; when it is detected that the vulnerability has defense facilities, determining the confrontation level of the defense facilities. Based on the confrontation level, determining the defense facility confrontation capability of the vulnerability. The confrontation level includes, for example, no protection, weak protection, strong protection, and strict protection.

[0133] Quantify the confrontation level and obtain the confrontation level score S adversary , as shown in Table 7:

[0134] Table 7

[0135] Confrontation level Interpretation <![CDATA[S adversary ]]> No protection Does not detect malicious traffic 0 Weak protection General keyword matching, etc. 2 Strong protection Possess certain traffic analysis capabilities 4 Strict protection Able to detect the protocol and perform certain decryption processing 7

[0136] The defense capability of the vulnerability can be expressed by formula (5):

[0137]

[0138] Among them, R adversary Indicates the ability to resist, S adversary Indicates the rating of the confrontation level.

[0139] When it is detected that the target vulnerability has certain defense facilities (for example, defense equipment), the attacker matches his own attack capability based on the fingerprint information of the defense equipment and his own defense evasion and confrontation capabilities. The target vulnerability matches the confrontation capability of its own defense facilities based on the attacker's attack capability. A higher matching degree means a stronger confrontation capability of the defense facilities. For example, when there are some defense equipment, the attacker needs to improve the attack payload, or use a certain algorithm to confuse sensitive data to bypass the detection rules of the defense equipment. Often in an attack, the attacker may give priority to using mature, simple and easy-to-construct attack payloads to carry out the attack behavior, but the existence of defense facilities will make this attack invalid. Therefore, in order to break through the current node, the attacker needs to implement a further enhanced attack. In order to prevent being broken, the node vulnerability can further improve the confrontation level of the defense facilities. At the same time, the number of times the attack payload is delivered will also increase the probability of the attacker being exposed and detected, thereby affecting the attack cost estimation.

[0140] In some embodiments, the step of analyzing the attack indicators corresponding to the vulnerability (step S120) includes: sub-step S126, analyzing the defense bypass capability of the vulnerability. Specifically, detect whether the vulnerability has defense facilities. When it is detected that the vulnerability has defense facilities, determine the defense type of the defense facilities. Based on the defense type, determine the defense bypass capability of the vulnerability. Defense types include unprotected, Web Application Firewall (WAF), operating system firewall, Extended Detection and Response (XDR), intrusion detection system (IDS), etc.

[0141] Quantify the defense type of the vulnerability and obtain the score S of the defense type of the vulnerability defend , as shown in Table 8:

[0142] Table 8

[0143]

[0144]

[0145] The vulnerability's defense bypass capability can be expressed by formula (6):

[0146] R defend =1-S defend ……(6)

[0147] Among them, R defend The defense bypass capability of the vulnerability, S defend A score for the defense type of the vulnerability.

[0148] The vulnerability's defense bypass capability is negatively correlated with the defense type score. The higher the vulnerability's defense type score, the weaker the vulnerability's defense bypass capability, and the less vulnerable the vulnerability is to attack. The lower the vulnerability's defense type score, the stronger the vulnerability's defense bypass capability, and the easier the vulnerability is to attack.

[0149] When it is detected that the target vulnerability has certain defense facilities, the attacker can decide the priority of attack according to the defense facilities of the defense equipment based on his own capabilities and tool usage. For example, the attacker can prioritize vulnerabilities with lower defense type scores (for example, less than 0.5 points) to achieve better attack effects.

[0150] In some embodiments, the number of defense types may be determined. When it is determined that there are multiple defense types, the defense bypass capability of the vulnerability is determined based on the product of the defense bypass capabilities of the multiple defense types, which can be expressed by formula (7):

[0151]

[0152] Where n is the number of vulnerabilities, R i is the defense bypass capability of the ith vulnerability, R′ defend The defense bypass capability for n vulnerabilities.

[0153] Similarly, when there are multiple defense devices, the product of the defense bypass capabilities of all defense devices can be taken to determine the defense bypass capability of the vulnerability.

[0154] In some embodiments, the step of analyzing the attack indicators corresponding to the vulnerability (step S120) includes: sub-step S127, analyzing the attack benefits of the vulnerability. Specifically, the asset type of the target node can be determined. The asset types include domain control, database, bastion host, file server, World Wide Web (Web) server, reverse proxy server, etc. Based on the asset type, the asset value of the target node is determined. Based on the asset value of the target node and the confidentiality, integrity and availability of the vulnerability, the attack benefits of the vulnerability are determined.

[0155] Table 9 shows some asset types of target nodes and their estimated values, as follows:

[0156] Table 9

[0157] Asset Type Value Estimation Domain Controller 10 database 9 Bastion Host 9 File Server 8 Web Server 5 Reverse Proxy Server 3 …… ……

[0158] According to the CVSS indicator, the confidentiality (C) is quantified and the score S of confidentiality (C) is obtained. C As shown in Table 10: In CVSS3(C), N, L, and H represent the confidentiality level, respectively. N represents None, L represents Low, and H represents High. In CVSS2(C), N represents no impact, P represents partial impact, and C represents complete impact.

[0159] Table 10

[0160]

[0161] According to the CVSS indicator, the integrity (I) is quantified and the score S of the integrity (I) is obtained. I As shown in Table 11: In CVSS3(I), N, L, and H represent the integrity level, respectively. N represents None, L represents Low, and H represents High. In CVSS2(I), N represents None, P represents Partial, and C represents Complete.

[0162] Table 11

[0163]

[0164] According to the CVSS indicator, the availability (A) is quantified and the score S of availability (A) is obtained. A As shown in Table 12: In CVSS3(A), N, L, and H represent the availability levels, respectively. N represents None, L represents Low, and H represents High. In CVSS2(A), N represents None, P represents Partial, and C represents Complete.

[0165] Table 12

[0166]

[0167] Based on the asset value of the target node, combined with the obtained permissions and leaked data and credential information (i.e. the confidentiality, integrity and availability of the vulnerability), the attack benefits can be evaluated. Higher asset value and more leaked information lead to higher attack benefits.

[0168] In some specific organizational simulation scenarios, the damage effect of software and hardware also needs to be evaluated as attack benefit. A higher damage effect means a higher attack benefit. However, in some scenarios, it is believed that a continuous attack that causes a smaller damage effect to software and hardware can obtain a higher attack benefit.

[0169] In some embodiments, an evaluation parameter λ may be set to evaluate different damage effects, λ∈{0,1}, where a value of λ of 0 indicates that the current attack does not have a high-value benefit of damaging the target asset.

[0170] The attack benefit of the vulnerability can be expressed by formula (8):

[0171]

[0172] Among them, S gain is the attack profit of the vulnerability, S C Score confidentiality, S I S is the completeness score. A is the availability score, λ is the evaluation parameter of the damage effect, V asset For asset value.

[0173] In some embodiments, the network security defense method further includes: determining the number of vulnerabilities. When it is determined that there are multiple vulnerabilities, determining the ratio of the attack revenue of each vulnerability to the maximum attack revenue of all vulnerabilities. The ratio of the attack revenue of each vulnerability to the maximum attack revenue of all vulnerabilities is defined as the rate of return of the vulnerability.

[0174] For example, when there are m vulnerabilities, the attack benefits of all vulnerabilities are set D m , the maximum value of the attack benefits of all vulnerabilities is max(D m ), the attack benefit of the i-th vulnerability is S i , the rate of return of the ith vulnerability is R i It can be expressed by formula (9):

[0175]

[0176] In some embodiments, the step of analyzing the attack indicators corresponding to the vulnerability (step S120) includes: sub-step S128, analyzing the number of attack payload delivery times of the vulnerability. Specifically, the number of times the target attack path of the vulnerability needs to deliver the attack payload and the number of attack target nodes involved can be determined. The ratio of the number of attack payload delivery times to the number of attack target nodes can be determined.

[0177] Number of attack payload delivery times N payload Satisfies formula (10), as follows:

[0178]

[0179] Among them, N payload is the number of attack payload delivery times, N node is the number of target nodes involved in the attack, R payload It is the ratio of the number of attack payload delivery times to the number of attack target nodes.

[0180] It should be understood that a higher number of attack payload delivery times means that attackers are more likely to be responded to by defense facilities, that is, the vulnerability is less likely to be attacked.

[0181] In step S130, based on the attack indicator, a comprehensive indicator generated for the vulnerability attack is determined. Specifically, based on the attack indicator, an attack indicator component value of the vulnerability can be determined. Based on the attack indicator component value of the vulnerability, a comprehensive indicator generated for the vulnerability attack is determined.

[0182] The attack index component value and comprehensive index of the vulnerability can be calculated according to the two dimensions of positive and negative correlation. The positive correlation index of the i-th vulnerability includes the attack benefit Attack stealth Offensive Ability Compatibility with attack weapons Negatively correlated indicators include attack cost Defense bypass capabilities Ability to fight against defense facilities

[0183] The attack index component value of the i-th vulnerability It can be expressed by formula (11):

[0184]

[0185] The comprehensive index generated by vulnerability attacks can be expressed by formula (12):

[0186]

[0187] Among them, R C It is a comprehensive indicator generated for vulnerability attacks, defined as the sum of the attack indicator component values ​​of m vulnerabilities.

[0188] In step S140, the probability of the target node being attacked is determined based on the comprehensive index. Specifically, the probability of the target node being attacked can be determined based on the ratio of the attack index component value of the vulnerability to the comprehensive index.

[0189] The probability of a target node being attacked can be expressed by formula (13):

[0190]

[0191] It should be understood that the higher the probability of a target node being attacked, the easier it is for the target node to be attacked by an attacker. Correspondingly, the lower the probability of a target node being attacked, the easier it is for the target node to be attacked by an attacker.

[0192] In step S150, based on the probability of the target node being attacked, the attack state of the target node is migrated. Specifically, the attack index component value of the vulnerability is determined. Afterwards, the attack indicator component values ​​of the vulnerability can be normalized as the probability basis for the decision of the target node being attacked, so as to transfer the state of the target node. The state transfer of the target node includes changing the state mark of the target node and / or the target node associated device. After each evaluation of the probability of the target node being attacked, the attack state of the target node can be migrated accordingly. For example, the migration may include: changing the state mark of the target node, or changing the state mark of the target node associated device, or changing the state mark of the target node and its associated device at the same time. Specifically, for example, the vulnerability and device information associated with the target node can be changed, including but not limited to sensitive information, login credentials, higher permissions, etc.

[0193] Based on the probability of the target node being attacked, one or more defense points (i.e., target nodes) can be randomly selected to simulate the attacker's decision to execute attacks on the selected target nodes based on the defense situation of the network environment where the target node is located, the sensitive information and vulnerabilities that can be exploited, and the attacker's own attack methods, technical capabilities, 0day vulnerabilities, load information, etc., to optimize the implementation of defense deployment strategies, thereby blocking or interfering with the attacker's actions. For example, one or more target nodes with a high probability of being attacked (for example, greater than 0.5) can be randomly selected to block or interfere with the attacker's actions, thereby improving network security defense capabilities.

[0194] Compared with the prior art, the network security defense method of the present invention can restore the behavioral threats of potential attackers more realistically and accurately by simulating and analyzing the vulnerabilities that attackers may exploit and quantifying the attack indicators of the vulnerabilities. It can optimize the implementation of defense deployment strategies by using the vulnerabilities, and randomly select one or more defense points to block or interfere with the actions of attackers, thereby improving network security defense capabilities. The quantitative analysis algorithm of the attack indicators of the vulnerabilities of the present invention is simple, which can reduce the complexity of quantitative calculations, save computing power consumption, and improve the response speed of network security defense capabilities.

[0195] The network security defense method of the present invention is a network security defense method based on vulnerability exploitation. By simulating and analyzing the vulnerabilities that may be exploited by attackers, one or more defense points can be randomly selected to block or interfere with the attacker's actions. Through in-depth quantitative analysis of known vulnerabilities, it is possible to understand the attack methods and paths that the attacker may take, thereby providing a reliable reference for defense decisions. When faced with a large number of possible defense points, defense points can be randomly selected to increase the uncertainty of the attacker, making it impossible for him to predict the defense strategy, thereby improving the effectiveness of the defense. According to changes in the network environment and the attacker's actions, the selection of defense points can be adjusted in real time, so that the defense strategy has better adaptability and flexibility.

[0196] The network security defense method of the present invention can combine public vulnerability knowledge intelligence, APT organization intelligence and historical case study reports in the process of cyberspace defense deployment, through quantitative analysis and simulation of vulnerabilities that attackers may exploit, and simulate the attacker's decision-making process in combination with the current environment and defense deployment situation, and analyze and simulate the attack methods, attack paths and attack behaviors that attackers may take. It can provide a more reliable reference basis for defense decision-making, greatly improve the efficiency of research and judgment of defense deployment strategies, and save a lot of costs.

[0197] The network security defense method of the present invention can extract a large amount of relevant information of vulnerability intelligence from public vulnerability intelligence, including exploitation cost, exploitation complexity, exploitation tool maturity, vulnerability exploitation concealment, etc., and can also be combined with vulnerability point environment analysis to extract indicators such as current vulnerability defense device capabilities and levels, attack payload delivery times and attack payload construction complexity, exploitation success benefits, attacker defense bypass capabilities, and conduct quantitative evaluations. It can more realistically and accurately restore the behavioral threats of potential attackers, can utilize vulnerabilities to optimize the implementation of defense deployment strategies, and can provide a more reliable reference basis for defense decisions.

[0198] When simulating an attacker to launch an attack, the completeness of the intelligence information already acquired is estimated, and the cost-benefit is quantitatively evaluated by calculating all the target assets that the attacker may attack. The attacker's attack is close to a random walk process similar to a "drunkard's walk". However, the present invention is different from the traditional random walk in that in a general attack process, especially when the attacker has very limited information, the randomness of the attacker's decision is high. As the attack continues to deepen, the attacker will make empirical judgments based on previous results, and the randomness will decrease over time, which can increase the attacker's uncertainty and make it impossible to predict the defense strategy, thereby improving the effectiveness of the defense. In addition, by constructing the conditional probability of the Bayesian network model, adjusting the model parameters and selecting the probability range, more potentially vulnerable nodes can be more accurately exposed, so that defense deployment strategies can be implemented for these nodes.

[0199] The invention also provides a network security defense system based on vulnerability exploitation. Figure 3 FIG. 1 is a schematic diagram of a network security defense system according to some embodiments of the present invention. Figure 3 As shown, the network security defense system 200 includes a memory 210 and a processor 220. The memory 210 and the processor 220 are coupled. The memory 210 includes computer executable instructions stored thereon, and when the executable instructions are executed by the processor 220, the network security defense method 100 described above can be implemented.

[0200] The network security defense system of the present invention, by implementing the above-mentioned network security defense method, by simulating and analyzing the vulnerabilities that may be exploited by attackers, and by quantitatively analyzing the attack indicators of the vulnerabilities, can more realistically and accurately restore the behavioral threats of potential attackers, and can optimize the implementation of defense deployment strategies by utilizing vulnerabilities, and randomly select one or more defense points to block or interfere with the actions of attackers, thereby improving network security defense capabilities.

[0201] The present invention provides a computer-readable storage medium, including computer-executable instructions stored thereon, and the executable instructions implement the network security defense method 100 as described above when executed by a processor.

[0202] In some embodiments, the memory / computer readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device. Computer readable storage media include, but are not limited to, electrical, magnetic, optical, or semiconductor forms or devices, more specific examples (a non-exhaustive list) include: an electrical connection with one or more conductors, a portable computer hard disk, a hard disk, a random access memory (RAM), a non-volatile random access memory (NVRAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0203] In some embodiments, the processor may include a central processing unit (CPU), a microprocessing unit (MCU), and may also include other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components and other similar devices.

[0204] It should be noted that this specification provides method operation steps such as embodiments or schematic diagrams, but more or fewer operation steps may be included based on conventional or non-creative labor. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the actual system or device product is executed, it can be executed in the order of the method shown in the embodiment or flowchart or in parallel.

[0205] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for improving network security defense capability, characterized in that: include: Determine the vulnerabilities of the target node; Analyze the attack indicators corresponding to the vulnerability, wherein the attack indicators include attack capability and attack cost; Based on the attack indicator, determine a comprehensive indicator generated by the vulnerability attack; Based on the comprehensive indicator, determining the probability of the target node being attacked; and Based on the probability, migrating the attack state of the target node; The attack indicators corresponding to the vulnerability analysis include: Analyzing the attack capability of the vulnerability, including: analyzing the attack capability of the vulnerability based on a sub-score of the exploitability indicator in the common vulnerability scoring system; and Analyze the attack cost of the vulnerability, including: analyzing the attack cost of the vulnerability based on the attack complexity, attack path and permission requirement of the vulnerability.

2. The method according to claim 1, characterized in that The attack indicators include: one or more of: attack concealment, attack weapon adaptability, defense facility confrontation capability, defense bypass capability, attack benefit, and attack payload delivery times.

3. The method according to claim 1 or 2, characterized in that: The step of analyzing the attack cost of the vulnerability based on the attack complexity, attack path and permission requirement of the vulnerability includes: Determining a weight vector of the attack complexity, attack vectors, and authority requirements; Quantify the attack complexity, attack vectors, and permission requirements based on the Common Vulnerability Scoring System; and Based on the weight vector and the quantized value, the attack cost of the vulnerability is determined.

4. The method according to claim 1 or 2, characterized in that: The step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the attack concealment of the vulnerability; The step of analyzing the attack concealment of the vulnerability includes: Determine the user interactivity and usability of the vulnerability based on the Common Vulnerability Scoring System; The attack concealment of the vulnerability is determined based on the user interactivity and usability.

5. The method according to claim 1 or 2, characterized in that: The step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the attack weapon suitability of the vulnerability; The step of analyzing the suitability of the attack weapon of the vulnerability includes: Based on the vulnerabilities, match the attacker’s weapon knowledge base; Based on the maturity of the exploit code of the attack weapon in the weapon knowledge base, the compatibility of the attack weapon with the vulnerability is determined.

6. The method according to claim 1 or 2, characterized in that: The step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the defense facility confrontation capability of the vulnerability; The step of analyzing the defense facility confrontation capability of the vulnerability includes: Detect whether the vulnerability has defense facilities; When it is detected that the vulnerability has a defense facility, determining the confrontation level of the defense facility; Based on the confrontation level, the confrontation capability of the defense facilities of the vulnerability is determined.

7. The method according to claim 6, characterized in that The defense facility confrontation capability satisfies the following relationship: Among them, R adversary Indicates the defense facility's countermeasure capability, S adversary Indicates the rating of the confrontation level.

8. The method according to claim 1 or 2, characterized in that: The step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the defense bypass capability of the vulnerability; The step of analyzing the defense bypass capability of the vulnerability comprises: Detect whether the vulnerability has defense facilities; When it is detected that the vulnerability has a defense facility, determining a defense type of the defense facility; Based on the defense type, a defense bypass capability of the vulnerability is determined.

9. The method according to claim 8, characterized in that Also includes: Determine the number of said defense types; When it is determined that there are multiple defense types, the defense bypass capability of the vulnerability is determined based on the product of the defense bypass capabilities of the multiple defense types.

10. The method according to claim 1 or 2, characterized in that: The step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the attack benefits of the vulnerability; The step of analyzing the attack benefits of the vulnerability includes: Determining the asset type of the target node; Based on the asset type, determining the asset value of the target node; The attack benefit of the vulnerability is determined based on the asset value of the target node and the confidentiality, integrity and availability of the vulnerability.

11. The method according to claim 10, characterized in that Also includes: Determine the number of said vulnerabilities; When it is determined that there are multiple vulnerabilities, the ratio of the attack benefit of each vulnerability to the maximum attack benefit of all vulnerabilities is determined.

12. The method according to claim 1 or 2, characterized in that: The step of analyzing the attack indicators corresponding to the vulnerability includes: analyzing the number of times the attack payload of the vulnerability is delivered; The step of analyzing the attack payload delivery times of the vulnerability includes: Determine the number of times the target attack path of the vulnerability needs to deliver the attack payload, and the number of target nodes involved in the attack; Determine the ratio of the attack payload delivery times to the number of attack target nodes.

13. The method according to claim 1 or 2, characterized in that: The step of determining the comprehensive index generated for the vulnerability attack based on the attack index comprises: Based on the attack indicator, determine the attack indicator component value of the vulnerability: Based on the attack indicator component values ​​of the vulnerability, a comprehensive indicator generated by the attack on the vulnerability is determined.

14. The method according to claim 13, characterized in that The attack index component value of the i-th vulnerability The following relations are satisfied: in, Indicates the attack benefit, Indicates the stealthiness of the attack. Indicates attack capability. Indicates weapon compatibility. represents the attack cost, Indicates defense bypass capability, Indicates the defense facility's confrontation capability.

15. The method according to claim 13, characterized in that The step of determining the probability of the target node being attacked based on the comprehensive indicator includes: Based on the ratio of the attack index component value of the vulnerability to the comprehensive index, the probability of the target node being attacked is determined.

16. The method according to claim 13, characterized in that The step of migrating the attack state of the target node based on the probability comprises: The attack index component values ​​of the vulnerability are normalized as the probability basis for the decision of the target node being attacked, so as to transfer the state of the target node.

17. The method according to claim 16, characterized in that The step of transferring the state of the target node includes: changing the state mark of the target node and / or the device associated with the target node.

18. A system for improving network security defense capabilities, characterized in that: include: Memory; and processor, The memory includes computer executable instructions stored thereon, and when the executable instructions are executed by the processor, the method according to any one of claims 1 to 17 is implemented.

19. A computer-readable storage medium, characterized in that: The invention comprises computer executable instructions stored thereon, which, when executed by a processor, implement the method according to any one of claims 1 to 17.

Images