Implicit Markov model-based attacker behavior prediction system and method

Abstract

The invention provides an attacker behavior prediction system and method based on an implicit Markov model. The system comprises: a security database module for collecting information from an existing open source vulnerability library and an attack database, and constructing an influence mapping pair caused by attacker operation and on a target system for subsequent model training and zero-day attack detection; the system monitoring module is used for capturing attacker behaviors by using a kernel-level honeypot and generating a configuration file; the attacker modeling module is used for modeling activities of an attacker according to an attacker configuration file from the honeypot, generating a minimum attack graph and updating the attack graph according to real-time data; the graph data mapping module is used for aligning information in the minimum attack graph with parameters of the implicit Markov model; the attacker behavior prediction module is used for processing training data and behavior modeling in a simulated real-time environment, training by adopting a Baum-Welch algorithm and predicting by using a Viterbi algorithm; and finally, calculating the maximum likelihood path in the implicit Markov model, selecting the path with the maximum probability in the final time step, and determining and generating the most probable hidden state sequence of the given observation action sequence according to the path, namely the most probable behavior executed by the attacker in the next stage.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and specifically relates to an attacker behavior prediction system and method based on a hidden Markov model Background Art

[0002] Attacker behavior prediction is a complex research field in network security. By predicting the attacker's next move, security personnel can make correct security decisions to mitigate the malicious impact on the target system. However, due to the flexibility of network threats and the diversity of data required for analysis, this task is very challenging, mainly in terms of processing large data sets, identifying the attacker's motivations, and false positives and negatives during prediction.

[0003] At present, the Moving Target Defense (MTD) method has been widely adopted as the latest security mechanism. One of the strategies is to observe the attacker's behavior in a static system and extract rules based on it to build an attacker behavior model. However, with the continuous advancement of network attack technology, attackers can adjust their attack strategies through the static configuration of the system to bypass defense.

[0004] In addition, previous methods also use attack graphs (AGs) to track and analyze network attack paths and provide effective information for attacker behavior prediction. Specifically, they can be divided into two types: complete attack graphs (CAGs) and minimum attack graphs (MAGs). The complete attack graph contains all feasible paths between hosts, while the minimum attack graph only includes potential paths from each host to the target host. However, traditional attack graphs have some significant limitations:

[0005] 1) It only provides consistent information about the attack path, lacks records of active responses and environmental changes, and cannot reflect the actual situation of the system when facing attacks.

[0006] 2) Most attack graph generation algorithms provide static information about the possibility of exploiting vulnerabilities. Although they show potential attack paths, they are not reliable enough to predict future attacks.

[0007] 3) They do not consider zero-day attack paths, which makes them incomplete in dealing with unknown threats.

[0008] 4) As the scale of the network expands, the scalability problem of the attack graph is difficult to solve, and efficient analysis of large-scale graphs becomes difficult.

[0009] 5) Redundant paths and nodes in the attack graph may interfere with the prediction results and affect the generalization and robustness of the model.

[0010] Therefore, there is an urgent need for a method that can efficiently model the real-time behavior of attackers, has good robustness and flexibility, can better cope with complex and changing network attacks, and provide reliable guidance for defenders. Summary of the invention

[0011] In order to solve the above problems existing in the prior art, the present invention provides an attacker behavior prediction system and prediction method based on a hidden Markov model. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0012] In a first aspect, an embodiment of the present invention provides an attacker behavior prediction system based on a hidden Markov model, comprising:

[0013] The security database module collects information from existing open source vulnerability libraries and constructs action and impact data pairs for minimum attack graph generation and training phase to detect zero-day attacks.

[0014] System monitoring module, which uses kernel-level honeypot to capture attacker behavior and generate attacker profiles;

[0015] The attacker modeling module models the attacker’s activities based on the attacker profile from the honeypot and generates a dynamic minimum attack graph (MAGD);

[0016] A graph data mapping module that aligns information from the attacker behavior model with the Hidden Markov Model (HMM) parameters;

[0017] The attack behavior prediction module processes training data and behavior modeling in a simulated real-time environment, using the Baum-Welch algorithm for training and the Viterbi algorithm for prediction.

[0018] In one embodiment of the present invention, the kernel-level honeypot consists of two main parts, including:

[0019] The first part involves honeypot hiding technology, through which attackers cannot detect our deployed honeypots in the target network;

[0020] Specifically, Direct Kernel Object Manipulation (DKOM) is a hiding method used by kernel-level rootkits (a type of malware). This technique uses low-level programming methods (such as pointer operations and memory patching) to operate kernel data structures to hide processes, load drivers, change permissions, etc. Since DKOM technology is currently difficult to detect, we chose to use it to hide our monitoring tools. The use of DKOM technology means that the honeypot monitoring tool can be discretely integrated into the kernel of the operating system without virtualizing or modifying the memory and kernel itself. In addition, kernel-level honeypots can also bypass the attacker's encrypted communication behavior and obtain unencrypted data.

[0021] The second part involves data recording methods, which are used to save information about the attacker's behavior;

[0022] Specifically, the honeypot will record all events that occur in the kernel in real time and generate an attacker profile. The specific attack behavior will be presented in the form of a five-tuple<Date,Time,IP,Action,Type> , respectively representing the date of the attack, the time of the attack process, the IP address of the attacker, the operation performed on the system, and the file type of the operation performed. This configuration file will be used in the attacker modeling module to construct a dynamic minimum attack graph.

[0023] In one embodiment of the present invention, the minimum attack graph is one of the most popular network attack modeling methods, including three steps of behavioral attacker model construction, graph generation and graph update, which are respectively composed of three algorithms:

[0024] Traditional attack graph algorithms generate a complete graph containing all possible attack paths, but it is difficult to visualize and further analyze because there are a large number of nodes and edges that are irrelevant to the actual attack. Therefore, in this paper, we use a minimum attack graph to mitigate the interference caused by redundant information. This method creates a special attack graph called a minimum attack subgraph (MAGD) based on the attacker information fed back by the honeypot. Each path corresponds to the action sequence of the attacker's real-time behavior, and also includes the impact of the attack operation on the target system.

[0025] First, in order to conveniently represent the attacker behavior in the form of a graph (nodes and edges), we reorganize the attacker behavior information into<s0,Act,S,→,F,IP> Six-tuple of . Among them, s0 represents the initial state of the attacker when entering the system, corresponding to the first record of the attacker information created in the honeypot; Act represents the set of behaviors of the attacker in the target system; S represents the set of states of the attacker in the target system; → represents the state transfer process; F represents the set of files accessed by the attacker; IP represents the IP address of the attacker.

[0026] Secondly, the graph generation algorithm constructs a minimum attack subgraph based on the regularized data. The generated minimum attack subgraph has two characteristics: ① The graph consists only of edges between the termination and target nodes; ② The graph only contains scenarios where the attack is successful. It maximizes the use of effective information and reduces the interference of redundant information.

[0027] Finally, the graph update algorithm updates the content of the minimum attack subgraph based on the latest dynamics fed back by the honeypot in real time, such as adding new nodes and edges to the graph, or modifying the previous attack path.

[0028] In one embodiment of the present invention, the Hidden Markov Model (HMM) is a machine learning model for characterizing a system of hidden and observable states, or for solving problems based on sequence information, such as time series or sequence states. This model is widely used in the field of network security, including but not limited to intrusion detection, malware analysis, and user behavior analysis.

[0029] Specifically, Hidden Markov Models can effectively detect abnormal behaviors and predict potential malicious activities by modeling and analyzing system logs, network traffic, and other security-related data. Its ability to capture time dependencies in data makes it particularly useful in predicting future malicious activities.

[0030] In one embodiment of the present invention, the Baum-Welch algorithm is an algorithm widely used to learn hidden Markov model (HMM) parameters from data. The algorithm estimates the model parameters through a forward-backward algorithm, and by updating the HMM parameters, maximizes the likelihood function of the observed data, thereby effectively training the model.

[0031] In one embodiment of the present invention, the Viterbi algorithm is an algorithm based on supervised learning. Different from the Baum-Welch algorithm, the Viterbi training algorithm directly updates parameters based on the optimal state path and has a more efficient learning process.

[0032] In a second aspect, an embodiment of the present invention provides an attacker behavior prediction method based on a hidden Markov model, which uses the attacker behavior prediction system based on a hidden Markov model described in the first aspect to complete the prediction.

[0033] Beneficial effects of the present invention:

[0034] 1. The state set in the dynamic minimum attack graph represents the attacker's behavior and the impact on the target system. The path in the graph accurately reflects the attacker's real-time behavior.

[0035] 2. The attacker monitoring tool used is a kernel-level honeypot, which can capture all the attacker's behaviors even if the attacker uses encryption.

[0036] 3. The attacker behavior modeling and prediction process is independent of the number of actions that occur in the attack sequence, and can handle attack sequences of varying lengths, with good flexibility and reliability.

[0037] 4. The dynamic minimum attack graph contains information about unknown attacks, and the system can be trained separately for these types of attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a general structural diagram of an attacker behavior prediction system based on a hidden Markov model provided in an embodiment of the present invention;

[0039] Figure 2 It is a flowchart of constructing a minimum attack subgraph (MAGD) in an embodiment of the present invention;

[0040] Figure 3 It is a step diagram of the attacker behavior prediction method based on the hidden Markov model;

[0041] Figure 4 It is the minimum attack subgraph generated according to the attacker behavior B1 in the case analysis;

[0042] Figure 5 It is the Markov chain generated according to the attacker behavior B1 in the case analysis;

[0043] Figure 6 It is the minimum attack subgraph generated according to the attacker behavior B2 in the case analysis;

[0044] Figure 7 It is the Markov chain generated according to the attacker behavior B2 in the case analysis; DETAILED DESCRIPTION

[0045] In order to enable those skilled in the art to better understand the scheme of the present invention and make the purpose and technical scheme of the present invention clearer, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present invention.

[0046] In a first aspect, the present invention provides an attacker behavior prediction system based on a hidden Markov model. Figure 1 As shown in the figure, the attacker behavior prediction system mainly includes:

[0047] The security database module collects information from existing open source vulnerability libraries and attack databases to construct mapping pairs between attacker operations and the impact on the target system, which are used for minimum attack graph generation and training phase to detect zero-day attacks.

[0048] System monitoring module, which uses kernel-level honeypot to capture attacker behavior to form a profile;

[0049] The attacker modeling module models the attacker’s activities based on the attacker profile from the honeypot and generates a dynamic minimum attack graph (MAGD);

[0050] A graph data mapping module that aligns information from the attacker behavior model with the Hidden Markov Model (HMM) parameters;

[0051] The attack behavior prediction module processes training data and behavior modeling in a simulated real-time environment, using the Baum-Welch algorithm for training and the Viterbi algorithm for prediction.

[0052] In general, the embodiment of the present invention first uses the vulnerability and attack information in the CVE and MITRE ATT&CK databases to build a database of attack behavior and target system impact mapping. Subsequently, the attacker's behavior is captured by a honeypot carefully set up in the target system, and the attacker's behavior model is regularized according to the configuration file to generate a dynamic minimum attack graph. In the process of generating the dynamic minimum attack graph, the constructed security database will be queried. If the vulnerability information used by the attacker cannot be obtained, it means that it is a zero-day vulnerability, and a zero-day attack detection report can be generated in time. At the same time, the minimum attack graph will change with the real-time feedback information of the honeypot, modify the path information, and add new nodes or edges. Real-time information is very helpful in improving the accuracy of prediction. Before inputting the data into the hidden Markov model, alignment processing is required. Finally, the trained hidden Markov model predicts the attacker's next behavior path based on the current minimum attack graph information.

[0053] The specific instructions are as follows.

[0054] For the security database module, this embodiment mainly uses the information in the CVE and MITRE ATT&CK databases to build a security database for minimum attack graph generation and zero-day attack detection in the training phase.

[0055] Specifically, the CVE (Common Vulnerabilities and Exposures) database is a standardized repository of known software and hardware vulnerabilities that assigns a unique identifier to each detected vulnerability. MITRE ATT&CK is a comprehensive knowledge base that records in detail the tactics, techniques, and procedures (TTPs) used by attackers, providing an important reference for understanding and defending against cyber threats. In actual attacks, attackers usually use a combination of multiple techniques in MITRE ATT&CK to exploit one or more CVEs. Therefore, mapping a single CVE to a single MITRE ATT&CK technique is not enough to fully reveal the complex cyber attack scenarios in reality.

[0056] The basis for constructing the minimum attack graph in this embodiment is to capture the behavior sequence of the attacker in the target system. The key lies in the abstract processing of the nature of the execution command and its expected impact on the target system. The attacker may use a variety of techniques described in the MITRE ATT&CK database to perform attack behaviors. To this end, we collected and identified technologies related to the vulnerabilities reported in the CVE database, and recorded the system calls (behaviors) corresponding to each CVE id and their impact on the target system. By capturing the mapping relationship between these behaviors and impacts, we constructed a security database containing behaviors and their impact on the system, which is used to generate the minimum attack graph and detect zero-day attacks in the training phase.

[0057] Table 1 shows a sample of the security database records constructed in this embodiment.

[0058] Table 1

[0059]

[0060] For the system monitoring module, in addition to utilizing static information related to network configuration and topology, this implementation also uses honeypot technology to capture and record the attacker's real-time dynamic information. The unique advantage of using honeypot technology is that it can capture the attacker's behavior sequence in real time without interfering with normal security mechanisms. Honeypots set up a series of vulnerable services and vulnerabilities to induce attackers to make illegal access and expose their attack behaviors. This module can be further divided into two parts: honeypot hiding and data recording.

[0061] Regarding honeypot hiding, unlike general honeypots, we use Direct Kernel Object Manipulation (DKOM) technology to hide the honeypot's own functions, making it difficult for attackers to detect its existence, further improving the stealth and security of system monitoring. This technology enables monitoring tools to monitor the honeypot file system in real time and record related events without affecting the memory or kernel, ensuring that the monitoring process is not detected by attackers. The DKOM-based honeypot is discretely integrated into the operating system kernel and can obtain unencrypted raw data before encryption by monitoring low-level activities such as system calls, process creation, and file operations. This allows the honeypot to effectively capture the attacker's operation traces when dealing with complex encryption attacks, ensuring comprehensive recording and analysis of attack behaviors.

[0062] The main goal of the honeypot is to monitor the attacker's behavior in the honeypot. It does not provide authorization services for ordinary users, so there is no normal inbound and outbound traffic. All connections from or to the honeypot are blocked. Assuming that the target network has two ordinary user hosts (NS1 and NS2) and a honeypot system host (HS), the access information is shown in Table 2.

[0063] Table 2, Access restrictions for hypothetical network hosts in the firewall policy.

[0064]

[0065] Regarding data recording, in order to facilitate subsequent data processing, the honeypot will create an attacker profile based on the attacker's behavior. The file records all the actions completed by the attacker in the target system in real time in chronological order. The specific content is presented in the form of a five-tuple.<Date,Time,IP,Action,Type> , respectively representing the date of the attack, the time of the attack process, the attacker's IP address, the operation performed on the system (create, open, read and write, etc.), and the file type of the operation performed (system file, executable file, etc.). This configuration file will be used in the attacker modeling module to build a dynamic minimum attack graph.

[0066] For the attacker modeling module, this embodiment uses the attacker profile provided by the system monitoring module to build an attacker behavior model. Subsequently, a minimum attack subgraph (MAGD) is generated based on the graph generation algorithm, and the graph update algorithm is used to update the content of the minimum attack subgraph according to the latest dynamic feedback from the honeypot in real time, such as adding new nodes and edges to the graph, or modifying the previous attack path. The overall process is as follows: Figure 2 Shown

[0067] Specifically, in the attacker behavior model, the configuration file is reorganized into the following data format:<s0,Act,S,→,F,IP> The detailed process is shown in Algorithm 1. Among them, s0 represents the initial state when the attacker enters the system, corresponding to the first record of the attacker information created in the honeypot; Act represents the set of behaviors of the attacker in the target system.

[0068] Assume that L = {local, remote} represents the attacker's location in the target system, where local means the attacker uses a local IP address in the target network, and remote means the attacker's IP address is not in the network. The standard definition of Act is: Act = {(Z, effect α (TS)) / Z∈{0,1}}, where effect α (TS) is the effect of the behavior performed by the attacker on the target system (TS). The binary variable Z is a variable used to determine the type of behavior performed by the attacker. The definition of this variable is used to detect zero-day attacks. If the behavior performed by the attacker is a known attack and exists in our database, then Z(α) = 0; if the behavior does not exist in the database, then Z(α) = 1, which means that the attack that occurred is a zero-day attack. The standard definition of Z is as follows:

[0069]

[0070] S represents the set of states of the attacker in the target system, represented as {s0, s1, s2, …, s n}, where each s i is regarded as (l, α), where l∈L and α∈Act; → represents the state transition process, such as F represents the set of files accessed by the attacker; IP represents the IP address of the attacker. According to the definition of S, the state in the minimum attack subgraph can be expressed in detail as (l, ((Z(α), effect α (TS)))). Assume α1 = (0, unlink()), s1 = (l, (0, deletion of an arbitrary file)), indicating that state s1 determines that the local attacker performs behavior a1 on the target, and the impact of this behavior on the target is to delete an arbitrary file.

[0071] Algorithm 1

[0072]

[0073]

[0074] Subsequently, the attacker model is sent as input to the minimum attack graph generation algorithm. In this graph, nodes represent the states reached by the attacker based on the honeypot output, while edges represent transitions between states. The attacker changes its state by performing attack operations, and creates corresponding edges in the graph based on the operations it performs on the target system. Algorithm 2 shows the construction process of the initial structure of the minimum attack graph.

[0075] Algorithm 2

[0076]

[0077] Since there are no extra edges and noisy states, the minimum attack subgraph has high determinism and accuracy. To prove the minimality of the obtained attack graph, we propose Theorem 1 and give a proof.

[0078] Definition: A minimal attack graph consists of two features.

[0079] 1. The minimum attack graph contains only edges that terminate at the target node.

[0080] 2. The minimum attack graph only contains scenarios where the attack is successful.

[0081] Theorem 1: If the attack graph (AG) is generated by Algorithm 2, then the attack Figure 1 It is a minimum attack graph (MAG).

[0082] Specifically, the proof of the theorem is divided into two parts. In the first part, the input of Algorithm 2 is the attacker behavior model (B). In the proposed algorithm, the construction of the attack graph does not depend on the structure of the network hierarchy, but starts to be generated immediately after the attacker enters the target system. The data used by the algorithm to construct the attack graph is related to the attacker's actions in the target system, and all generated nodes (states) are closely related to the attacker's activities in the target system.

[0083] The second part is about the attacker's behavior, which can be divided into the following three situations:

[0084] 1. The attacker enters the honeypot and performs his malicious actions (such as executing executable files, deleting files, modifying data, etc.), and then exits the system (a complete host attack scenario).

[0085] 2. The attacker enters the honeypot and exits the system without performing any malicious actions (incomplete host attack scenario).

[0086] 3. The attacker only enters the target network, but not the honeypot, and then exits the network (incomplete network layer attack scenario).

[0087] In the above cases, both Case 1 and Case 2 can be considered successful attack events because the attacker has successfully accessed the target system, the honeypot, regardless of whether malicious behavior has been performed. In Case 2, the attacker may choose to perform his malicious behavior again at some point in the future, so the data related to the attacker's first entry into the honeypot is valuable for predicting his subsequent behavior. In Case 3, the attacker entered the target network but did not further penetrate the target system and ended the attack process in the reconnaissance phase. If the attacker fails to successfully penetrate the system and the attack process is not completed at the network level, then according to the definition of the minimum attack graph and the discussion in the first part, the model will not establish a corresponding path for such an attacker.

[0088] The graph update algorithm updates the content of the minimum attack subgraph according to the latest dynamic feedback from the honeypot in real time, such as adding new nodes and edges to the graph, or modifying the previous attack path. The specific process is shown in Algorithm 3. The honeypot can send new attack data to the existing attack graph at any time and update it in real time. During the update process, the algorithm will check the attacker's new behavior and, if necessary, add new nodes and edges to the attack graph or adjust the existing path.

[0089] Specifically, we use a search algorithm in the graph to determine the required changes, which are implemented in UpdateGraph(B). The attacker behavior model (B) contains the IP addresses associated with the generated attack graph, so the search algorithm can locate the corresponding attack graph based on the input IP address and update it accordingly. At this stage, we consider the handling mechanism of the attack graph model in the case of repeated behavior. There are two specific scenarios:

[0090] The attacker repeats a single behavior (repeated actions). When the attacker repeatedly performs a single action in the target system (such as repeatedly performing file operations or modifying the same data), the update method checks whether the node related to the action already exists in the attack graph. If the node already exists, no update is performed to avoid generating duplicate nodes.

[0091] The attacker repeats a series of actions (repeated paths). When the attacker repeatedly performs a series of identical actions (i.e., forms repeated paths), Algorithm 3 detects whether the path already exists in the existing attack graph. If the path already exists, it will not be recreated in the attack graph to avoid generating redundant path nodes.

[0092] Algorithm 3

[0093]

[0094] After the minimum attack graph (MAGD) is generated, it needs to be mapped to a hidden Markov model (HMM) to predict attack behavior. Each HMM model contains an HMM configuration file to store its model parameters (λ as ). The following will explain in detail how to build the corresponding HMM model for each type of attack scenario (as).

[0095] The formal definition of the HMM model is: as =(∑, S, A, Q, Π). Where: ∑ represents the set of all possible actions that the attacker may perform. S represents all the steps that the attacker may go through in the attack scenario. A represents the state transition probability matrix, which is used to define the transition from state state i Transfer to state j The probability of observing an action in each state. Q represents the observation probability matrix, which is used to define the probability of observing an action in each state. Π represents the initial distribution vector, which is used to determine the probability of each state being the initial state.

[0096] Specifically, the observation set ∑ = {v1, v2, v3, ..., v M} represents all possible actions that an attacker may perform in the honeypot system. Each command executed by the attacker is regarded as an action. We consider all common actions performed by the attacker in the system and their effects on the system, such as (α, (effect α (TS))), collected as an action set, provides observation data for the HMM training algorithm.

[0097] In cybersecurity and military operations, the concept of a “kill chain” is often used to describe the stages that an attacker goes through in successfully executing a cyberattack or military operation. The concept originated in the military field, but has been introduced into the field of cybersecurity. A typical cyberattack “kill chain” includes the following stages: (a) Reconnaissance (B1): The attacker collects relevant information about the target, such as identifying potential vulnerabilities, system configurations, and possible entry points. (b) Weaponization (B2): The attacker creates or obtains tools or malware that can exploit the identified vulnerabilities. (c) Delivery (B3): The attacker delivers the weaponized payload to the target system. This is usually achieved through email attachments, malicious links, or other attack vectors. (d) Exploitation (B4): The attacker exploits vulnerabilities in the target system to gain access, usually through techniques such as code execution or privilege escalation. (e) Installation (B5): The attacker installs and sets up his tools or malware within the target system to maintain access and control. (f) Command and Control (C2) phase (B6): The attacker establishes a communication channel to remotely control the compromised system, thereby being able to send commands and steal data. (g) Actions on Objectives (B7): After gaining control of the compromised system, the attacker executes his ultimate goal, such as data theft, system sabotage, or other malicious activities.

[0098] Each stage in the kill chain model is regarded as a behavior (B) of the attacker, and each behavior B contains a series of action sequences. Therefore, each state in the minimum attack graph (MAGD) also corresponds to a state in the Markov chain (MC). For example, state s1 = (I, a1), where α1 = (0, "Root Access") means that in the first behavior B1 of the attack model, the attacker obtains root access to the target system after executing action α1 locally. When mapping the state of MAGD to the HMM state, the state in MAGD, such as (l, ((Z(α), effect α (TS)))) is labeled as a character and used as the state of the HMM.

[0099] The probability matrices A and Q and the initial distribution vector Π need to be obtained through training models to describe the transition and observation probabilities of each attacker behavior. To achieve this goal, this scheme uses a supervised algorithm for model training. The HMM model is learned through a data set collected from the attacker's behavior sequence. The training of different Markov models is implemented by the Baum-Welch algorithm, which is used to solve the probability matrix and vector to generate the corresponding HMM profile for each action sequence.

[0100] The attack behavior prediction module can be divided into two stages: model training and behavior prediction. In the training stage, we use the Baum-Welch algorithm and use the Kullback-Leibler (KL) distance as the evaluation. The algorithm maximizes the likelihood probability of the observed data by iteratively adjusting the model parameters. In the testing stage, we use the Viterbi algorithm to predict the attacker's behavior on the hidden Markov model (HMM) to find the most likely hidden state sequence in the HMM that best matches the given observed action sequence.

[0101] Specifically, when the KL distance (divergence between model parameters) after the model parameters are updated is less than the set threshold (0.001), or when the maximum number of iterations is reached, the algorithm will terminate the training process. The steps of the training algorithm are as follows:

[0102] 1. Initialize model parameters:

[0103] Initialize the state transfer matrix A, the observation matrix Q and the initial state probability distribution Π.

[0104] 2. Repeat the following steps until convergence or the maximum number of iterations is reached:

[0105] Calculate forward probabilities based on the current model parameters.

[0106] Calculate the backward probabilities based on the current model parameters.

[0107] Combine the forward probability and the backward probability to calculate the posterior probabilities.

[0108] Based on the posterior probability, the expected sufficient statistics of the state transfer matrix, the observation matrix and the initial state probability distribution are calculated.

[0109] Sufficient Statistics).

[0110] Update the model parameters using the expected sufficient statistics above.

[0111] Calculate the KL Divergence between the old model parameters and the new model parameters.

[0112] 3. Check convergence conditions:

[0113] If the KL divergence is less than the preset threshold or the maximum number of iterations is reached, the training is stopped and the final model parameters are returned.

[0114] The model parameters obtained through the above training process include: initial state distribution vector, state transition probability matrix and observation probability matrix. Subsequently, the Viterbi algorithm is used to predict the state of the new observation using the parameters obtained through training.

[0115] The Viterbi algorithm uses dynamic programming to efficiently calculate the maximum likelihood path in the hidden Markov model. Specifically, the Viterbi algorithm recursively calculates the probability of the most likely path to reach each hidden state in the HMM at each time step. During the calculation process, the maximum probability path to each state in the previous time step is recorded, and this information is used to calculate the maximum probability path to each state in the current time step. After all time steps are calculated, the path with the highest probability in the final time step is selected, and the most likely hidden state sequence for a given observed action sequence is determined based on this.

[0116] The Viterbi algorithm gradually selects the optimal state path based on the state probability of each step in the Markov chain (MC), thereby determining the optimal state change path of the attacker's behavior sequence. Through the above process, the Viterbi algorithm can accurately identify the attacker's potential attack behavior patterns and state changes in the attacker's observed behavior sequence, providing a powerful attack behavior prediction capability for network security protection and intrusion detection systems.

[0117] In a second aspect, an embodiment of the present invention proposes an attacker behavior prediction method based on a hidden Markov model, characterized in that the attacker behavior prediction system based on a hidden Markov model described in the first aspect is used to complete behavior prediction, and the detailed steps are as follows: Figure 3 For details, please refer to the description of the first aspect, which will not be repeated here.

[0118] However, in order to better help understand the system and method proposed in the present invention, we will provide a simple case analysis.

[0119] Assume that the information obtained from the honeypot is shown in Table 3. Based on the attacker profile obtained from the honeypot, Algorithm 1 is applied to construct the attacker behavior. At this stage, the algorithm searches for the effects of the performed operations to create states and related records to detect zero-day attacks. The states generated by the attacker behavior are as follows. To simplify the data representation, we use characters to replace the action and its effect name:

[0120] Table 3. Attacker configuration files obtained from the honeypot

[0121]

[0122] The status of attacker behavior B1 is as follows:

[0123] s0=(l,((Z(α1), effect α1 (TS))))

[0124] s1=(l,((Z(α1), effect α1 (TS))))

[0125] s2=(l,((Z(α2),effect α2 (TS))))

[0126] s3=(l,((Z(α3), effect α3 (TS))))

[0127] s4=(l,((Z(α4), effect α4 (TS))))

[0128] s5=(l,((Z(α5),effect α5 (TS))))

[0129] s6=(l,((Z(α6), effect α6 (TS))))

[0130] s7=(l,((Z(α7),effect α7 (TS))))

[0131] s8=(l,((Z(α8),effect α8 (TS))))

[0132] s9=(l,((Z(α9),effect α9 (TS))))

[0133] Figure 4 and Figure 5 is the minimum attack subgraph and Markov chain generated according to B1.

[0134] The status of attacker behavior B2 is as follows:

[0135] s0=(l,((Z(β1), effect B1 (TS))))

[0136] s1=(l,((Z(β1),effect B1 (TS))))

[0137] s2=(l,((Z(β2),effect β2 (TS))))

[0138] s3=(l,((Z(β3),effect β3 (TS))))

[0139] s4=(l,((Z(β4),effect β4 (TS))))

[0140] s5=(l,((Z(β5),effect β5 (TS))))

[0141] Figure 6 and Figure 7 is the minimum attack subgraph and Markov chain generated according to B2.

[0142] Next, we will explain the meaning of the values ​​obtained after training B1 using the Baum-Welch algorithm. The parameters required for training the hidden Markov model are the observation set and the state set. For B1, the state set is S = {s1, s2, s3, s4, s5, s6, s7, s8, s9}, and the observation set is O = {Act1, Act2, Act3, Act4, Act5, Act6, Act7, Act8, Act9}. The values ​​obtained after training the hidden Markov model are:

[0143] ① Initial state probability distribution Π: In this case, the probability that the first state (s1) is the initial state is 100%

[0144] Π=(1,0,0,0,0,0,0,0,0)

[0145] ②Transition probability matrix A: represents the transition between the states of set S, such as Figure 6 In this matrix, each row and column is a state, and the coordinate (i, j) can be expressed as the probability of transitioning from state i to state j. For example, if the attacker is in state 1, the probability of continuing to stay in state 1 is 0.362836.

[0146]

[0147] ③Transition probability matrix Q: represents the probability of observing a specific action in a certain state. In this matrix, each row represents a different state, each column represents a different action, and the coordinate (i, j) can be expressed as the probability of observing action j in state i. For example,

[0148] If the attacker is in state 1, the probability of observing action 1 is 0.016394.

[0149] This training example is just a sample to further describe the training process. Each possible behavior is trained using the training data we collected. Next, we apply the prediction module to the observation sequence of behavior B2 to predict the attacker's next move. The existing observation sequence: s1→s2→s3→s4→s5. The complete sequence predicted by the hidden Markov model is s1→s2→s3→s4→s5→s2→s3. The above is a simple training prediction process.

[0150]

Claims

1. An attacker behavior prediction system based on a hidden Markov model, characterized in that: Includes the following modules: The security database module is used to collect the mapping of attacker behavior information and the impact on the target system from the open source vulnerability library and attack database, and generate basic data for training and prediction; The system monitoring module deploys kernel-level honeypots to capture attacker behavior and generate behavior profiles; The attacker modeling module models the attacker's activities based on the attacker profile from the honeypot, generates a minimum attack graph, and updates the attack graph based on real-time data; The graph data mapping module aligns the information in the minimum attack graph with the hidden Markov model parameters; The attacker behavior prediction module processes training data and behavior modeling in a simulated real-time environment, trains the model through the Baum-Welch algorithm, and uses the Viterbi algorithm to predict the attacker's possible future behavior.

2. The attacker behavior prediction system based on hidden Markov model according to claim 1, characterized in that: The open source vulnerability database and attack database used in the security database module include but are not limited to the CVE (Common Vulnerabilities and Exposures) database and the MITRE ATT&CK database.

3. The attacker behavior prediction system based on hidden Markov model according to claim 1, characterized in that: The kernel-level honeypot of the system monitoring module includes the following two parts: a honeypot hiding module, which uses Direct Kernel Object Manipulation (DKOM) technology to hide the existence of the honeypot, so that attackers cannot detect the honeypot; The data recording module captures the attacker's behavior in real time and generates a behavior profile in the form of five-tuple<Date,Time,IP,Action,Type> The attacker's behavior information is recorded in the form of 4. The attacker behavior prediction system based on hidden Markov model according to claim 1, characterized in that: The attacker modeling module adopts an attacker behavior model construction algorithm to reorganize the attacker configuration data, and then adopts a graph generation algorithm to generate a minimum attack graph, which consists of all possible attack paths after the attacker enters the target system, and can dynamically update the attack paths and nodes according to real-time data.

5. The attacker behavior prediction system based on hidden Markov model according to claim 1, characterized in that: The attacker behavior prediction module trains the model through the Baum-Welch algorithm, obtains the state transfer matrix and the observation probability matrix, and uses the Viterbi algorithm to predict the most likely hidden state sequence for a given observation sequence.

6. A method for predicting attacker behavior based on a hidden Markov model, characterized in that: The attacker behavior prediction system described in claims 1 to 5 is used to complete the following steps: The security database module collects information from the open source vulnerability library and attack database to generate attacker behavior and impact mapping pairs; deploys kernel-level honeypots in the target system, captures the attacker's real-time behavior through the system monitoring module, and generates a behavior profile; uses the attacker modeling module to generate a minimum attack graph based on the behavior profile, and dynamically updates the graph data; maps the state and observation values ​​of the minimum attack graph to the state set and observation set of the hidden Markov model; The attacker behavior prediction module is used to train and predict the hidden Markov model and output the most likely behavior sequence of the attacker.

Images