A system and method for predicting attacker behavior based on hidden Markov model

Abstract

The present invention provides an attacker behavior prediction system and method based on a hidden Markov model. The system includes: a security database module, which collects information from existing open source vulnerability libraries and attack databases, constructs mapping pairs between attacker operations and the impact on the target system, and is used for subsequent model training and detection of zero-day attacks; a system monitoring module, which uses a kernel-level honeypot to capture attacker behavior and generate a configuration file; an attacker modeling module, which models the attacker's activities based on the attacker configuration file from the honeypot, generates a minimum attack graph, and updates the attack graph based on real-time data; a graph data mapping module, which aligns the information in the minimum attack graph with the parameters of the hidden Markov model; an attacker behavior prediction module, which processes training data and behavior modeling in a simulated real-time environment, uses the Baum-Welch algorithm for training, and uses the Viterbi algorithm for prediction; finally, calculates the maximum likelihood path in the hidden Markov model, selects the path with the maximum probability in the final time step, and determines the most likely hidden state sequence that generates a given observed action sequence, that is, the behavior that the attacker is most likely to perform in the next stage.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and specifically relates to an attacker behavior prediction system and method based on a hidden Markov model Background Art

[0002] Predicting attacker behavior is a complex research area in cybersecurity. Predicting an attacker's next move helps security personnel make informed decisions to mitigate the impact of malicious activity on target systems. However, due to the flexibility of cyber threats and the diversity of data required for analysis, this task presents significant challenges, primarily in processing large datasets, identifying attacker motivations, and avoiding false positives and negatives during prediction.

[0003] Currently, Moving Target Defense (MTD) methods have been widely adopted as the latest security mechanism. One strategy involves observing attackers' behavior within static systems and extracting rules based on this behavior to build a behavioral model. However, with the continuous advancement of network attack technology, attackers can now adjust their attack strategies through the static configuration of the system to circumvent defenses.

[0004] In addition, previous methods have also used attack graphs (AGs) to track and analyze network attack paths, providing effective information for predicting attacker behavior. Specifically, they can be divided into two types: complete attack graphs (CAGs) and minimum attack graphs (MAGs). A complete attack graph contains all feasible paths between hosts, while a minimum attack graph only includes potential paths from each host to the target host. However, traditional attack graphs have some significant limitations:

[0005] 1) It only provides consistent information about the attack path, lacks records of active responses and environmental changes, and cannot reflect the actual situation of the system when facing attacks.

[0006] 2) Most attack graph generation algorithms provide static information about the likelihood of exploiting vulnerabilities. Although they show potential attack paths, they are not reliable enough to predict future attacks.

[0007] 3) They do not consider zero-day attack paths, which makes them incomplete in dealing with unknown threats.

[0008] 4) As the scale of the network expands, the scalability problem of the attack graph is difficult to solve, and efficient analysis of large-scale graphs becomes difficult.

[0009] 5) Redundant paths and nodes in the attack graph may interfere with the prediction results and affect the generalization and robustness of the model.

[0010] Therefore, there is an urgent need for a method that can efficiently model the real-time behavior of attackers, has good robustness and flexibility, can better deal with complex and changing network attacks, and provide reliable guidance for defenders. Summary of the Invention

[0011] In order to solve the above problems existing in the prior art, the present invention provides an attacker behavior prediction system and prediction method based on a hidden Markov model. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0012] In a first aspect, an embodiment of the present invention provides an attacker behavior prediction system based on a hidden Markov model, comprising:

[0013] The security database module collects information from existing open source vulnerability libraries and constructs action and impact data pairs for minimum attack graph generation and training phase to detect zero-day attacks.

[0014] System monitoring module, which uses kernel-level honeypots to capture attacker behavior and generate attacker profiles;

[0015] The attacker modeling module models the attacker's activities based on the attacker profile from the honeypot and generates a dynamic minimum attack graph (MAGD);

[0016] A graph data mapping module that aligns information from the attacker behavior model with the Hidden Markov Model (HMM) parameters;

[0017] The attack behavior prediction module processes training data and behavior modeling in a simulated real-time environment, adopts the Baum-Welch algorithm for training and uses the Viterbi algorithm for prediction.

[0018] In one embodiment of the present invention, the kernel-level honeypot consists of two main parts, including:

[0019] The first part involves honeypot hiding technology, through which attackers cannot detect our deployed honeypots in the target network;

[0020] Specifically, Direct Kernel Object Manipulation (DKOM) is a concealment method used by kernel-level rootkits (a type of malware). This technique uses low-level programming methods (such as pointer manipulation and memory patching) to manipulate kernel data structures to hide processes, load drivers, change permissions, and more. Because DKOM technology is currently difficult to detect, we chose to use it to hide our monitoring tools. Using DKOM technology means that honeypot monitoring tools can be discretely integrated into the operating system kernel without virtualizing or modifying the memory and kernel itself. In addition, kernel-level honeypots can also bypass attackers' encrypted communication behaviors and obtain unencrypted data.

[0021] The second part involves data recording methods, which are used to save information about the attacker's behavior;

[0022] Specifically, the honeypot will record all events that occur in the kernel in real time and generate an attacker profile. The specific attack behavior will be presented in the form of a five-tuple<Date,Time,IP,Action,Type> , respectively representing the date of the attack, the attack process time, the attacker's IP address, the operation performed on the system, and the file type of the operation performed. This configuration file will be used in the attacker modeling module to construct a dynamic minimum attack graph.

[0023] In one embodiment of the present invention, the minimum attack graph is one of the most popular network attack modeling methods, which includes three steps: behavioral attacker model construction, graph generation, and graph update, which are composed of three algorithms respectively:

[0024] Traditional attack graph algorithms generate a complete graph containing all possible attack paths, but the presence of numerous nodes and edges irrelevant to the actual attack makes visualization and further analysis difficult. Therefore, in this paper, we use a minimal attack graph to mitigate the interference caused by redundant information. This method creates a special attack graph, called a minimal attack graph (MAGD), based on attacker information fed back by the honeypot. Each path corresponds to a sequence of actions taken by the attacker in real time, including the impact of the attack on the target system.

[0025] First, in order to conveniently represent the attacker behavior in the form of a graph (nodes and edges), we restructure the attacker behavior information into<s0,Act,S,→,F,IP> Here, s0 represents the initial state of the attacker when entering the system, corresponding to the first record of attacker information created in the honeypot; Act represents the set of actions of the attacker in the target system; S represents the set of states of the attacker in the target system; → represents the state transition process; F represents the set of files accessed by the attacker; and IP represents the IP address of the attacker.

[0026] Next, the graph generation algorithm constructs a minimum attack subgraph based on the normalized data. This minimum attack subgraph has two characteristics: ① It consists only of edges terminating at the target node; ② It only contains scenarios where the attack was successful. This maximizes the use of effective information and minimizes the interference of redundant information.

[0027] Finally, the graph update algorithm updates the content of the minimum attack subgraph based on the latest dynamics fed back by the honeypot in real time, such as adding new nodes and edges to the graph, or modifying the previous attack path.

[0028] In one embodiment of the present invention, the Hidden Markov Model (HMM) is a machine learning model used to characterize systems of hidden and observable states, or to solve problems based on sequential information, such as time series or sequential states. This model is widely used in network security, including but not limited to intrusion detection, malware analysis, and user behavior analysis.

[0029] Specifically, Hidden Markov Models (HMMs) can effectively detect anomalous behavior and predict potential malicious activity by modeling and analyzing system logs, network traffic, and other security-related data. Their ability to capture temporal dependencies in data makes them particularly useful for predicting future malicious activity.

[0030] In one embodiment of the present invention, the Baum-Welch algorithm is a widely used algorithm for learning Hidden Markov Model (HMM) parameters from data. The algorithm estimates the model parameters through a forward-backward algorithm and maximizes the likelihood function of the observed data by updating the HMM parameters, thereby effectively training the model.

[0031] In one embodiment of the present invention, the Viterbi algorithm is an algorithm based on supervised learning. Unlike the Baum-Welch algorithm, the Viterbi training algorithm directly updates parameters based on the optimal state path, and has a more efficient learning process.

[0032] In a second aspect, an embodiment of the present invention provides an attacker behavior prediction method based on a hidden Markov model, which uses the attacker behavior prediction system based on a hidden Markov model described in the first aspect to complete the prediction.

[0033] Beneficial effects of the present invention:

[0034] 1. The state set in the dynamic minimum attack graph represents the attacker's behavior and the impact on the target system. The paths in the graph accurately reflect the attacker's real-time behavior.

[0035] 2. The attacker monitoring tool used is a kernel-level honeypot. Even if the attacker uses encryption, the honeypot can capture all of his actions.

[0036] 3. The attacker behavior modeling and prediction process is independent of the number of actions in the attack sequence and can handle attack sequences of varying lengths, with good flexibility and reliability.

[0037] 4. The dynamic minimum attack graph contains information about unknown attacks, and the system can be trained separately for these types of attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 1 is a general structural diagram of an attacker behavior prediction system based on a hidden Markov model provided in an embodiment of the present invention;

[0039] Figure 2 This is a flowchart of constructing a minimum attack subgraph (MAGD) in an embodiment of the present invention;

[0040] Figure 3 This is a step diagram of the attacker behavior prediction method based on the hidden Markov model;

[0041] Figure 4 It is the minimum attack subgraph generated according to the attacker behavior B1 in the case analysis;

[0042] Figure 5 It is the Markov chain generated based on the attacker behavior B1 in the case analysis;

[0043] Figure 6 It is the minimum attack subgraph generated according to the attacker behavior B2 in the case analysis;

[0044] Figure 7 It is the Markov chain generated based on the attacker behavior B2 in the case analysis; DETAILED DESCRIPTION

[0045] In order to enable those skilled in the art to better understand the present invention and to make the purpose and technical solution of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present invention.

[0046] In the first aspect, the present invention provides an attacker behavior prediction system based on a hidden Markov model. Figure 1 As shown in Figure 1, the attacker behavior prediction system mainly includes:

[0047] The security database module collects information from existing open source vulnerability libraries and attack databases to construct mapping pairs between attacker operations and the impact on the target system, which is used for minimum attack graph generation and training phase to detect zero-day attacks.

[0048] System monitoring module, which uses kernel-level honeypots to capture attacker behavior to form a profile;

[0049] The attacker modeling module models the attacker's activities based on the attacker profile from the honeypot and generates a dynamic minimum attack graph (MAGD);

[0050] A graph data mapping module that aligns information from the attacker behavior model with the Hidden Markov Model (HMM) parameters;

[0051] The attack behavior prediction module processes training data and behavior modeling in a simulated real-time environment, adopts the Baum-Welch algorithm for training and uses the Viterbi algorithm for prediction.

[0052] In general, the embodiment of the present invention first uses the vulnerability and attack information in the CVE and MITRE ATT&CK databases to build a database mapping attack behaviors and target system impacts. Subsequently, the attacker's behavior is captured by a honeypot carefully set up in the target system, and the attacker's behavior model is regularized according to the configuration file to generate a dynamic minimum attack graph. In the process of generating the dynamic minimum attack graph, the constructed security database will be queried. If the vulnerability information used by the attacker cannot be obtained, it means that it is a zero-day vulnerability, and a zero-day attack detection report can be generated in time. At the same time, the minimum attack graph will change with the real-time feedback information from the honeypot, modify the path information, and add new nodes or edges. Real-time information is of great help in improving prediction accuracy. Before inputting the data into the hidden Markov model, alignment processing is required. Finally, the trained hidden Markov model predicts the attacker's next behavior path based on the current minimum attack graph information.

[0053] The following is a detailed description.

[0054] For the security database module, this embodiment mainly uses information in the CVE and MITRE ATT&CK databases to build a security database for minimum attack graph generation and training phase to detect zero-day attacks.

[0055] Specifically, the CVE (Common Vulnerabilities and Exposures) database is a standardized repository of known software and hardware vulnerabilities, assigning a unique identifier to each detected vulnerability. MITRE ATT&CK, on ​​the other hand, is a comprehensive knowledge base that details the tactics, techniques, and procedures (TTPs) used by attackers, providing a crucial reference for understanding and defending against cyberthreats. In actual attacks, attackers often combine multiple techniques from MITRE ATT&CK to exploit one or more CVEs. Therefore, simply mapping a single CVE to a single MITRE ATT&CK technique is insufficient to fully reveal the complex cyberattack scenarios that exist in the real world.

[0056] The basis for constructing the minimum attack graph in this embodiment is to capture the attacker's behavior sequence in the target system. The key lies in the abstract processing of the nature of the executed command and its expected impact on the target system. The attacker may use a variety of techniques described in the MITRE ATT&CK database to perform attack behaviors. To this end, we collected and identified technologies related to the vulnerabilities reported in the CVE database, and recorded the system calls (behaviors) corresponding to each CVE id and their impact on the target system. By capturing the mapping relationship between these behaviors and impacts, we constructed a security database containing behaviors and their impact on the system, which is used for the generation of the minimum attack graph and the detection of zero-day attacks in the training phase.

[0057] Table 1 shows a sample of security database records constructed in this embodiment.

[0058] Table 1

[0059]

[0060] For the system monitoring module, this implementation utilizes not only static information related to network configuration and topology but also honeypot technology to capture and record real-time dynamic information about attackers. The unique advantage of using honeypot technology is its ability to capture attackers' behavioral sequences in real time without disrupting normal security mechanisms. Honeypots, by setting up a series of vulnerable services and vulnerabilities, lure attackers into unauthorized access and expose their attack behavior. This module can be further divided into two parts: honeypot hiding and data logging.

[0061] Regarding honeypot hiding, unlike typical honeypots, we utilize Direct Kernel Object Manipulation (DKOM) technology to conceal the honeypot's functionality, making it difficult for attackers to detect its presence and further improving the stealth and security of system monitoring. This technology enables monitoring tools to monitor the honeypot file system in real time and record related events without impacting memory or the kernel, ensuring that the monitoring process remains undetected by attackers. DKOM-based honeypots are discretely integrated into the operating system kernel and can obtain unencrypted raw data before encryption by monitoring low-level activities such as system calls, process creation, and file operations. This allows the honeypot to effectively capture the attacker's operational traces even when responding to complex encryption attacks, ensuring comprehensive recording and analysis of attack behavior.

[0062] The primary purpose of a honeypot is to monitor attackers' behavior within the honeypot. It does not provide authorized services to ordinary users, so there is no normal inbound or outbound traffic. All connections to and from the honeypot are blocked. Assuming the target network has two ordinary user hosts (NS1 and NS2) and one honeypot system host (HS), the access information is shown in Table 2.

[0063] Table 2, Access restrictions for hypothetical network hosts in the firewall policy.

[0064]

[0065] Regarding data recording, in order to facilitate subsequent data processing, the honeypot will create an attacker profile based on the attacker's behavior. The file records all the actions completed by the attacker in the target system in real time in the order of action time. The specific content is presented in the form of a five-tuple<Date,Time,IP,Action,Type> , respectively representing the date of the attack, the duration of the attack, the attacker's IP address, the operation performed on the system (create, open, read and write, etc.), and the file type (system file, executable file, etc.) on which the operation was performed. This configuration file will be used in the attacker modeling module to construct a dynamic minimum attack graph.

[0066] For the attacker modeling module, this embodiment uses the attacker profile provided by the system monitoring module to build an attacker behavior model. Subsequently, a minimum attack subgraph (MAGD) is generated based on the graph generation algorithm, and the graph update algorithm is used to update the content of the minimum attack subgraph based on the latest dynamic feedback from the honeypot in real time, such as adding new nodes and edges to the graph, or modifying the previous attack path. The overall process is as follows: Figure 2 shown

[0067] Specifically, in the attacker behavior model, the configuration file is reorganized into the following data format:<s0,Act,S,→,F,IP> The detailed process of the six-tuple is shown in Algorithm 1. Among them, s0 represents the initial state when the attacker enters the system, corresponding to the first record of the attacker information created in the honeypot; Act represents the set of behaviors of the attacker in the target system.

[0068] Assume that L = {local, remote} represents the attacker's location in the target system, where local means the attacker uses a local IP address in the target network, and remote means the attacker's IP address is not in the target network. The standard definition of Act is: Act = {(Z, effect α (TS)) / Z∈{0,1}},where effect α (TS) is the effect of the attacker's behavior on the target system (TS). The binary variable Z is used to determine the type of behavior performed by the attacker. This variable is defined to detect zero-day attacks. If the behavior performed by the attacker is a known attack and exists in our database, then Z(α) = 0; if the behavior does not exist in the database, then Z(α) = 1, which means that the attack that occurred is a zero-day attack. The standard definition of Z is as follows:

[0069]

[0070] S represents the attacker's state set in the target system, which is represented by {s0, s1, s2, ..., s n}, where each s i is regarded as (l, α), where l∈L and α∈Act; → represents the state transition process, such as F represents the set of files accessed by the attacker; IP represents the attacker's IP address. According to the definition of S, the state in the minimum attack subgraph can be expressed in detail as (l, ((Z(α), effect α Assume that α1 = (0, unlink()), s1 = (l, (0, deletion of an arbitrary file)), indicating that state s1 determines that the local attacker performs behavior a1 on the target, and the impact of this behavior on the target is the deletion of an arbitrary file.

[0071] Algorithm 1

[0072]

[0073]

[0074] The attacker model is then sent as input to the minimum attack graph generation algorithm. In this graph, nodes represent the states reached by the attacker based on the honeypot output, while edges represent transitions between states. The attacker changes its state by performing attack operations, and corresponding edges are created in the graph based on the operations performed on the target system. Algorithm 2 demonstrates the construction of the initial structure of the minimum attack graph.

[0075] Algorithm 2

[0076]

[0077] Since there are no extra edges and noisy states, the minimum attack subgraph has high determinism and accuracy. To prove the minimality of the obtained attack graph, we propose Theorem 1 and give a proof.

[0078] Definition: A minimal attack graph consists of two features.

[0079] 1. The minimum attack graph only contains edges that terminate at the target node.

[0080] 2. The minimum attack graph only contains scenarios where the attack is successful.

[0081] Theorem 1: If the attack graph (AG) is generated by Algorithm 2, then the attack Figure 1 It must be the Minimum Attack Graph (MAG).

[0082] Specifically, the proof of this theorem consists of two parts. First, the input to Algorithm 2 is the attacker's behavior model (B). In the proposed algorithm, the construction of the attack graph does not depend on the network hierarchy; instead, it begins immediately after the attacker enters the target system. The data used to construct the attack graph is related to the attacker's actions in the target system, and all generated nodes (states) are closely related to the attacker's activities in the target system.

[0083] The second part focuses on the attacker's behavior, which can be divided into the following three situations:

[0084] 1. The attacker enters the honeypot and performs malicious actions (such as executing executable files, deleting files, modifying data, etc.), and then exits the system (a complete host attack scenario).

[0085] 2. The attacker enters the honeypot and exits the system without performing any malicious actions (incomplete host attack scenario).

[0086] 3. The attacker only enters the target network, but not the honeypot, and then exits the network (incomplete network layer attack scenario).

[0087] In the above scenarios, both Case 1 and Case 2 can be considered successful attacks, as the attacker successfully accessed the target honeypot system, regardless of whether or not they performed malicious actions. In Case 2, the attacker may choose to perform malicious actions again at some point in the future, so data related to the attacker's initial access to the honeypot is valuable for predicting their subsequent behavior. In Case 3, the attacker entered the target network but did not further penetrate the target system, concluding the attack process during the reconnaissance phase. If the attacker fails to successfully penetrate the system and the attack process is not completed at the network level, then according to the definition of the minimum attack graph and the discussion in Part 1, the model will not establish a corresponding path for such an attacker.

[0088] The graph update algorithm updates the contents of the minimum attack subgraph based on the latest dynamic feedback from the honeypot in real time. This includes adding new nodes and edges to the graph or modifying existing attack paths. The specific process is shown in Algorithm 3. Honeypots can send new attack data to the existing attack graph at any time and update it in real time. During the update process, the algorithm checks for new attacker behavior and, if necessary, adds new nodes and edges to the attack graph or adjusts existing paths.

[0089] Specifically, we use a search algorithm within the graph to identify the required changes, implemented in UpdateGraph(B). The attacker behavior model (B) contains the IP addresses associated with the generated attack graph, so the search algorithm can locate the corresponding attack graph based on the input IP address and update it accordingly. At this stage, we considered how the attack graph model handles repeated behavior. Specifically, there are two scenarios:

[0090] The attacker repeats a single action (repeated actions). When an attacker repeatedly performs a single action on the target system (such as repeatedly performing a file operation or modifying the same data), the update method checks whether the node associated with that action already exists in the attack graph. If the node already exists, no update is performed to avoid generating duplicate nodes.

[0091] The attacker repeats a series of actions (repeated paths). When the attacker repeatedly performs a series of identical actions (i.e., forms a repeated path), Algorithm 3 checks whether the path already exists in the existing attack graph. If the path already exists, it is not recreated in the attack graph to avoid generating redundant path nodes.

[0092] Algorithm 3

[0093]

[0094] After generating the minimum attack graph (MAGD), it needs to be mapped to the hidden Markov model (HMM) to predict the attack behavior. Each HMM model contains an HMM configuration file to store its model parameters (λ as ). The following will explain in detail how to build the corresponding HMM model for each type of attack scenario (as).

[0095] The formal definition of the HMM model is: as =(∑, S, A, Q, Π). Where: ∑ represents the set of all possible actions that the attacker may perform. S represents all possible steps that the attacker may go through in the attack scenario. A represents the state transition probability matrix, which is used to define the transition from state state i Transfer to state j The probability of observing an action in each state. Q represents the observation probability matrix, which is used to define the probability of observing an action in each state. Π represents the initial distribution vector, which is used to determine the probability of each state being the initial state.

[0096] Specifically, the observation set ∑={v1,v2,v3,...,v M} represents all possible actions that the attacker may perform in the honeypot system. Each command executed by the attacker is considered an action. We consider all common actions performed by the attacker in the system and their effects on the system as (α, (effect α (TS))), collected as an action set, provides observation data for the HMM training algorithm.

[0097] In cybersecurity and military operations, the concept of a "kill chain" is often used to describe the stages an attacker goes through during a successful cyberattack or military operation. This concept originated in the military but has been adopted for use in cybersecurity. A typical cyberattack kill chain includes the following stages: (a) Reconnaissance (B1): The attacker gathers information about the target, such as identifying potential vulnerabilities, system configurations, and possible entry points. (b) Weaponization (B2): The attacker creates or acquires tools or malware capable of exploiting identified vulnerabilities. (c) Delivery (B3): The attacker delivers the weaponized payload to the target system, typically via email attachments, malicious links, or other attack vectors. (d) Exploitation (B4): The attacker exploits vulnerabilities in the target system to gain access, typically through techniques such as code execution or privilege escalation. (e) Installation (B5): The attacker installs and configures their tools or malware within the target system to maintain access and control. (f) Command and Control (C2) phase (B6): The attacker establishes a communication channel to remotely control the compromised system, enabling them to send commands and steal data. (g) Actions on Objectives (B7): After gaining control of the compromised system, the attacker executes their ultimate objectives, such as data theft, system sabotage, or other malicious activities.

[0098] Each stage in the kill chain model is considered as an attacker's behavior (B), and each behavior B contains a series of action sequences. Therefore, each state in the minimum attack graph (MAGD) also corresponds to a state in the Markov chain (MC). For example, state s1 = (I, a1), where α1 = (0, "Root Access") means that in the first behavior B1 of the attack model, the attacker obtains root access to the target system after executing the α1 action locally. When mapping the state of MAGD to the HMM state, the state in MAGD, such as (l, ((Z(α), effect α (TS)))) is labeled as a character and used as the state of the HMM.

[0099] The probability matrices A and Q, as well as the initial distribution vector π, must be obtained through model training to describe the transition and observation probabilities of each attacker action. To achieve this, this solution uses a supervised algorithm for model training. The HMM model is learned using a dataset collected from the attacker's action sequences. The different Markov models are trained using the Baum-Welch algorithm, which solves for the probability matrix and vector to generate a corresponding HMM profile for each action sequence.

[0100] The attack behavior prediction module can be divided into two phases: model training and behavior prediction. During the training phase, we use the Baum-Welch algorithm and the Kullback-Leibler (KL) distance as the evaluation method. This algorithm iteratively adjusts model parameters to maximize the likelihood of the observed data. During the testing phase, we use the Viterbi algorithm to predict attacker behavior using a hidden Markov model (HMM). This algorithm searches for the most likely hidden state sequence in the HMM that best matches a given observed action sequence.

[0101] Specifically, when the KL distance (divergence between model parameters) after the model parameters are updated is less than the set threshold (0.001), or when the maximum number of iterations is reached, the algorithm will terminate the training process. The steps of the training algorithm are as follows:

[0102] 1. Initialize model parameters:

[0103] Initialize the state transfer matrix A, observation matrix Q and initial state probability distribution π.

[0104] 2. Repeat the following steps until convergence or the maximum number of iterations is reached:

[0105] Calculate forward probabilities based on the current model parameters.

[0106] Calculates backward probabilities based on the current model parameters.

[0107] Combine the forward probability and the backward probability to calculate the posterior probability (Posterior Probabilities).

[0108] Calculate the expected sufficient statistics of the state transfer matrix, observation matrix and initial state probability distribution based on the posterior probability (Expected

[0109] Sufficient Statistics).

[0110] Update the model parameters using the expected sufficient statistics above.

[0111] Calculate the KL Divergence between the old model parameters and the new model parameters.

[0112] 3. Check convergence conditions:

[0113] If the KL divergence is less than the preset threshold or the maximum number of iterations is reached, training is stopped and the final model parameters are returned.

[0114] The model parameters obtained through the above training process include: the initial state distribution vector, the state transition probability matrix, and the observation probability matrix. Subsequently, the state of the new observation value is predicted using the Viterbi algorithm using the trained parameters.

[0115] The Viterbi algorithm uses dynamic programming to efficiently calculate the maximum likelihood path in a hidden Markov model. Specifically, the Viterbi algorithm recursively calculates the probability of the most likely path to each hidden state in the HMM at each time step. The calculation records the path with the highest probability to each state at the previous time step and uses this information to calculate the path with the highest probability to each state at the current time step. After all time steps have been calculated, the path with the highest probability at the final time step is selected to determine the most likely sequence of hidden states that will generate a given observed action sequence.

[0116] The Viterbi algorithm gradually selects the optimal state path based on the state probabilities of each step in the Markov chain (MC), thereby determining the optimal state change path for the attacker's behavior sequence. Through this process, the Viterbi algorithm can accurately identify potential attack behavior patterns and state changes in the attacker's observed behavior sequence, providing powerful attack behavior prediction capabilities for network security protection and intrusion detection systems.

[0117] In the second aspect, the embodiment of the present invention proposes an attacker behavior prediction method based on a hidden Markov model, which is characterized in that the attacker behavior prediction system based on the hidden Markov model described in the first aspect is used to complete the behavior prediction. The detailed steps are as follows: Figure 3 For details, please refer to the description of the first aspect and will not be repeated here.

[0118] However, in order to better help understand the system and method proposed in the present invention, we will provide a simple case analysis.

[0119] Assume that the information obtained from the honeypot is shown in Table 3. Based on the attacker profile obtained from the honeypot, Algorithm 1 is applied to construct the attacker's behavior. At this stage, the algorithm searches for the effects of the actions performed to create states and related records to detect zero-day attacks. The states generated by the attacker's behavior are as follows. To simplify the data representation, we use characters to replace the names of actions and their effects:

[0120] Table 3. Attacker profiles obtained from the honeypot

[0121]

[0122] The status of attacker behavior B1 is as follows:

[0123] s0=(l,((Z(α1), effect α1 (TS))))

[0124] s1=(l,((Z(α1), effect α1 (TS))))

[0125] s2=(l,((Z(α2), effect α2 (TS))))

[0126] s3=(l,((Z(α3), effect α3 (TS))))

[0127] s4=(l,((Z(α4), effect α4 (TS))))

[0128] s5=(l,((Z(α5), effect α5 (TS))))

[0129] s6=(l,((Z(α6), effect α6 (TS))))

[0130] s7=(l,((Z(α7), effect α7 (TS))))

[0131] s8=(l,((Z(α8), effect α8 (TS))))

[0132] s9=(l,((Z(α9), effect α9 (TS))))

[0133] Figure 4 and Figure 5 is the minimum attack subgraph and Markov chain generated according to B1.

[0134] The status of attacker behavior B2 is as follows:

[0135] s0=(l,((Z(β1), effect B1 (TS))))

[0136] s1=(l,((Z(β1), effect B1 (TS))))

[0137] s2=(l,((Z(β2), effect β2 (TS))))

[0138] s3=(l,((Z(β3), effect β3 (TS))))

[0139] s4=(l,((Z(β4), effect β4 (TS))))

[0140] s5=(l,((Z(β5), effect β5 (TS))))

[0141] Figure 6 and Figure 7 is the minimum attack subgraph and Markov chain generated according to B2.

[0142] Next, we will explain the meaning of the values ​​obtained after training B1 using the Baum-Welch algorithm. The parameters required to train the hidden Markov model are the observation set and the state set. For B1, the state set is S = {s1, s2, s3, s4, s5, s6, s7, s8, s9}, and the observation set is O = {Act1, Act2, Act3, Act4, Act5, Act6, Act7, Act8, Act9}. The values ​​obtained after training the hidden Markov model are:

[0143] ① Initial state probability distribution Π: In this case, the probability that the first state (s1) is the initial state is 100%

[0144] Π=(1,0,0,0,0,0,0,0,0)

[0145] ②Transition probability matrix A: represents the transition between the states of set S, such as Figure 6 This is shown in the state chain in . In this matrix, each row and column is a state, and the coordinate (i, j) can be expressed as the probability of transitioning from state i to state j. For example, if the attacker is in state 1, the probability of remaining in state 1 is 0.362836.

[0146]

[0147] ③Transition probability matrix Q: represents the probability of observing a specific action in a certain state. In this matrix, each row represents a different state, each column represents a different action, and the coordinate (i, j) can be expressed as the probability of observing action j in state i. For example,

[0148] If the attacker is in state 1, the probability of observing action 1 is 0.016394.

[0149] This training example is just a sample, used to further illustrate the training process. Each possible behavior is trained using the training data we collected. Next, we apply the prediction module to the observation sequence of behavior B2 to predict the attacker's next move. The observation sequence is: s1 → s2 → s3 → s4 → s5. The complete sequence predicted by the hidden Markov model is s1 → s2 → s3 → s4 → s5 → s2 → s3. This is a simple training and prediction process.

[0150]

Claims

1. An attacker behavior prediction system based on a hidden Markov model, characterized in that: Includes the following modules: The security database module is used to collect mappings of attacker behavior information and impact on target systems from open source vulnerability libraries and attack databases, and generate basic data for training and prediction; The system monitoring module deploys kernel-level honeypots to capture attacker behavior and generate behavior profiles; The attacker modeling module models the attacker's activities based on the attacker profile from the honeypot, generates a minimum attack graph, and updates the attack graph based on real-time data; Graph data mapping module, which aligns the information in the minimum attack graph with the hidden Markov model parameters; The attacker behavior prediction module processes training data and behavior modeling in a simulated real-time environment, trains the model through the Baum-Welch algorithm, and uses the Viterbi algorithm to predict the attacker's possible future behavior.

2. The attacker behavior prediction system based on a hidden Markov model according to claim 1, characterized in that: The open source vulnerability database and attack database used in the security database module include the CVE (Common Vulnerabilities and Exposures) database and the MITRE ATT&CK database.

3. The attacker behavior prediction system based on a hidden Markov model according to claim 1, characterized in that: The kernel-level honeypot of the system monitoring module consists of the following two parts: a honeypot hiding module that uses Direct Kernel Object Manipulation (DKOM) technology to hide the existence of the honeypot, making it impossible for attackers to detect the honeypot; The data recording module captures the attacker's behavior in real time and generates a behavior profile in the form of five-tuple<Date, Time, IP, Action,Type> The attacker's behavior information is recorded in the form of 4. The attacker behavior prediction system based on a hidden Markov model according to claim 1, characterized in that: The attacker modeling module uses an attacker behavior model construction algorithm to re-regularize the attacker configuration data, and then uses a graph generation algorithm to generate a minimum attack graph. The minimum attack graph consists of all possible attack paths after the attacker enters the target system, and can dynamically update the attack paths and nodes based on real-time data.

5. The attacker behavior prediction system based on a hidden Markov model according to claim 1, characterized in that: The attacker behavior prediction module trains the model through the Baum-Welch algorithm, obtains the state transition matrix and the observation probability matrix, and uses the Viterbi algorithm to predict the most likely hidden state sequence for a given observation sequence.

6. A method for predicting attacker behavior based on a hidden Markov model, characterized in that: The attacker behavior prediction system according to any one of claims 1 to 5 is used to complete the following steps: The security database module collects information from open source vulnerability libraries and attack databases to generate attacker behavior and impact mapping pairs. A kernel-level honeypot is deployed in the target system, and the system monitoring module captures the attacker's real-time behavior to generate a behavior profile. The attacker modeling module generates a minimum attack graph based on the behavior profile and dynamically updates the graph data. The state and observation values ​​of the minimum attack graph are mapped to the state set and observation set of the hidden Markov model. The attacker behavior prediction module is used to train and predict the hidden Markov model and output the most likely behavior sequence of the attacker.

Images