Industrial internet attack scene reproduction method, equipment, storage medium and device

Abstract

The invention relates to the technical field of network security, and discloses an attack scene reproduction method, equipment, a storage medium and a device of an industrial internet, and the method comprises the steps: obtaining attack information based on a vulnerability analysis result and an alarm analysis result of a target network, determining an attack path according to the attack information, generating an attack code based on the attack path, obtaining a network protocol packet, and reproducing a network attack scene of the target network based on the attack code and the network protocol packet; according to the method, the network attack scene is reproduced from vulnerability analysis and alarm analysis dimensions, so that an attack source, an attack target and possible consequences caused by attacks can be accurately restored, the authenticity of network attack scene reproduction is ensured, and the scene reproduction effect is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an attack scenario reproducing method, equipment, storage medium and device for industrial Internet. Background Art

[0002] With the rapid development of the Internet, various network security issues continue to emerge. When reproducing network attack scenarios, the existing technology has poor scene reproduction effects due to the single analysis content.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide an attack scenario reproduction method, equipment, storage medium and device for the industrial Internet, aiming to solve the technical problem in the prior art that when reproducing network attack scenarios, the scene reproduction effect is poor due to the single analysis content.

[0005] To achieve the above object, the present invention provides an attack scenario reproducing method for the industrial Internet, and the attack scenario reproducing method for the industrial Internet comprises the following steps:

[0006] Obtain attack information based on vulnerability analysis results and alarm analysis results of the target network;

[0007] Determine an attack path according to the attack information, and generate an attack code based on the attack path;

[0008] A network protocol packet is obtained, and a network attack scenario of the target network is reproduced based on the attack code and the network protocol packet.

[0009] Optionally, before the step of acquiring attack information based on the vulnerability analysis result and the alarm analysis result of the target network, the step further includes:

[0010] Mining unknown vulnerabilities of the target network and obtaining vulnerability mining results;

[0011] Scanning known vulnerabilities of the target network to obtain vulnerability scanning results;

[0012] Analyze the possibility of the target network's vulnerability being attacked and obtain the vulnerability utilization rate;

[0013] Generate a vulnerability analysis result of the target network according to the vulnerability mining result, the vulnerability scanning result and the vulnerability utilization rate.

[0014] Optionally, the step of analyzing the possibility of the vulnerability of the target network being attacked and obtaining the vulnerability utilization rate includes:

[0015] Obtaining the defense strength, attack recognition rate, and attack cost of the target network;

[0016] The possibility of the vulnerability of the target network being attacked is analyzed according to the defense strength, the attack recognition rate and the attack cost to obtain the vulnerability utilization rate.

[0017] Optionally, the step of scanning known vulnerabilities of the target network to obtain vulnerability scanning results includes:

[0018] Based on the preset scanning strategy and vulnerability information library, the known vulnerabilities of the target network are scanned through a preset crawler script to obtain vulnerability scanning results.

[0019] Optionally, before the step of acquiring attack information based on the vulnerability analysis result and the alarm analysis result of the target network, the step further includes:

[0020] Pre-process the alarm data of the target network to obtain an alarm set;

[0021] Analyze the correlation between the alarms in the alarm set;

[0022] Determining the alarm level of each alarm in the alarm set;

[0023] An alarm analysis result of the target network is generated based on the association relationship and the alarm level.

[0024] Optionally, the step of determining the alarm level of each alarm in the alarm set includes:

[0025] Obtaining the threat level and associated asset weight of each alarm in the alarm set;

[0026] The alarm level of each alarm in the alarm set is determined based on the threat level and the associated asset weight.

[0027] Optionally, the step of analyzing the correlation between the alarms in the alarm set includes:

[0028] Analyze the cause-effect relationship between the alarms in the alarm set;

[0029] Analyzing similarities between the alarms in the alarm set;

[0030] The correlation relationship between the alarms in the alarm set is determined according to the causal relationship and the similarity.

[0031] Optionally, the step of preprocessing the alarm data of the target network to obtain an alarm set includes:

[0032] Screening the alarm data to obtain target data;

[0033] Performing vectorization conversion on the target data to obtain an alarm coefficient;

[0034] An alarm set is determined according to the attack scenario corresponding to the alarm coefficient.

[0035] Optionally, the step of determining an attack path according to the attack information and generating an attack code based on the attack path includes:

[0036] Determine an attack step node and an attack authority node according to the attack information;

[0037] Determine an attack path according to the attack step node and the attack authority node;

[0038] An attack code is generated based on the attack path.

[0039] Optionally, the step of generating an attack code based on the attack path includes:

[0040] Determine the vulnerability utilization rate according to the vulnerability analysis result, and determine the alarm coefficient according to the alarm analysis result;

[0041] An attack code is generated based on the attack path, the vulnerability utilization rate, and the warning coefficient.

[0042] Optionally, the step of obtaining a network protocol packet and reproducing a network attack scenario of the target network based on the attack code and the network protocol packet includes:

[0043] Acquire a network protocol packet, and match the attack code with the network protocol packet;

[0044] Reproduce the network attack scenario of the target network according to the matching result.

[0045] Optionally, the step of acquiring attack information based on vulnerability analysis results and alarm analysis results of the target network includes:

[0046] Obtain configuration parameter information and industrial control equipment information of the target network;

[0047] Attack information is obtained based on vulnerability analysis results, alarm analysis results, configuration parameter information, and industrial control equipment information of the target network.

[0048] In addition, to achieve the above-mentioned objectives, the present invention also proposes an attack scenario reproduction device for the Industrial Internet, wherein the attack scenario reproduction device for the Industrial Internet includes a memory, a processor, and an attack scenario reproduction program for the Industrial Internet stored in the memory and executable on the processor, wherein the attack scenario reproduction program for the Industrial Internet is configured to implement the attack scenario reproduction method for the Industrial Internet as described above.

[0049] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which an attack scenario reproduction program for the industrial Internet is stored. When the attack scenario reproduction program for the industrial Internet is executed by a processor, the attack scenario reproduction method for the industrial Internet as described above is implemented.

[0050] In addition, to achieve the above-mentioned purpose, the present invention also proposes an attack scenario reproducing device for industrial Internet, the attack scenario reproducing device for industrial Internet comprising: an information acquisition module, a code generation module and a scenario reproducing module;

[0051] The information acquisition module is used to acquire attack information based on vulnerability analysis results and alarm analysis results of the target network;

[0052] The code generation module is used to determine an attack path according to the attack information, and generate an attack code based on the attack path;

[0053] The scenario reproduction module is used to obtain a network protocol packet and reproduce the network attack scenario of the target network based on the attack code and the network protocol packet.

[0054] Optionally, the attack scenario reproducing device of the industrial Internet further includes: a vulnerability analysis module;

[0055] The vulnerability analysis module is used to mine unknown vulnerabilities of the target network and obtain vulnerability mining results;

[0056] The vulnerability analysis module is further used to scan the known vulnerabilities of the target network to obtain vulnerability scanning results;

[0057] The vulnerability analysis module is also used to analyze the possibility of the vulnerability of the target network being attacked and obtain the vulnerability utilization rate;

[0058] The vulnerability analysis module is further used to generate a vulnerability analysis result of the target network according to the vulnerability mining result, the vulnerability scanning result and the vulnerability utilization rate.

[0059] Optionally, the vulnerability analysis module is further used to obtain the defense strength, attack recognition rate and attack cost of the target network;

[0060] The vulnerability analysis module is further used to analyze the possibility of the vulnerability of the target network being attacked according to the defense strength, the attack recognition rate and the attack cost, and obtain the vulnerability utilization rate.

[0061] Optionally, the vulnerability analysis module is further used to scan known vulnerabilities of the target network through a preset crawler script based on a preset scanning strategy and a vulnerability information library to obtain vulnerability scanning results.

[0062] Optionally, the attack scenario reproducing device of the industrial Internet further includes: an alarm analysis module;

[0063] The alarm analysis module is used to pre-process the alarm data of the target network to obtain an alarm set;

[0064] The alarm analysis module is further used to analyze the correlation between the alarms in the alarm set;

[0065] The alarm analysis module is further used to determine the alarm level of each alarm in the alarm set;

[0066] The alarm analysis module is further used to generate an alarm analysis result of the target network based on the association relationship and the alarm level.

[0067] Optionally, the alarm analysis module is further used to obtain the threat level and associated asset weight of each alarm in the alarm set;

[0068] The alarm analysis module is further used to determine the alarm level of each alarm in the alarm set based on the threat level and the associated asset weight.

[0069] The present invention discloses a method of obtaining attack information based on vulnerability analysis results and alarm analysis results of a target network, determining an attack path based on the attack information, generating an attack code based on the attack path, obtaining a network protocol packet, and reproducing a network attack scenario of the target network based on the attack code and the network protocol packet. Since the present invention reproduces the attack scenario of the industrial Internet from the dimensions of vulnerability analysis and alarm analysis, it is able to accurately restore the attack source, attack target, and possible consequences of the attack, thereby ensuring the authenticity of the attack scenario reproduction of the industrial Internet, and thereby improving the scenario reproduction effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 It is a structural diagram of an attack scenario reproducing device of the industrial Internet in the hardware operating environment involved in the embodiment of the present invention;

[0071] Figure 2 It is a flow chart of the first embodiment of the method for reproducing the attack scenario of the industrial Internet of the present invention;

[0072] Figure 3 It is a flow chart of the second embodiment of the method for reproducing the attack scenario of the industrial Internet of the present invention;

[0073] Figure 4 It is a flow chart of the third embodiment of the method for reproducing the attack scenario of the industrial Internet of the present invention;

[0074] Figure 5 This is a structural block diagram of the first embodiment of the attack scenario reproduction device for the industrial Internet of the present invention.

[0075] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0076] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0077] Reference Figure 1 , Figure 1 The present invention is a schematic diagram of the attack scenario reproduction device structure of the industrial Internet in the hardware operating environment involved in the embodiment of the present invention.

[0078] like Figure 1 As shown, the attack scenario reproducing device of the industrial Internet may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The wired interface of the user interface 1003 may be a USB interface in the present invention. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable memory (Non-volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0079] Those skilled in the art will understand that Figure 1 The structure shown in does not constitute a limitation on the attack scenario reproduction device of the Industrial Internet, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0080] like Figure 1 As shown, the memory 1005 identified as a computer storage medium may include an operating system, a network communication module, a user interface module, and an attack scenario reproduction program for the industrial Internet.

[0081] exist Figure 1 In the attack scenario reproduction device of the industrial Internet shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to the user device; the attack scenario reproduction device of the industrial Internet calls the attack scenario reproduction program of the industrial Internet stored in the memory 1005 through the processor 1001, and executes the attack scenario reproduction method of the industrial Internet provided in the embodiment of the present invention.

[0082] Based on the above hardware structure, an embodiment of the method for reproducing attack scenarios of the industrial Internet of the present invention is proposed.

[0083] Reference Figure 2 , Figure 2 It is a flow chart of the first embodiment of the method for reproducing attack scenarios of the Industrial Internet of the present invention, and proposes the first embodiment of the method for reproducing attack scenarios of the Industrial Internet of the present invention.

[0084] In a first embodiment, the method for reproducing an attack scenario of the industrial Internet includes the following steps:

[0085] Step S10: Acquire attack information based on the vulnerability analysis results and alarm analysis results of the target network.

[0086] It should be understood that the executor of the method of this embodiment can be an attack scenario reproduction device of the industrial Internet with data processing, network communication and program running functions, such as a server, etc., or other electronic devices that can achieve the same or similar functions. This embodiment does not impose any restrictions on this.

[0087] It should be noted that the target network may be the industrial Internet that needs to reproduce the network attack scenario. In this embodiment and other embodiments, the target network may be an industrial control network.

[0088] The vulnerability analysis result can be obtained by performing a vulnerability analysis on the target network in advance, and the alarm analysis result can be obtained by performing an alarm analysis on the target network in advance.

[0089] It can be understood that obtaining attack information based on the vulnerability analysis results and alarm analysis results of the target network may be using the vulnerability analysis results and alarm analysis results of the target network as the attack information.

[0090] Step S20: determining an attack path according to the attack information, and generating an attack code based on the attack path.

[0091] It should be understood that determining the attack path according to the attack information may be performing attack path planning based on the attack information to obtain the attack path.

[0092] It can be understood that generating the attack code based on the attack path may be performing code restoration based on the attack path to obtain the attack code.

[0093] Step S30: Acquire a network protocol packet, and reproduce the network attack scenario of the target network based on the attack code and the network protocol packet.

[0094] It should be noted that the network protocol package can be pre-constructed, and the network protocol package is used to represent the network protocol corresponding to each network attack.

[0095] It should be understood that reproducing the network attack scenario of the target network based on the attack code and the network protocol packet can be reproducing the network attack scenario of the target network based on the attack code and the network protocol packet through a preset attack reproduction model. Among them, the preset attack reproduction model can be pre-set and used to analyze the attack code.

[0096] In the first embodiment, it is disclosed that attack information is obtained based on vulnerability analysis results and alarm analysis results of the target network, an attack path is determined according to the attack information, an attack code is generated based on the attack path, a network protocol packet is obtained, and a network attack scenario of the target network is reproduced based on the attack code and the network protocol packet; since this embodiment reproduces the network attack scenario from the dimensions of vulnerability analysis and alarm analysis, it is possible to accurately restore the attack source, attack target and possible consequences of the attack, thereby ensuring the authenticity of the network attack scenario reproduction, thereby improving the scenario reproduction effect.

[0097] Reference Figure 3 , Figure 3 This is a flow chart of the second embodiment of the method for reproducing the attack scenario of the industrial Internet of the present invention, based on the above Figure 2 The first embodiment shown proposes a second embodiment of the method for reproducing attack scenarios of the industrial Internet of the present invention.

[0098] In the second embodiment, before step S10, the method further includes:

[0099] Step S01: mining unknown vulnerabilities of the target network to obtain vulnerability mining results.

[0100] It should be understood that in order to improve the comprehensiveness of the vulnerability analysis results, in this embodiment, the vulnerability analysis can be performed from multiple dimensions.

[0101] It is understandable that mining unknown vulnerabilities of the target network and obtaining vulnerability mining results can be based on preset industrial control protocol rules to mine unknown vulnerabilities, and through dynamic tracking to identify the anomalies of industrial control equipment corresponding to the industrial control network, so as to obtain vulnerability mining results.

[0102] Step S02: Scan the known vulnerabilities of the target network to obtain vulnerability scanning results.

[0103] It should be understood that scanning the known vulnerabilities of the target network to obtain the vulnerability scanning results can be performed based on the vulnerability information library to scan the known vulnerabilities of the target network to obtain the vulnerability scanning results. The vulnerability information library can be used to store vulnerability information of the known vulnerabilities.

[0104] Furthermore, in order to improve the vulnerability scanning efficiency, the step S02 includes:

[0105] Based on the preset scanning strategy and vulnerability information library, the known vulnerabilities of the target network are scanned through a preset crawler script to obtain vulnerability scanning results.

[0106] It is understandable that in order to improve the efficiency of vulnerability scanning, in this embodiment, vulnerability scanning can also be performed with the help of preset scanning strategies and preset crawler scripts.

[0107] It should be noted that the preset scanning policy may be preset, for example, the preset scanning policy may be a host discovery scan, a quick scan or a deep scan.

[0108] Preset crawler scripts can be pre-set to crawl information on the network.

[0109] Step S03: Analyze the possibility of the vulnerability of the target network being attacked and obtain the vulnerability utilization rate.

[0110] It should be understood that analyzing the possibility of the target network vulnerability being attacked and obtaining the vulnerability utilization rate can be based on a preset attack analysis model to analyze the possibility of the target network vulnerability being attacked and obtain the vulnerability utilization rate. The preset attack analysis model can be preset.

[0111] Furthermore, in order to improve the accuracy of vulnerability utilization, step S03 includes:

[0112] Obtaining the defense strength, attack recognition rate, and attack cost of the target network;

[0113] The possibility of the vulnerability of the target network being attacked is analyzed according to the defense strength, the attack recognition rate and the attack cost to obtain the vulnerability utilization rate.

[0114] It should be understood that the possibility of the target network vulnerability being attacked is analyzed based on the defense strength, attack recognition rate and attack cost, and the vulnerability utilization rate can be obtained by calculating the vulnerability utilization rate through a preset utilization rate calculation formula based on the defense strength, attack recognition rate and attack cost. The preset utilization rate calculation formula is as follows:

[0115]

[0116] Where VU is the vulnerability utilization rate, d is the defense strength, id is the attack recognition rate, c is the attack cost, q1, q2, q3 are weight values, which can be set in advance.

[0117] Step S04: Generate a vulnerability analysis result of the target network according to the vulnerability mining result, the vulnerability scanning result and the vulnerability utilization rate.

[0118] It can be understood that generating the vulnerability analysis result of the target network according to the vulnerability mining result, the vulnerability scanning result and the vulnerability utilization rate may be to use the vulnerability mining result, the vulnerability scanning result and the vulnerability utilization rate as the vulnerability analysis result of the target network.

[0119] In the second embodiment, it is disclosed to mine unknown vulnerabilities of the target network, obtain vulnerability mining results, scan known vulnerabilities of the target network, obtain vulnerability scanning results, analyze the possibility of the vulnerabilities of the target network being attacked, obtain vulnerability utilization, and generate vulnerability analysis results of the target network according to the vulnerability mining results, vulnerability scanning results and vulnerability utilization; since this embodiment performs vulnerability analysis from multiple dimensions, it can improve the comprehensiveness of the vulnerability analysis results.

[0120] In the second embodiment, before step S10, the method further includes:

[0121] Step S01': pre-process the alarm data of the target network to obtain an alarm set.

[0122] It should be understood that in order to improve the comprehensiveness of the alarm analysis results, in this embodiment, the alarm analysis can be performed from multiple dimensions.

[0123] It is understandable that, in order to remove interference data, in this embodiment, the alarm data of the target network may be pre-processed to obtain an alarm set.

[0124] Furthermore, in order to improve the preprocessing efficiency, the step S01' comprises:

[0125] Screening the alarm data to obtain target data;

[0126] Performing vectorization conversion on the target data to obtain an alarm coefficient;

[0127] An alarm set is determined according to the attack scenario corresponding to the alarm coefficient.

[0128] It can be understood that screening the alarm data to obtain the target data may be to delete meaningless alarm data and / or aggregate redundant alarm data from the alarm data, and this embodiment does not impose any limitation on this.

[0129] It should be understood that performing vectorization conversion on the target data to obtain the alarm coefficient may be performing vectorization conversion on the target data based on a preset vectorization model to obtain the alarm coefficient, wherein the preset vectorization model may be pre-set.

[0130] It is understandable that determining the alarm set according to the attack scenario corresponding to the alarm coefficient may be to first determine the attack scenario corresponding to each alarm according to the alarm system, and then classify the alarms according to the attack scenario to obtain the alarm set. Classifying the alarms according to the attack scenario may be to classify the alarms under the same attack scenario into the same alarm set.

[0131] Step S02': Analyze the correlation between the alarms in the alarm set.

[0132] It should be understood that analyzing the correlation between the alarms in the alarm set may be analyzing the causal relationship between the alarms in the alarm set, analyzing the similarity between the alarms in the alarm set, and determining the correlation between the alarms in the alarm set based on the causal relationship and / or similarity.

[0133] Furthermore, in order to improve the accuracy of the association relationship, the step S02' includes:

[0134] Analyze the cause-effect relationship between the alarms in the alarm set;

[0135] Analyzing similarities between the alarms in the alarm set;

[0136] The correlation relationship between the alarms in the alarm set is determined according to the causal relationship and the similarity.

[0137] It is understandable that in order to improve the accuracy of the correlation relationship, in this embodiment, the correlation relationship between the alarms can be analyzed from the dimensions of causality and similarity.

[0138] It should be understood that determining the correlation between the alarms in the alarm set according to the causal relationship and the similarity may be taking the causal relationship and the similarity as the correlation between the alarms.

[0139] Step S03': Determine the alarm level of each alarm in the alarm set.

[0140] It can be understood that determining the alarm level of each alarm in the alarm set may be to obtain the alarm type of each alarm in the alarm set and search for the alarm level corresponding to the alarm type.

[0141] It should be understood that searching for the alarm level corresponding to the alarm type may be searching for the alarm level corresponding to the alarm type in a preset alarm table, wherein the preset alarm table includes the correspondence between the alarm type and the alarm level, and the correspondence between the alarm type and the alarm level may be pre-entered.

[0142] Furthermore, in order to improve the reliability of the alarm level, the step S03' comprises:

[0143] Obtaining the threat level and associated asset weight of each alarm in the alarm set;

[0144] The alarm level of each alarm in the alarm set is determined based on the threat level and the associated asset weight.

[0145] It can be understood that in order to improve the reliability of the alarm level, in this embodiment, the alarm level of each alarm in the alarm set can be determined from the dimensions of threat degree and associated asset weight.

[0146] Step S04': generating an alarm analysis result of the target network based on the association relationship and the alarm level.

[0147] It should be understood that generating the alarm analysis result of the target network based on the association relationship and the alarm level may be to use the association relationship and the alarm level as the alarm analysis result of the target network.

[0148] In the second embodiment, it is disclosed to pre-process the alarm data of the target network, obtain an alarm set, analyze the correlation between the alarms in the alarm set, determine the alarm level of each alarm in the alarm set, and generate the alarm analysis results of the target network based on the correlation and the alarm level; since this embodiment performs alarm analysis from multiple dimensions, it can improve the comprehensiveness of the alarm analysis results.

[0149] Reference Figure 4 , Figure 4 This is a flow chart of the third embodiment of the method for reproducing attack scenarios of the Industrial Internet of the present invention. Based on the above embodiments, the third embodiment of the method for reproducing attack scenarios of the Industrial Internet of the present invention is proposed.

[0150] In the third embodiment, the step S10 includes:

[0151] Step S101: Acquire configuration parameter information and industrial control equipment information of the target network.

[0152] It should be understood that, in order to improve the comprehensiveness of the attack information, in this embodiment, configuration parameter information and industrial control equipment information are also introduced as attack information.

[0153] It should be noted that the target network may be the industrial Internet that needs to reproduce the network attack scenario. In this embodiment and other embodiments, the target network may be an industrial control network.

[0154] The industrial control device information may be information of the industrial control device connected to the target network.

[0155] Step S102: acquiring attack information based on vulnerability analysis results, alarm analysis results, configuration parameter information, and industrial control equipment information of the target network.

[0156] It can be understood that obtaining attack information based on vulnerability analysis results, alarm analysis results, configuration parameter information and industrial control equipment information of the target network may be using the vulnerability analysis results, alarm analysis results, configuration parameter information and industrial control equipment information of the target network as attack information.

[0157] In the third embodiment, it is disclosed to obtain configuration parameter information and industrial control equipment information of the target network, and obtain attack information based on the vulnerability analysis results, alarm analysis results, configuration parameter information and industrial control equipment information of the target network; because in this embodiment, configuration parameter information and industrial control equipment information are also introduced as attack information, the comprehensiveness of the attack information can be improved.

[0158] In the third embodiment, the step S20 includes:

[0159] Step S201: determining an attack step node and an attack authority node according to the attack information.

[0160] It should be understood that in order to ensure the reproducibility of the attack path, in this embodiment, the attack path is determined based on the attack step node and the attack authority node.

[0161] It can be understood that determining the attack step node and the attack authority node according to the attack information may be to extract the attack information to obtain the attack step node and the attack authority node.

[0162] Step S202: determining an attack path according to the attack step node and the attack authority node.

[0163] It should be understood that determining the attack path according to the attack step nodes and the attack authority nodes may be performing path planning according to the attack step nodes and the attack authority nodes to obtain the attack path.

[0164] Step S203: Generate attack code based on the attack path.

[0165] It can be understood that generating the attack code based on the attack path may be performing code restoration based on the attack path to obtain the attack code.

[0166] In the third embodiment, it is disclosed to determine the attack step node and the attack permission node according to the attack information, determine the attack path according to the attack step node and the attack permission node, and generate the attack code based on the attack path; since this embodiment determines the attack path based on the attack step node and the attack permission node, the reproducibility of the attack path can be ensured.

[0167] Furthermore, in order to ensure the reliability of the attack code, step S203 includes:

[0168] Determine the vulnerability utilization rate according to the vulnerability analysis result, and determine the alarm coefficient according to the alarm analysis result;

[0169] An attack code is generated based on the attack path, the vulnerability utilization rate, and the warning coefficient.

[0170] It should be understood that in order to ensure the reliability of the attack code, in this embodiment, the vulnerability utilization rate and the warning coefficient may also be introduced to generate the attack code.

[0171] In the third embodiment, the step S30 includes:

[0172] Step S301: Acquire a network protocol packet, and match the attack code with the network protocol packet.

[0173] It should be understood that in order to improve the efficiency of reproducing the network attack scenario, in this embodiment, the attack code can be directly matched with the network protocol packet, and the network attack scenario of the target network can be reproduced according to the matching result.

[0174] It should be noted that the network protocol package can be pre-constructed, and the network protocol package is used to represent the network protocol corresponding to each network attack.

[0175] Step S302: Reproduce the network attack scenario of the target network according to the matching result.

[0176] It can be understood that reproducing the network attack scenario of the target network according to the matching result can mean that when the matching result is a successful match, it means that the network attack scenario is successfully reproduced; when the matching result is a failed match, it means that the network attack scenario is failed to be reproduced.

[0177] In the third embodiment, it is disclosed to obtain a network protocol packet, match the attack code with the network protocol packet, and reproduce the network attack scenario of the target network according to the matching result; because this embodiment directly matches the attack code with the network protocol packet, and reproduces the network attack scenario of the target network according to the matching result, the efficiency of reproducing the network attack scenario can be improved.

[0178] In addition, an embodiment of the present invention also proposes a storage medium, on which an attack scenario reproduction program for the industrial Internet is stored. When the attack scenario reproduction program for the industrial Internet is executed by a processor, the attack scenario reproduction method for the industrial Internet as described above is implemented.

[0179] In addition, refer to Figure 5 , an embodiment of the present invention further proposes an attack scenario reproducing device for industrial Internet, the attack scenario reproducing device for industrial Internet comprising: an information acquisition module 10, a code generation module 20 and a scenario reproducing module 30;

[0180] The information acquisition module 10 is used to acquire attack information based on vulnerability analysis results and alarm analysis results of the target network.

[0181] It should be noted that the target network may be the industrial Internet that needs to reproduce the network attack scenario. In this embodiment and other embodiments, the target network may be an industrial control network.

[0182] The vulnerability analysis result can be obtained by performing a vulnerability analysis on the target network in advance, and the alarm analysis result can be obtained by performing an alarm analysis on the target network in advance.

[0183] It can be understood that obtaining attack information based on the vulnerability analysis results and alarm analysis results of the target network may be using the vulnerability analysis results and alarm analysis results of the target network as the attack information.

[0184] The code generation module 20 is used to determine an attack path according to the attack information, and generate an attack code based on the attack path.

[0185] It should be understood that determining the attack path according to the attack information may be performing attack path planning based on the attack information to obtain the attack path.

[0186] It can be understood that generating the attack code based on the attack path may be performing code restoration based on the attack path to obtain the attack code.

[0187] The scenario reproducing module 30 is used to obtain a network protocol packet and reproduce the network attack scenario of the target network based on the attack code and the network protocol packet.

[0188] It should be noted that the network protocol package can be pre-constructed, and the network protocol package is used to represent the network protocol corresponding to each network attack.

[0189] It should be understood that reproducing the network attack scenario of the target network based on the attack code and the network protocol packet can be reproducing the network attack scenario of the target network based on the attack code and the network protocol packet through a preset attack reproduction model. Among them, the preset attack reproduction model can be pre-set and used to analyze the attack code.

[0190] In this embodiment, it is disclosed to obtain attack information based on vulnerability analysis results and alarm analysis results of the target network, determine the attack path according to the attack information, generate attack code based on the attack path, obtain network protocol packets, and reproduce the network attack scenario of the target network based on the attack code and the network protocol packet; because this embodiment reproduces the network attack scenario from the dimensions of vulnerability analysis and alarm analysis, it can accurately restore the attack source, attack target and possible consequences of the attack, ensure the authenticity of the network attack scenario reproduction, and thus improve the scenario reproduction effect.

[0191] Other embodiments or specific implementation methods of the attack scenario reproduction device of the industrial Internet described in the present invention can refer to the above-mentioned method embodiments and will not be repeated here.

[0192] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0193] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0194] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, in essence or in other words, the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory image (ROM) / random access memory (RAM), a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0195] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0196] The present invention discloses A1, a method for reproducing an attack scenario of an industrial Internet, and the method for reproducing an attack scenario of an industrial Internet comprises the following steps:

[0197] Obtain attack information based on vulnerability analysis results and alarm analysis results of the target network;

[0198] Determine an attack path according to the attack information, and generate an attack code based on the attack path;

[0199] A network protocol packet is obtained, and a network attack scenario of the target network is reproduced based on the attack code and the network protocol packet.

[0200] A2. The method for reproducing an attack scenario of the industrial Internet as described in A1, before the step of obtaining attack information based on the vulnerability analysis results and alarm analysis results of the target network, further includes:

[0201] Mining unknown vulnerabilities of the target network and obtaining vulnerability mining results;

[0202] Scanning known vulnerabilities of the target network to obtain vulnerability scanning results;

[0203] Analyze the possibility of the target network's vulnerability being attacked and obtain the vulnerability utilization rate;

[0204] Generate a vulnerability analysis result of the target network according to the vulnerability mining result, the vulnerability scanning result and the vulnerability utilization rate.

[0205] A3. The method for reproducing the attack scenario of the industrial Internet as described in A2, wherein the step of analyzing the possibility of the vulnerability of the target network being attacked and obtaining the vulnerability utilization rate comprises:

[0206] Obtaining the defense strength, attack recognition rate, and attack cost of the target network;

[0207] The possibility of the vulnerability of the target network being attacked is analyzed according to the defense strength, the attack recognition rate and the attack cost to obtain the vulnerability utilization rate.

[0208] A4. In the method for reproducing an attack scenario of the industrial Internet as described in A2, the step of scanning the known vulnerabilities of the target network to obtain vulnerability scanning results comprises:

[0209] Based on the preset scanning strategy and vulnerability information library, the known vulnerabilities of the target network are scanned through a preset crawler script to obtain vulnerability scanning results.

[0210] A5. The method for reproducing an attack scenario of the industrial Internet as described in A1, before the step of obtaining attack information based on the vulnerability analysis results and alarm analysis results of the target network, further includes:

[0211] Pre-process the alarm data of the target network to obtain an alarm set;

[0212] Analyze the correlation between the alarms in the alarm set;

[0213] Determining the alarm level of each alarm in the alarm set;

[0214] An alarm analysis result of the target network is generated based on the association relationship and the alarm level.

[0215] A6. In the method for reproducing an attack scenario of the industrial Internet as described in A5, the step of determining the alarm level of each alarm in the alarm set comprises:

[0216] Obtaining the threat level and associated asset weight of each alarm in the alarm set;

[0217] The alarm level of each alarm in the alarm set is determined based on the threat level and the associated asset weight.

[0218] A7. In the method for reproducing an attack scenario of the industrial Internet as described in A5, the step of analyzing the correlation between the alarms in the alarm set comprises:

[0219] Analyze the cause-effect relationship between the alarms in the alarm set;

[0220] Analyzing similarities between the alarms in the alarm set;

[0221] The correlation relationship between the alarms in the alarm set is determined according to the causal relationship and the similarity.

[0222] A8. In the method for reproducing an attack scenario of the industrial Internet as described in A5, the step of preprocessing the alarm data of the target network to obtain an alarm set includes:

[0223] Screening the alarm data to obtain target data;

[0224] Performing vectorization conversion on the target data to obtain an alarm coefficient;

[0225] An alarm set is determined according to the attack scenario corresponding to the alarm coefficient.

[0226] A9. The method for reproducing an attack scenario of the industrial Internet as described in any one of A1 to A8, wherein the step of determining an attack path according to the attack information and generating an attack code based on the attack path comprises:

[0227] Determine an attack step node and an attack authority node according to the attack information;

[0228] Determine an attack path according to the attack step node and the attack authority node;

[0229] An attack code is generated based on the attack path.

[0230] A10. In the method for reproducing an attack scenario of the industrial Internet as described in A9, the step of generating an attack code based on the attack path comprises:

[0231] Determine the vulnerability utilization rate according to the vulnerability analysis result, and determine the alarm coefficient according to the alarm analysis result;

[0232] An attack code is generated based on the attack path, the vulnerability utilization rate, and the warning coefficient.

[0233] A11. The method for reproducing an attack scenario of the industrial Internet as described in any one of A1 to A8, wherein the step of obtaining a network protocol packet and reproducing the network attack scenario of the target network based on the attack code and the network protocol packet comprises:

[0234] Acquire a network protocol packet, and match the attack code with the network protocol packet;

[0235] Reproduce the network attack scenario of the target network according to the matching result.

[0236] A12. In the method for reproducing an attack scenario of the industrial Internet as described in any one of A1 to A8, the step of obtaining attack information based on the vulnerability analysis results and alarm analysis results of the target network comprises:

[0237] Obtain configuration parameter information and industrial control equipment information of the target network;

[0238] Attack information is obtained based on vulnerability analysis results, alarm analysis results, configuration parameter information, and industrial control equipment information of the target network.

[0239] The present invention also discloses B13, an attack scenario reproduction device for an industrial Internet, the attack scenario reproduction device for the industrial Internet comprising: a memory, a processor, and an attack scenario reproduction program for the industrial Internet stored in the memory and executable on the processor, the attack scenario reproduction program for the industrial Internet, when executed by the processor, implements the attack scenario reproduction method for the industrial Internet as described above.

[0240] The present invention also discloses C14, a storage medium, on which is stored an attack scenario reproduction program for the industrial Internet. When the attack scenario reproduction program for the industrial Internet is executed by a processor, the attack scenario reproduction method for the industrial Internet as described above is implemented.

[0241] The present invention also discloses D15, an attack scenario reproducing device for industrial Internet, the attack scenario reproducing device for industrial Internet comprising: an information acquisition module, a code generation module and a scenario reproducing module;

[0242] The information acquisition module is used to acquire attack information based on vulnerability analysis results and alarm analysis results of the target network;

[0243] The code generation module is used to determine an attack path according to the attack information, and generate an attack code based on the attack path;

[0244] The scenario reproduction module is used to obtain a network protocol packet and reproduce the network attack scenario of the target network based on the attack code and the network protocol packet.

[0245] D16. The attack scenario reproducing device for the industrial Internet as described in D15, wherein the attack scenario reproducing device for the industrial Internet further comprises: a vulnerability analysis module;

[0246] The vulnerability analysis module is used to mine unknown vulnerabilities of the target network and obtain vulnerability mining results;

[0247] The vulnerability analysis module is further used to scan the known vulnerabilities of the target network to obtain vulnerability scanning results;

[0248] The vulnerability analysis module is also used to analyze the possibility of the vulnerability of the target network being attacked and obtain the vulnerability utilization rate;

[0249] The vulnerability analysis module is further used to generate a vulnerability analysis result of the target network according to the vulnerability mining result, the vulnerability scanning result and the vulnerability utilization rate.

[0250] D17. The attack scenario reproducing device for the industrial Internet as described in D16, wherein the vulnerability analysis module is further used to obtain the defense strength, attack recognition rate and attack cost of the target network;

[0251] The vulnerability analysis module is further used to analyze the possibility of the vulnerability of the target network being attacked according to the defense strength, the attack recognition rate and the attack cost, and obtain the vulnerability utilization rate.

[0252] D18. The attack scenario reproduction device of the industrial Internet as described in D16, wherein the vulnerability analysis module is further used to scan the known vulnerabilities of the target network through a preset crawler script based on a preset scanning strategy and a vulnerability information library to obtain vulnerability scanning results.

[0253] D19. The attack scenario reproducing device of the industrial Internet as described in D15, wherein the attack scenario reproducing device of the industrial Internet further comprises: an alarm analysis module;

[0254] The alarm analysis module is used to pre-process the alarm data of the target network to obtain an alarm set;

[0255] The alarm analysis module is further used to analyze the correlation between the alarms in the alarm set;

[0256] The alarm analysis module is further used to determine the alarm level of each alarm in the alarm set;

[0257] The alarm analysis module is further used to generate an alarm analysis result of the target network based on the association relationship and the alarm level.

[0258] D20. The attack scenario reproducing device of the industrial Internet as described in D19, wherein the alarm analysis module is further used to obtain the threat level and associated asset weight of each alarm in the alarm set;

[0259] The alarm analysis module is further used to determine the alarm level of each alarm in the alarm set based on the threat level and the associated asset weight.

Claims

1. A method for reproducing an attack scenario of an industrial Internet, characterized in that: The method for reproducing the attack scenario of the industrial Internet comprises the following steps: Obtain attack information based on vulnerability analysis results and alarm analysis results of the target network; Determine an attack path according to the attack information, and generate an attack code based on the attack path; A network protocol packet is obtained, and a network attack scenario of the target network is reproduced based on the attack code and the network protocol packet.

2. The method for reproducing an attack scenario of the industrial Internet according to claim 1, characterized in that: Before the step of acquiring attack information based on the vulnerability analysis results and the alarm analysis results of the target network, the method further includes: Mining unknown vulnerabilities of the target network and obtaining vulnerability mining results; Scanning known vulnerabilities of the target network to obtain vulnerability scanning results; Analyze the possibility of the target network's vulnerability being attacked and obtain the vulnerability utilization rate; Generate a vulnerability analysis result of the target network according to the vulnerability mining result, the vulnerability scanning result and the vulnerability utilization rate.

3. The method for reproducing an attack scenario of the industrial Internet as claimed in claim 2, characterized in that: The step of analyzing the possibility of the vulnerability of the target network being attacked and obtaining the vulnerability utilization rate includes: Obtaining the defense strength, attack recognition rate, and attack cost of the target network; The possibility of the vulnerability of the target network being attacked is analyzed according to the defense strength, the attack recognition rate and the attack cost to obtain the vulnerability utilization rate.

4. The method for reproducing an attack scenario of the industrial Internet as claimed in claim 2, characterized in that: The step of scanning the known vulnerabilities of the target network to obtain vulnerability scanning results includes: Based on the preset scanning strategy and vulnerability information library, the known vulnerabilities of the target network are scanned through a preset crawler script to obtain vulnerability scanning results.

5. The method for reproducing an attack scenario of the industrial Internet according to claim 1, characterized in that: Before the step of acquiring attack information based on the vulnerability analysis results and the alarm analysis results of the target network, the method further includes: Pre-process the alarm data of the target network to obtain an alarm set; Analyze the correlation between the alarms in the alarm set; Determining the alarm level of each alarm in the alarm set; An alarm analysis result of the target network is generated based on the association relationship and the alarm level.

6. The method for reproducing an attack scenario of the industrial Internet according to claim 5, characterized in that: The step of determining the alarm level of each alarm in the alarm set includes: Obtaining the threat level and associated asset weight of each alarm in the alarm set; The alarm level of each alarm in the alarm set is determined based on the threat level and the associated asset weight.

7. The method for reproducing an attack scenario of the industrial Internet according to claim 5, characterized in that: The step of analyzing the correlation between the alarms in the alarm set includes: Analyze the cause-effect relationship between the alarms in the alarm set; Analyzing similarities between the alarms in the alarm set; The correlation relationship between the alarms in the alarm set is determined according to the causal relationship and the similarity.

8. An attack scenario reproduction device for the industrial Internet, characterized in that: The attack scenario reproduction device of the industrial Internet includes: a memory, a processor, and an attack scenario reproduction program of the industrial Internet stored in the memory and executable on the processor. When the attack scenario reproduction program of the industrial Internet is executed by the processor, the attack scenario reproduction method of the industrial Internet as described in any one of claims 1 to 7 is implemented.

9. A storage medium, characterized in that: The storage medium stores an attack scenario reproduction program for the Industrial Internet, and when the attack scenario reproduction program for the Industrial Internet is executed by the processor, the attack scenario reproduction method for the Industrial Internet as described in any one of claims 1 to 7 is implemented.

10. An attack scenario reproducing device for industrial Internet, characterized in that: The attack scenario reproducing device of the industrial Internet includes: an information acquisition module, a code generation module and a scenario reproducing module; The information acquisition module is used to acquire attack information based on vulnerability analysis results and alarm analysis results of the target network; The code generation module is used to determine an attack path according to the attack information, and generate an attack code based on the attack path; The scenario reproduction module is used to obtain a network protocol packet and reproduce the network attack scenario of the target network based on the attack code and the network protocol packet.

Images