Key defense node set selection method and system based on attribute attack graph

Abstract

The invention discloses a key defense node set selection method and system based on an attribute attack graph, and the method comprises the steps: firstly carrying out the strong connected component division of the attribute attack graph, and obtaining a strong connected graph; generating an abstract graph according to the strongly connected graph obtained by division; and finally, selecting a key defense node set according to the abstract graph. The complexity of the attack graph is reduced, the defense efficiency and accuracy are improved, and the method can be widely applied to the technical field of computers.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and system for selecting a key defense node set based on an attribute attack graph. Background Art

[0002] An attack graph is a graphical tool for analyzing the security of a computer system. It is used to describe possible security vulnerabilities in the system and how attackers can enter the system, obtain sensitive information, and control the system. It helps security teams assess the security of the system and take appropriate measures to strengthen defense by graphically representing the vulnerabilities that attackers can exploit, attack paths, and possible security risks. Its components usually consist of topics, vulnerabilities, assets, vulnerability exploits, and attack paths. Attack graphs can provide security teams with potential attack paths, key assets, security control deficiencies, and threat models.

[0003] The traversal of the attack graph represents the attacker's direction from the current attack node to the next attack node, or from the current network state to the new network state after completing one attack step. The types of attack graphs vary depending on the content represented by the vertices of the attack graph. When the vertices represent network security-related elements, the type of attack graph is an attribute attack graph, and when the vertices represent network states, the type of attack graph is a state attack graph.

[0004] The attribute attack graph usually contains two different types of nodes and two different types of edges. Among them, the condition node represents the precondition that the attacker must meet before attacking, and the vulnerability node represents the vulnerability that the attacker can exploit to obtain higher permissions. The leading edge points from the condition node to the vulnerability node, indicating the prerequisite that the attacker needs to meet to exploit this vulnerability. The trailing edge points from the vulnerability node to the condition node, indicating the possible consequences after the vulnerability is exploited.

[0005] MLC (Minimum Label Cut) is to identify a set of minimum attacks in the attack graph. If these attacks are blocked, the attacker will not be able to reach the target node from the starting node, that is, the system-level security cannot be compromised. In graph theory, this is equivalent to finding a set of minimum attack labels, whose corresponding edges, if removed from the graph, will eliminate all paths from the starting node to the target node.

[0006] The existing MLC algorithm has three main shortcomings:

[0007] (1) Existing MLC algorithms are usually computationally infeasible when dealing with MLC problems, because MLC is an NP-complete problem and a direct solution requires exponential time complexity.

[0008] (2) Although some approximate algorithms can provide solutions, they may not guarantee the smallest attack set found, or the approximation factor is large, resulting in an inaccurate solution.

[0009] (3) Some algorithms may only be applicable to specific types of attack graphs, not be universal, or be limited by label frequency, which limits their application to more general attack graphs.

[0010] The disadvantage of the attribute attack graph is that loop problems are prone to occur in the attribute attack graph. Summary of the invention

[0011] The main purpose of the embodiments of the present invention is to propose a method and system for selecting a key defense node set based on an attribute attack graph, which can reduce the complexity of the problem and improve efficiency and accuracy.

[0012] To achieve the above object, an embodiment of the present invention proposes a method for selecting a key defense node set based on an attribute attack graph, comprising the following steps:

[0013] Divide the attribute attack graph into strongly connected components to obtain a strongly connected graph;

[0014] Generate an abstract graph according to the strongly connected graph obtained by dividing;

[0015] A set of key defense nodes is selected according to the abstract graph.

[0016] In some embodiments, dividing the attribute attack graph into strongly connected components to obtain a strongly connected graph includes the following steps:

[0017] Starting from the attacking node, all nodes that can be reached by the attacking node are divided into strongly connected components;

[0018] Maintain a stack to store visited nodes;

[0019] Bind two variables aid and lowid to each node; wherein the variable aid represents the sequential index of the node visited during the depth-first search process; the variable lowid represents the node with the minimum aid value reached by the node through the dfs path; the variable lowid is used to determine whether there is a loop and identify the strongly connected component by updating the value of lowid;

[0020] Perform a depth-first search on each unvisited node, mark the current node as visited, assign aid and lowid, and push the node into the stack;

[0021] Traverse all child nodes of the current node: if the child node has not been visited, update the lowid of the current node; if the child node is already in the stack, update the lowid of the current node to maintain the minimum reachable index;

[0022] Determine the strongly connected component: If the aid of the current node is equal to lowid, the current node is the root node of a strongly connected component; pop nodes from the stack until the current node is popped, and mark these nodes as an SCC;

[0023] When recursively returning, the lowid value of the current node is passed to update the lowid of the upper node until all nodes in the attribute attack graph are visited.

[0024] In some embodiments, generating an abstract graph according to the strongly connected graph obtained by dividing comprises the following steps:

[0025] Generate an abstract graph structure based on the partitioning results of strongly connected components;

[0026] Quantifying the cost of defending abstract graphs.

[0027] In some embodiments, the step of generating an abstract graph structure based on the strongly connected component partitioning result comprises the following steps:

[0028] Analyze the characteristics of the attribute attack graph, exclude nodes that do not participate in the strong connected component division, reduce the number of strong connected component divisions, and divide the nodes into three basic types: source nodes, and nodes, and or nodes;

[0029] Among them, for the source node: in the attribute attack graph, the source node is divided into an attacker node and a condition node; the attacker node participates in the division of the strongly connected component as the starting node of the attack graph, and the condition node serves as the precondition of the and node, so that when accessing the and node, the corresponding precondition node is accessed, and the condition node is not accessed separately;

[0030] For and nodes and or nodes: and nodes represent rule nodes, which are elliptical nodes in the attack graph; or nodes are conditional nodes pointed to by and nodes, which are diamond nodes in the attack graph and serve as precondition nodes for other and nodes;

[0031] Mark all the and nodes, or nodes and source attack nodes in the attack graph with the strongly connected components they belong to, and use the numbers to generate an abstract graph structure.

[0032] In some embodiments, the step of marking all and nodes, or nodes, and source attack nodes of the attack graph with numbers of strongly connected components to which they belong, and using the numbers to generate an abstract graph structure comprises the following steps:

[0033] Create a node set nodeSet of the abstract graph, each node corresponds to an SCC;

[0034] Initialize the attacker and target sets, and add the nodes belonging to the attacker and target in the original graph to the corresponding sets in the line drawing graph;

[0035] Traverse the nodes in the attack graph and process each node and its predecessor edge; the processing of the predecessor edge is used to calculate the cost of cutting the edge of the abstract graph;

[0036] For each and node, calculate the predecessor edges of different SCCs connected to it, and take the edge with the smallest cost as the abstract edge; the cost of the abstract edge is its predecessor node with the smallest cost;

[0037] For each or node, traverse its predecessor edges, add each predecessor edge to the abstract edge, and calculate the cumulative cost of the predecessor nodes as the cost of cutting the abstract edge.

[0038] In some embodiments, the quantifying the defense cost of the abstract graph comprises the following steps:

[0039] First, a defense cost quantification method for nodes in the attribute attack graph is designed, then a quantification method for abstract edge cutting cost of the abstract graph is designed, and finally the defense cost quantification of the abstract graph is completed; among which, the defense method of the abstract graph is to cut the abstract edges between adjacent abstract points, and the defense cost of the abstract graph is quantified as the cutting cost of the abstract edges, and the quantification of the cutting cost depends on the defense cost of the nodes in the original attack graph.

[0040] In some embodiments, for a source node in the original attack graph, the defense cost of the source node is defined as the cost of cutting the edge from the current node to the subsequent node, and the cutting cost is quantified as the result of comprehensive consideration of multiple factors of the node, including the defense strategy execution cost factor, the attacker's attack benefit factor, and the attacker's attack cost factor; the source node is divided into a vulnerability node, a host configuration node, a network configuration node, and a main node;

[0041] For the and node and or node in the original attack graph, the or node is the post-node pointed to by the and node, and the quantification of the or node defense cost depends on the defense cost of the and node;

[0042] For the defense cost quantification of the and node, if all the preconditions of the and node are met, the and node is used to reach the subsequent or node, and a leading edge of the and node is cut to intercept the attacker from reaching the subsequent node. The defense cost of the and node is quantified as the defense cost of the preceding node with the smallest defense cost. The cut edge is the leading edge corresponding to the and node connecting the preceding node, which means that defense is arranged for the preceding node of the leading edge, thereby intercepting the attacker's path from the and node to the subsequent node. Among them, there are two types of leading edges of the and node, one is the leading edge connecting the source condition node, and the other is the leading edge connecting the or node.

[0043] For the defense cost quantification of the or node, if any of the preconditions is met, then according to the or node reaching the subsequent and node, all the preceding edges of the or node are cut to intercept the attacker from reaching the subsequent node. The defense cost of the or node is quantified as the sum of the defense costs of all preceding nodes, and the cut edges are all preceding edges;

[0044] According to the quantified results of the defense costs of the source node, the and node and the or node, a cutting cost calculation method for abstract edges is constructed; wherein the abstract edges are divided into two types: one is an abstract edge with the starting attack node as the source point, and the other is an abstract edge with other abstract points as the source point;

[0045] Among them, the cutting cost calculation algorithm steps of the abstract edge in the abstract graph are:

[0046] Traverse the original node;

[0047] If the node is an and node, traverse its predecessor edge. If the predecessor edge connects two different abstract points, obtain the corresponding abstract edge, add the defense cost of the and node to the cutting cost of the abstract edge, and record the cutting edge set from the and node cutting edge to the abstract edge;

[0048] If the node is an or node, traverse its predecessor edge. If the predecessor edge connects two different abstract points, obtain the corresponding abstract edge, take the and node defense cost connected by the predecessor edge to initialize the abstract edge, and record the cut edge of the and node to the cut edge set of the abstract edge.

[0049] In some embodiments, selecting a set of key defense nodes according to the abstract graph comprises the following steps:

[0050] Randomly select an unvisited target abstract node V and initialize its minimum defense cost CostV to 0;

[0051] If point V does not have a preceding edge, update and return its minimum defense cost as the maximum value;

[0052] Traverse the preceding abstract edge E. If the source abstract point U of edge E has not been visited, recursively return the minimum defense cost CostU of point U and the corresponding minimum cut edge set; if the source abstract point U has been visited, directly take its CostU;

[0053] By comparing CostU with the cutting cost CostE of edge E, the minimum defense cost CostV and the minimum cutting edge set CutV of the current node V are updated;

[0054] Among them, the calculation formula of the minimum defense cost CostV is: CostV=CostV+Min(CostU,CostE)

[0055] The key defense node set of the target node is calculated, and the key defense node set of all traversed abstract nodes is calculated.

[0056] Another aspect of the embodiment of the present invention further provides a key defense node set selection system based on an attribute attack graph, comprising:

[0057] The first module is used to divide the attribute attack graph into strongly connected components to obtain a strongly connected graph;

[0058] The second module is used to generate an abstract graph according to the strongly connected graph obtained by division;

[0059] The third module is used to select a set of key defense nodes according to the abstract graph.

[0060] To achieve the above objective, another aspect of an embodiment of the present invention provides an electronic device, the electronic device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the above-mentioned method when executing the computer program.

[0061] To achieve the above objective, another aspect of an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned method is implemented.

[0062] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0063] The embodiments of the present invention include at least the following beneficial effects: the present invention provides a method and system for selecting a key defense node set based on an attribute attack graph, the scheme first divides the attribute attack graph into strongly connected components to obtain a strongly connected graph; then generates an abstract graph based on the strongly connected graph obtained by the division; finally, selects a key defense node set based on the abstract graph. The present invention reduces the complexity of the attack graph and improves the defense efficiency and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 It is a schematic diagram of an implementation environment provided by an embodiment of the present invention;

[0065] Figure 2 is a flow chart of the overall steps provided by an embodiment of the present invention;

[0066] Figure 3 is an attribute attack graph provided by an embodiment of the present invention;

[0067] Figure 4 It is an or node characteristic diagram provided by an embodiment of the present invention;

[0068] Figure 5 It is a characteristic diagram of an and node provided in an embodiment of the present invention;

[0069] Figure 6 is a schematic diagram of an and node provided in an embodiment of the present invention;

[0070] Figure 7 is a schematic diagram of an or node provided in an embodiment of the present invention;

[0071] Figure 8 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0072] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present invention. They are only examples of devices and methods consistent with some aspects of the embodiments of the present invention as detailed in the attached claims.

[0073] It is understood that the terms "first", "second", etc. used in the present invention may be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0074] The terms "at least one", "multiple", "each", "any", etc. used in the present invention, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0075] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. The terms used herein are only for the purpose of describing the embodiments of the present invention and are not intended to limit the present invention.

[0076] The key defense node set selection method and system based on the attribute attack graph provided by the embodiment of the present invention relate to the field of computer technology. The key defense node set selection method based on the attribute attack graph provided by the embodiment of the present invention can be applied to a terminal, can also be applied to a server, and can also be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and a car terminal, etc., but is not limited to this; the server side can be configured as an independent physical server, or it can be configured as a server cluster or a distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements the key defense node set selection method based on the attribute attack graph, etc., but is not limited to the above forms.

[0077] The present invention can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0078] like Figure 1 FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present invention. Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected to a network wirelessly or wired to complete data transmission and exchange.

[0079] Server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0080] In addition, the server 101 can also be a node server in the blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0081] The terminal 102 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc. The terminal 102 may also be a vehicle-mounted terminal of various device types described above, but is not limited thereto. The terminal 102 and the server 101 may be directly or indirectly connected via wired or wireless communication, which is not limited in this embodiment of the present invention.

[0082] Based on the example Figure 1 In the implementation environment shown, an embodiment of the present invention provides a method for selecting a key defense node set based on an attribute attack graph. The following is explained using an example of applying the method for selecting a key defense node set based on an attribute attack graph to a server 101. It can be understood that the method can also be applied to a terminal 102.

[0083] Reference Figure 2 , Figure 2 The flowchart of the method for selecting a key defense node set based on an attribute attack graph applied to a server provided in an embodiment of the present invention, the execution subject of the method can be any of the aforementioned computer devices (including a server or a terminal). Figure 2 , the method may include the following steps:

[0084] Divide the attribute attack graph into strongly connected components to obtain a strongly connected graph;

[0085] Generate an abstract graph according to the strongly connected graph obtained by dividing;

[0086] A set of key defense nodes is selected according to the abstract graph.

[0087] In some embodiments, dividing the attribute attack graph into strongly connected components to obtain a strongly connected graph includes the following steps:

[0088] Starting from the attacking node, all nodes that can be reached by the attacking node are divided into strongly connected components;

[0089] Maintain a stack to store visited nodes;

[0090] Bind two variables aid and lowid to each node; wherein the variable aid represents the sequential index of the node visited during the depth-first search process; the variable lowid represents the node with the minimum aid value reached by the node through the dfs path; the variable lowid is used to determine whether there is a cycle and identify the strongly connected component by updating the value of lowid;

[0091] Perform a depth-first search on each unvisited node, mark the current node as visited, assign aid and lowid, and push the node into the stack;

[0092] Traverse all child nodes of the current node: if the child node has not been visited, update the lowid of the current node; if the child node is already in the stack, update the lowid of the current node to maintain the minimum reachable index;

[0093] Determine the strongly connected component: If the aid of the current node is equal to lowid, the current node is the root node of a strongly connected component; pop nodes from the stack until the current node is popped, and mark these nodes as an SCC;

[0094] When recursively returning, the lowid value of the current node is passed to update the lowid of the upper node until all nodes in the attribute attack graph are visited.

[0095] In some embodiments, generating an abstract graph according to the strongly connected graph obtained by dividing comprises the following steps:

[0096] Generate an abstract graph structure based on the partitioning results of strongly connected components;

[0097] Quantifying the cost of defending abstract graphs.

[0098] In some embodiments, the generating of the abstract graph structure based on the strongly connected component partitioning result comprises the following steps:

[0099] Analyze the characteristics of the attribute attack graph, exclude nodes that do not participate in the strong connected component division, reduce the number of strong connected component divisions, and divide the nodes into three basic types: source nodes, and nodes, and or nodes;

[0100] Among them, for the source node: in the attribute attack graph, the source node is divided into an attacker node and a condition node; the attacker node participates in the division of the strongly connected component as the starting node of the attack graph, and the condition node serves as the precondition of the and node, so that when accessing the and node, the corresponding precondition node is accessed, and the condition node is not accessed separately;

[0101] For and nodes and or nodes: and nodes represent rule nodes, which are elliptical nodes in the attack graph; or nodes are conditional nodes pointed to by and nodes, which are diamond nodes in the attack graph and serve as precondition nodes for other and nodes;

[0102] Mark all the and nodes, or nodes and source attack nodes in the attack graph with the strongly connected components, and use the numbers to generate an abstract graph structure.

[0103] In some embodiments, the step of marking all and nodes, or nodes, and source attack nodes of the attack graph with numbers of strongly connected components to which they belong, and using the numbers to generate an abstract graph structure comprises the following steps:

[0104] Create a node set nodeSet of the abstract graph, each node corresponds to an SCC;

[0105] Initialize the attacker and target sets, and add the nodes belonging to the attacker and target in the original graph to the corresponding sets in the line drawing graph;

[0106] Traverse the nodes in the attack graph and process each node and its predecessor edge; the processing of the predecessor edge is used to calculate the cost of cutting the edge of the abstract graph;

[0107] For each and node, calculate the predecessor edges of different SCCs connected to it, and take the edge with the smallest cost as the abstract edge; the cost of the abstract edge is its predecessor node with the smallest cost;

[0108] For each or node, traverse its predecessor edges, add each predecessor edge to the abstract edge, and calculate the cumulative cost of the predecessor nodes as the cost of cutting the abstract edge.

[0109] In some embodiments, the quantifying the defense cost of the abstract graph comprises the following steps:

[0110] First, a defense cost quantification method for nodes in the attribute attack graph is designed, then a quantification method for abstract edge cutting cost of the abstract graph is designed, and finally the defense cost quantification of the abstract graph is completed; among which, the defense method of the abstract graph is to cut the abstract edges between adjacent abstract points, and the defense cost of the abstract graph is quantified as the cutting cost of the abstract edges, and the quantification of the cutting cost depends on the defense cost of the nodes in the original attack graph.

[0111] In some embodiments, for a source node in the original attack graph, the defense cost of the source node is defined as the cost of cutting the edge from the current node to the subsequent node, and the cutting cost is quantified as the result of comprehensive consideration of multiple factors of the node, including the defense strategy execution cost factor, the attacker's attack benefit factor, and the attacker's attack cost factor; the source node is divided into a vulnerability node, a host configuration node, a network configuration node, and a main node;

[0112] For the and node and or node in the original attack graph, the or node is the post-node pointed to by the and node, and the quantification of the or node defense cost depends on the defense cost of the and node;

[0113] For the defense cost quantification of the and node, if all the preconditions of the and node are met, the and node is used to reach the subsequent or node, and a leading edge of the and node is cut to intercept the attacker from reaching the subsequent node. The defense cost of the and node is quantified as the defense cost of the preceding node with the smallest defense cost. The cut edge is the leading edge corresponding to the and node connecting the preceding node, which means that defense is arranged for the preceding node of the leading edge, thereby intercepting the attacker's path from the and node to the subsequent node. Among them, there are two types of leading edges of the and node, one is the leading edge connecting the source condition node, and the other is the leading edge connecting the or node.

[0114] For the defense cost quantification of the or node, if any of the preconditions is met, then according to the or node reaching the subsequent and node, all the preceding edges of the or node are cut to intercept the attacker from reaching the subsequent node. The defense cost of the or node is quantified as the sum of the defense costs of all preceding nodes, and the cut edges are all preceding edges;

[0115] According to the quantified results of the defense costs of the source node, the and node and the or node, a cutting cost calculation method for abstract edges is constructed; wherein the abstract edges are divided into two types: one is an abstract edge with the starting attack node as the source point, and the other is an abstract edge with other abstract points as the source point;

[0116] Among them, the cutting cost calculation algorithm steps of the abstract edge in the abstract graph are:

[0117] Traverse the original node;

[0118] If the node is an and node, traverse its predecessor edge. If the predecessor edge connects two different abstract points, obtain the corresponding abstract edge, add the defense cost of the and node to the cutting cost of the abstract edge, and record the cutting edge set from the and node cutting edge to the abstract edge;

[0119] If the node is an or node, traverse its predecessor edge. If the predecessor edge connects two different abstract points, obtain the corresponding abstract edge, take the and node defense cost connected by the predecessor edge to initialize the abstract edge, and record the cut edge of the and node to the cut edge set of the abstract edge.

[0120] In some embodiments, selecting a set of key defense nodes according to the abstract graph comprises the following steps:

[0121] Randomly select an unvisited target abstract node V and initialize its minimum defense cost CostV to 0;

[0122] If point V does not have a preceding edge, update and return its minimum defense cost as the maximum value;

[0123] Traverse the preceding abstract edge E. If the source abstract point U of edge E has not been visited, recursively return the minimum defense cost CostU of point U and the corresponding minimum cut edge set; if the source abstract point U has been visited, directly take its CostU;

[0124] By comparing CostU with the cutting cost CostE of edge E, the minimum defense cost CostV and the minimum cutting edge set CutV of the current node V are updated;

[0125] Among them, the calculation formula of the minimum defense cost CostV is: CostV=CostV+Min(CostU,CostE)

[0126] The key defense node set of the target node is calculated, and the key defense node set of all traversed abstract nodes is calculated.

[0127] The implementation process of the present invention in a specific application scenario is described in detail below in conjunction with the accompanying drawings of the specification:

[0128] First of all, it should be noted that the attribute attack graph can be represented by a triple AG = (C, V, E). C represents a set of conditions. For any c∈C, the c node may have multiple parent nodes. If the relationship between the parent nodes is "or", it means that any prerequisite in the parent node is met, and the child node c is established. V is the set of all vulnerabilities. For any v∈V, the v node may also have multiple parent nodes. When the relationship between the parent nodes is "and", it means that all prerequisites in the parent node must be met to make the child node v established. E is the set of all edges. The attribute attack graph is as follows Figure 3 As shown, the rectangle represents the conditional vertex and the ellipse represents the vulnerability vertex (i.e., the atomic attack node).

[0129] MLC is mostly used to find some nodes, and by removing these nodes, the connectivity from the source point to the target point is eliminated. There are many limitations in terms of applicable conditions, calculations, and algorithm accuracy, and the traditional MLC algorithm is difficult to apply. Therefore, the present invention optimizes the MLC algorithm from three aspects: (1) By using the strongly connected components (SCCs) of the attack graph to create a simplified attribute graph, the number of nodes and edges that need to be considered is reduced, thereby reducing the complexity of the problem. (2) Perform an iterative reverse search on the simplified tree, starting from the target node and gradually backtracking to identify the set of nodes that can reach the target and their outgoing edges and labels, which helps to find the cut set with the lowest defense cost. (3) By using the strongly connected component partitioning technology, the meta-attack graph is abstracted into a directed acyclic abstract graph with strongly connected components as basic nodes.

[0130] The technical problems to be solved by the present invention are:

[0131] (1) Based on the attribute attack graph, the backbone of the attribute attack graph can be found by dividing it into strongly connected components, thereby generating an abstract graph to compress the size of the attack graph.

[0132] (2) The abstract graph generation algorithm based on strongly connected components mainly studies two problems: one is to generate the abstract graph structure based on the strongly connected component partitioning result, and the other is to quantify the defense cost of the abstract graph.

[0133] (3) Calculate the defense cost of all nodes in the abstract graph and find the key defense node set through the minimum cut edge set.

[0134] Specifically, the present invention applies MLC to the attribute attack graph, adopts the minimum cut set search method, and implements the key defense node set selection method for the attribute attack graph with linear time complexity. Specifically, it includes three main processes: (1) dividing the attribute attack graph into strongly connected components; (2) generating an abstract graph based on the strongly connected graph; (3) selecting the key defense node set based on the abstract graph.

[0135] The following is a detailed description of the process of dividing the attribute attack graph into strongly connected components:

[0136] By dividing the attribute attack graph into strongly connected components, we can find the backbone of the attribute attack graph, thereby generating an abstract graph to compress the scale of the attack graph.

[0137] The general steps of the algorithm for partitioning the attribute attack graph into strongly connected components are:

[0138] 1. Starting from the attacking node, divide all nodes that can be reached by the attacking node into strongly connected components.

[0139] 2. Maintain a stack to store visited nodes.

[0140] 3. Bind two variables aid and lowid to each node, which represent the sequential index of the node visited during the depth-first search process and the node with the minimum aid value reached by the node through the DFS path. In the algorithm, by updating the value of lowid, it is possible to determine whether there is a cycle and identify strongly connected components.

[0141] 4. Perform a depth-first search on each unvisited node, mark the current node as visited, assign aid and lowid, and push the node into the stack.

[0142] 5. Traverse all child nodes of the current node: If the child node has not been visited, update the lowid of the current node. If the child node is already in the stack, update the lowid of the current node to maintain the minimum reachable index.

[0143] 6. Determine the strongly connected component: If the aid of the current node is equal to lowid, then the current node is the root node of a strongly connected component. Pop nodes from the stack until the current node is popped, and mark these nodes as an SCC.

[0144] 7. When recursively returning, the lowid value of the current node is passed to update the lowid of the upper node.

[0145] 8. Repeat the above steps for each node in the graph until all nodes have been visited.

[0146] The following is a detailed description of the abstract graph generation technology based on strongly connected components:

[0147] The abstract graph generation algorithm based on strongly connected components in the present invention needs to solve two problems: one is to generate the abstract graph structure based on the strongly connected component division result, and the other is to quantify the defense cost of the abstract graph.

[0148] (1) Generate abstract graph structure

[0149] Firstly, the characteristics of the attribute attack graph are analyzed, the nodes that do not participate in the strong connected component division are excluded, the number of strong connected component divisions is reduced to improve the compression efficiency of the attack graph, and the nodes are divided into three basic types: source nodes, and nodes and or nodes.

[0150] 1. Source node division

[0151] In the attribute attack graph, the source nodes are divided into attacker nodes and conditional nodes. The attacker node, as the starting node of the attack graph, participates in the division of strongly connected components; the source conditional node, as the precondition of the and node (rule node), usually visits its preconditional node when visiting the and node, and does not visit the source conditional node alone, and does not constitute the backbone of the abstract graph. Therefore, the source conditional node does not participate in the division of strongly connected components.

[0152] 2. and node and or node division

[0153] and node and or node. The and node represents a rule node, which is an elliptical node in the attack graph. Only when all preconditions are met can the node be used to reach the subsequent or node; the or node is the conditional node pointed to by the and node, which is a diamond node in the attack graph and can be used as a precondition node for other and nodes. These two types of nodes are the parts that constitute the ring in the attribute attack graph and are the backbone of the attack graph. Compressing or deleting these two types of nodes may lead to incomplete attack paths, so these two types of nodes need to participate in the strong connected component division.

[0154] The or node can have multiple in-degree edges and out-degree edges, such as Figure 4 shown.

[0155] An and node can have multiple in-degree edges, but can only have one out-degree edge to indicate the post-state reached after the rule is applied, such as Figure 5 shown.

[0156] Since the and node has only one out-degree edge, it can be deduced that when a strongly connected component contains multiple nodes, the out-degree edge of the and node in the strongly connected component must point to the or node in the strongly connected component, and cannot be used as a connection edge connecting two different strongly connected components. Only when the and node is divided into a strongly connected component node, its out-degree edge can be used as a connection edge connecting two different strongly connected components.

[0157] The process of generating the abstract graph structure designed by marking the strongly connected components of all and nodes, or nodes, and source attack nodes in the attack graph with the numbers is as follows:

[0158] 1. Create a node set nodeSet of the abstract graph, where each node corresponds to an SCC.

[0159] 2. Initialize the attacker and target sets, and add the nodes belonging to the attacker and target in the original graph to the corresponding sets of the line drawing graph.

[0160] 3. Traverse the nodes in the attack graph and process each node and its predecessor edge. The purpose of processing the predecessor edge is to calculate the cost of cutting the edge of the abstract graph.

[0161] 4. For each AND node, calculate the predecessor edges of different SCCs connected to it, and take the edge with the smallest cost as the abstract edge. The cost of the abstract edge is the predecessor node with the smallest cost.

[0162] 5. For each OR node, traverse its predecessor edges, add each predecessor edge to the abstract edge, and calculate the cumulative cost of the predecessor nodes as the cost of cutting the abstract edge.

[0163] (2) Quantifying the cost of abstract graph defense

[0164] The defense method of the abstract graph is to cut the abstract edges between adjacent abstract points. The defense cost is quantified as the cutting cost of the abstract edge. The quantification of this cutting cost depends on the defense cost of the node in the original attack graph. Therefore, we first design a defense cost quantification method for the nodes in the attribute attack graph, then design an abstract edge cutting cost quantification method for the abstract graph, and finally complete the defense cost quantification of the abstract graph.

[0165] 1) Quantification of the defense cost of the original attack graph source condition nodes:

[0166] The defense cost (C) of the original attack graph node is defined as the cost of cutting the edge from the current node to the subsequent node. It is necessary to arrange defense with the lowest possible defense strategy execution cost, and also to consider reducing the damage caused by the attacker on the attack path during the interception process. The cutting cost is quantified as the result of comprehensive consideration of factors such as the defense strategy execution cost of the node, the attacker's attack benefit, and the attacker's attack cost.

[0167] The source condition nodes are divided into vulnerability nodes, host configuration nodes, network configuration nodes, and main nodes. The present invention uses CVSS vulnerability scoring to quantify the defense cost of vulnerability nodes, and quantifies the defense cost of the remaining nodes into three levels: OL1, OL2, and OL3, where the OL1 defense cost value is set to 0.1-1, the OL2 defense cost is set to 1-5, and the OL3 defense cost is set to 5-10.

[0168] Host configuration node, which describes the configuration parameter information in the host. For example, the information of the service program in the host can be output, indicating that the program is running with a certain permission on the host. The defense strategy for this node mainly includes strictly controlling the program running permission, identifying the legitimacy of the running program, and closing the process in an emergency. According to the importance and credibility of the node running program, the cost is evaluated as OL2~OL3.

[0169] Network configuration node, which abstracts the configuration of router or firewall as host access control list. For example, it can be described as a rule that allows traffic to flow from the source device to the destination device. The defense strategy for this node mainly includes using software to block IP and ports, and disconnecting the system from the network in an emergency. The defense cost needs to be comprehensively evaluated based on the credibility of the traffic source and the loss of blocked traffic. The cost is evaluated as OL2~OL3. For example, the traffic communicated through port 443 is more credible, and the cost is evaluated as OL3.

[0170] The main node binds the main symbol to its user account on the host. The defense strategy for this node mainly includes setting user access rights, strictly limiting the permissions and activities of suspicious accounts, verifying the identity of suspicious accounts, and deleting suspicious accounts. The defense cost of this node is evaluated as OL1~OL2.

[0171] Vulnerability node, describes the vulnerability information existing in the network host. The defense strategies for this node mainly include installing software upgrade patches, installing system upgrade patches, etc. The defense costs of updating patches are mainly OL2 and OL3. The defense cost can be quantified more specifically using CVSS scoring. The calculation indicators of CVSS scoring are based on the attacker's perspective, and the scores are quantified from aspects such as the benefits and costs of attackers exploiting vulnerabilities. The present invention selects three indicators for quantification: attack vector (AV), attack complexity (AC), and attack authentication (AU).

[0172] Attack vector: describes the way attackers exploit vulnerabilities, which can be divided into three ways: attack through the Internet (N), attack through the local network (A), and attack through physical contact (L). The defense costs of the three ways decrease step by step. When launching attacks through the Internet, the attack surface is wide, the attacker's disguise is secret, and the amount of traffic monitoring is large, so the defense cost is OL3; when attacking through the local network, the network scale is small, the information is filtered through a layer, and the characteristics of suspicious information are easier to find, so the defense cost is OL2; attacks through physical contact require comprehensive considerations, and the defense effect of network technology is limited, so the defense cost is OL1.

[0173] Attack complexity: describes the technical difficulty required by the attacker when attacking, divided into three levels: low (L), medium (M), and high (H), and the defense costs of the three methods increase gradually. The defense strategy for simple attacks on the defensive end is relatively mature, and the defense cost is OL1; the attack launch conditions for medium technical difficulty are strict, the number of attacks is small, but the concealment is high, and the defense cost is OL2; the attack launch conditions for high technical difficulty are strict, the number is extremely small, but the destructiveness and concealment are extremely high, and the defense cost is OL3.

[0174] Attack Authentication: describes the number of authentications required for an attacker to attack, which is divided into multiple authentications (M), one authentication (S), and no authentication required (N). The defense costs of the three cases increase gradually, namely OL1, OL2, and OL3.

[0175] By analyzing the defense cost of the above CVSS indicators, we can obtain the defense cost calculation method for vulnerable nodes:

[0176] k1+k2+k3=1

[0177] C=k1*AV+k2*AC+k3*AU

[0178] 2) Quantification of defense cost of the original attack graph and / or node:

[0179] The or node is the post-node pointed to by the and node. Only when the attacker meets all the pre-condition nodes of the and node can the post-node or node be reached. Therefore, the quantification of the defense cost of the or node depends on the defense cost of the and node. First, the defense cost of the and node and its corresponding cut edge are calculated.

[0180] The defense cost of the and node is quantified. If all the preconditions of the and node are met, the and node can be used to reach the subsequent or node. Therefore, it is only necessary to cut a leading edge of the and node to intercept the attacker from reaching the subsequent node. The defense cost of the and node is quantified as the defense cost of the preceding node with the smallest defense cost. The cutting edge is the preceding edge corresponding to the and node connecting the preceding node, which means that the path of the attacker from the and node to the subsequent node can be intercepted by arranging defense on the preceding node of the preceding edge.

[0181] There are two types of leading edges of and nodes: one is the leading edge connecting the source condition node, and the other is the leading edge connecting the or node, such as Figure 6 shown.

[0182] The and node connects the leading edge of the source condition node, for example Figure 6 The cutting cost of the directed edges labeled and1 and and2 is the defense cost of the source node of the preceding edge.

[0183] The and node connects the preceding edge of the or node, for example Figure 6 The defense cost of the directed edge labeled and3 is the defense cost of the preceding or node. Since the defense cost calculation of the or node needs to rely on the quantification of the defense cost of the preceding and node, this causes the algorithm to recursively calculate the defense cost of the node forward, which may lead to infinite recursion or difficulty in obtaining appropriate calculation results in a cycle attack graph. Therefore, the cutting cost of the preceding edge is improved to the minimum cutting cost of the preceding edge connecting the and node to the source condition node. If the preceding nodes of the and node are all or nodes, its defense cost is quantified to max, indicating that this node cannot be defended and needs to rely on the defense of the preceding node of its preceding node.

[0184] The defense cost of the or node is quantified. If any of the preconditions are met, the or node can be used to reach the subsequent and node. Therefore, it is necessary to cut all the preceding edges of the or node to intercept the attacker from reaching the subsequent node. The defense cost of the or node is quantified as the sum of the defense costs of all preceding nodes, and the cut edges are all preceding edges. There is only one kind of preceding edge of the or node, that is, the preceding edge connecting the and node, so the defense cost of the or node is quantified as the defense cost of all preceding and nodes. The schematic diagram of the or node is as follows Figure 7 shown.

[0185] 3) Abstract edge cutting cost calculation:

[0186] Based on the defense cost calculation results of the original attack graph nodes, a cutting cost calculation method for abstract edges can be designed. There are two types of abstract edges: one is the abstract edge with the starting attack node as the source point, and the other is the abstract edge with other abstract points as the source point.

[0187] The steps of the algorithm for calculating the cutting cost of abstract edges in an abstract graph are:

[0188] 1. Traverse the original node.

[0189] 2. If the node is an and node, traverse its predecessor edge. If the predecessor edge connects two different abstract points, obtain the corresponding abstract edge, sum the defense cost of the and node to the cutting cost of the abstract edge, and record the cutting edge from the and node to the abstract edge in the cutting edge set.

[0190] 3. If the node is an or node, traverse its predecessor edge. If the predecessor edge connects two different abstract points, obtain the corresponding abstract edge, take the and node defense cost connected by the predecessor edge to initialize the abstract edge, and record the cut edge of the and node to the cut edge set of the abstract edge.

[0191] Since the algorithm needs to traverse all original nodes and original edges, the time complexity of the algorithm is O(V+E).

[0192] The implementation process of the key defense node set selection algorithm is described in detail below:

[0193] The critical defense node set (Cut) of an abstract node is defined as the source point set of the minimum cut edge set of the abstract node, and its defense cost symbol is defined as Cost. Since the critical defense node set can be found through the minimum cut edge set, the present invention defines the minimum cut edge set as the critical defense set.

[0194] The general idea of ​​calculating the cut set of a directed graph is to backtrack from the target node through breadth-first traversal, mark the level of the backtracked node, and obtain the inter-layer cut set with the minimum cut cost by comparing the cut costs between layers. However, this method does not consider the linkage relationship between different levels. Therefore, the key defense node set selection algorithm designed by the present invention will be based on depth-first traversal. Through post-order traversal, the minimum cut cost returned by the previous abstract point is compared with the cut cost of the connected abstract edge. The cut set with the smaller cut cost is added to the minimum cut set of the current abstract node, thereby calculating the minimum cut edge set that comprehensively considers the linkage relationship of each layer.

[0195] The general steps of the algorithm are as follows:

[0196] 1. Randomly select an unvisited target abstract node V and initialize its minimum defense cost CostV to 0;

[0197] 2. If point V does not have a preceding edge, update and return its minimum defense cost to the maximum value.

[0198] 3. Traverse the preceding abstract edge E. If the source abstract point U of edge E has not been visited, recursively return the minimum defense cost CostU and the corresponding minimum cut edge set of point U; if point U has been visited, directly take its CostU. By comparing CostU with the cut cost CostE of edge E, update the minimum defense cost CostV and the minimum cut edge set CutV of the current node V. CostV=CostV+Min(CostU,CostE)

[0199] Through the above algorithm, the key defense node set of the target node can be obtained. In addition, the key defense node set of all abstract nodes traversed in the algorithm is also calculated.

[0200] In summary, compared with the prior art, the present invention has the following characteristics:

[0201] 1. Through the strongly connected components (SCCs) partitioning technology, the complex attack graph is decomposed into smaller subgraphs, reducing the complexity of the graph.

[0202] 2. Create abstract node edges based on strongly connected components and quantify the defense cost.

[0203] 3. Perform a reverse search on the simplified abstract graph to identify the set of key defense nodes with the lowest defense cost.

[0204] Existing MLC usually uses simple graph traversal or heuristic algorithms to analyze attack graphs, which fails to effectively simplify the complexity of the graph. Most methods use forward search or full graph traversal, which cannot efficiently identify key nodes. Compared with the existing technology, the present invention not only reduces the complexity of the graph and improves the analysis efficiency, but is also more accurate and efficient in quantifying defense costs and identifying key nodes.

[0205] Compared with the prior art, the present invention has the following advantages:

[0206] 1. Reduce the complexity of the attack graph. The present invention adopts the strongly connected components (SCCs) partitioning technology to decompose the complex attribute attack graph into smaller strongly connected component subgraphs, thereby reducing the number of nodes and edges that need to be considered.

[0207] 2. Improve defense efficiency by performing iterative reverse search on a simplified abstract graph, starting from the target node and gradually backtracking to identify the set of nodes that can reach the target and their outgoing edges and labels. This method helps find the cut set with the lowest defense cost.

[0208] 3. The strongly connected component partitioning technology is used to abstract the original attribute attack graph into a directed acyclic graph with strongly connected components as basic nodes, so that this method is not only used for specific types of attack graphs, but can also be used in a wider range of application scenarios.

[0209] Another aspect of the embodiment of the present invention further provides a key defense node set selection system based on an attribute attack graph, comprising:

[0210] The first module is used to divide the attribute attack graph into strongly connected components to obtain a strongly connected graph;

[0211] The second module is used to generate an abstract graph according to the strongly connected graph obtained by division;

[0212] The third module is used to select a set of key defense nodes according to the abstract graph.

[0213] It can be understood that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0214] The embodiment of the present invention also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned key defense node set selection method based on the attribute attack graph when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0215] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0216] See also Figure 8 , Figure 8 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0217] The processor 801 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention;

[0218] The memory 802 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 802 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 802, and the processor 801 calls and executes the key defense node set selection method based on the attribute attack graph of the embodiment of the present invention;

[0219] Input / output interface 803, used to implement information input and output;

[0220] The communication interface 804 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0221] A bus 805 that transmits information between the various components of the device (e.g., the processor 801, the memory 802, the input / output interface 803, and the communication interface 804);

[0222] The processor 801 , the memory 802 , the input / output interface 803 and the communication interface 804 are connected to each other in communication within the device via a bus 805 .

[0223] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-mentioned method for selecting a key defense node set based on an attribute attack graph.

[0224] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiments, the functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0225] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0226] It should be noted that in various specific embodiments of the present invention, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present invention needs to obtain the user's sensitive personal information, it will obtain the user's separate permission or consent through a pop-up window or jump to a confirmation page, and after clearly obtaining the user's separate permission or consent, it will obtain the necessary user-related data for the normal operation of the embodiment of the present invention.

[0227] The embodiments described in the embodiments of the present invention are intended to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. Those skilled in the art can appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0228] Those skilled in the art will appreciate that the technical solutions shown in the figures do not limit the embodiments of the present invention and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0229] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0230] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0231] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0232] It should be understood that in the present invention, "at least one (item)" refers to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can represent: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0233] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0234] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0235] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0236] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including multiple instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store programs.

[0237] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the embodiments of the present invention is not limited thereby. Any modification, equivalent substitution and improvement made by those skilled in the art without departing from the scope and essence of the embodiments of the present invention shall be within the scope of the rights of the embodiments of the present invention.

Claims

1. A method for selecting a key defense node set based on an attribute attack graph, characterized in that: The following steps are involved: Divide the attribute attack graph into strongly connected components to obtain a strongly connected graph; Generate an abstract graph according to the strongly connected graph obtained by dividing; A set of key defense nodes is selected according to the abstract graph.

2. According to the method for selecting a key defense node set based on an attribute attack graph according to claim 1, it is characterized in that: The method of dividing the attribute attack graph into strongly connected components to obtain a strongly connected graph includes the following steps: Starting from the attacking node, all nodes that can be reached by the attacking node are divided into strongly connected components; Maintain a stack to store visited nodes; Bind two variables aid and lowid to each node; wherein the variable aid represents the sequential index of the node visited during the depth-first search process; the variable lowid represents the node with the minimum aid value reached by the node through the dfs path; the variable lowid is used to determine whether there is a cycle and identify the strongly connected component by updating the value of lowid; Perform a depth-first search on each unvisited node, mark the current node as visited, assign aid and lowid, and push the node into the stack; Traverse all child nodes of the current node: if the child node has not been visited, update the lowid of the current node; if the child node is already in the stack, update the lowid of the current node to maintain the minimum reachable index; Determine the strongly connected component: If the aid of the current node is equal to lowid, the current node is the root node of a strongly connected component; pop nodes from the stack until the current node is popped, and mark these nodes as an SCC; When recursively returning, the lowid value of the current node is passed to update the lowid of the upper node until all nodes in the attribute attack graph are visited.

3. According to the method for selecting a key defense node set based on an attribute attack graph according to claim 1, it is characterized in that: Generating an abstract graph according to the strongly connected graph obtained by dividing comprises the following steps: Generate an abstract graph structure based on the partitioning results of strongly connected components; Quantifying the cost of defending abstract graphs.

4. According to claim 3, a method for selecting a key defense node set based on an attribute attack graph is characterized in that: The method of generating an abstract graph structure based on the strongly connected component partitioning result comprises the following steps: Analyze the characteristics of the attribute attack graph, exclude nodes that do not participate in the strong connected component division, reduce the number of strong connected component divisions, and divide the nodes into three basic types: source nodes, and nodes, and or nodes; Among them, for the source node: in the attribute attack graph, the source node is divided into an attacker node and a condition node; the attacker node participates in the division of the strongly connected component as the starting node of the attack graph, and the condition node serves as the precondition of the and node, so that when accessing the and node, the corresponding precondition node is accessed, and the condition node is not accessed separately; For and nodes and or nodes: and nodes represent rule nodes, which are elliptical nodes in the attack graph; or nodes are conditional nodes pointed to by and nodes, which are diamond nodes in the attack graph and serve as precondition nodes for other and nodes; Mark all the and nodes, or nodes and source attack nodes in the attack graph with the strongly connected components they belong to, and use the numbers to generate an abstract graph structure.

5. According to the method for selecting a key defense node set based on an attribute attack graph according to claim 4, it is characterized in that: The method of marking all and nodes, or nodes and source attack nodes of the attack graph with strongly connected component numbers, and using the numbers to generate an abstract graph structure, includes the following steps: Create a node set nodeSet of the abstract graph, each node corresponds to an SCC; Initialize the attacker and target sets, and add the nodes belonging to the attacker and target in the original graph to the corresponding sets in the line drawing graph; Traverse the nodes in the attack graph and process each node and its predecessor edge; the processing of the predecessor edge is used to calculate the cost of cutting the edge of the abstract graph; For each and node, calculate the predecessor edges of different SCCs connected to it, and take the edge with the smallest cost as the abstract edge; the cost of the abstract edge is its predecessor node with the smallest cost; For each or node, traverse its predecessor edges, add each predecessor edge to the abstract edge, and calculate the cumulative cost of the predecessor nodes as the cost of cutting the abstract edge.

6. According to the method for selecting a key defense node set based on an attribute attack graph according to claim 3, it is characterized in that: The quantified abstract graph defense cost includes the following steps: First, a defense cost quantification method for nodes in the attribute attack graph is designed, then a quantification method for abstract edge cutting cost of the abstract graph is designed, and finally the defense cost quantification of the abstract graph is completed; among which, the defense method of the abstract graph is to cut the abstract edges between adjacent abstract points, and the defense cost of the abstract graph is quantified as the cutting cost of the abstract edges, and the quantification of the cutting cost depends on the defense cost of the nodes in the original attack graph.

7. A method for selecting a key defense node set based on an attribute attack graph according to claim 6, characterized in that: For the source node in the original attack graph, the defense cost of the source node is defined as the cost of cutting the edge from the current node to the subsequent node. The cutting cost is quantified as the result of comprehensive consideration of multiple factors of the node, including the defense strategy execution cost factor, the attacker's attack benefit factor, and the attacker's attack cost factor. The source nodes are divided into vulnerability nodes, host configuration nodes, network configuration nodes, and subject nodes; For the and node and or node in the original attack graph, the or node is the post-node pointed to by the and node, and the quantification of the or node defense cost depends on the defense cost of the and node; For the defense cost quantification of the and node, if all the preconditions of the and node are met, the and node is used to reach the subsequent or node, and a leading edge of the and node is cut to intercept the attacker from reaching the subsequent node. The defense cost of the and node is quantified as the defense cost of the preceding node with the smallest defense cost. The cut edge is the leading edge corresponding to the and node connecting the preceding node, which means that defense is arranged for the preceding node of the leading edge, thereby intercepting the attacker's path from the and node to the subsequent node. Among them, there are two types of leading edges of the and node, one is the leading edge connecting the source condition node, and the other is the leading edge connecting the or node. For the defense cost quantification of the or node, if any of the preconditions is met, then according to the or node reaching the subsequent and node, all the preceding edges of the or node are cut to intercept the attacker from reaching the subsequent node. The defense cost of the or node is quantified as the sum of the defense costs of all preceding nodes, and the cut edges are all preceding edges; According to the quantified results of the defense costs of the source node, the and node and the or node, a cutting cost calculation method for abstract edges is constructed; wherein the abstract edges are divided into two types: one is an abstract edge with the starting attack node as the source point, and the other is an abstract edge with other abstract points as the source point; Among them, the cutting cost calculation algorithm steps of the abstract edge in the abstract graph are: Traverse the original node; If the node is an and node, traverse its predecessor edge. If the predecessor edge connects two different abstract points, obtain the corresponding abstract edge, add the defense cost of the and node to the cutting cost of the abstract edge, and record the cutting edge set from the and node cutting edge to the abstract edge; If the node is an or node, traverse its predecessor edge. If the predecessor edge connects two different abstract points, obtain the corresponding abstract edge, take the and node defense cost connected by the predecessor edge to initialize the abstract edge, and record the cut edge of the and node to the cut edge set of the abstract edge.

8. The method for selecting a key defense node set based on an attribute attack graph according to claim 1, characterized in that: The step of selecting a key defense node set according to the abstract graph comprises the following steps: Randomly select an unvisited target abstract node V and initialize its minimum defense cost CostV to 0; If point V does not have a preceding edge, update and return its minimum defense cost as the maximum value; Traverse the preceding abstract edge E. If the source abstract point U of edge E has not been visited, recursively return the minimum defense cost CostU of point U and the corresponding minimum cut edge set; if the source abstract point U has been visited, directly take its CostU; By comparing CostU with the cutting cost CostE of edge E, the minimum defense cost CostV and the minimum cutting edge set CutV of the current node V are updated; Among them, the calculation formula of the minimum defense cost CostV is: CostV=CostV+Min(CostU,CostE) The key defense node set of the target node is calculated, and the key defense node set of all traversed abstract nodes is calculated.

9. A key defense node set selection system based on attribute attack graph, characterized in that: include: The first module is used to divide the attribute attack graph into strongly connected components to obtain a strongly connected graph; The second module is used to generate an abstract graph according to the strongly connected graph obtained by division; The third module is used to select a set of key defense nodes according to the abstract graph.

10. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 8.

Images