System vulnerability attack handling method, program product, storage medium and equipment

Abstract

The invention provides a system vulnerability attack processing method, a program product, a storage medium and equipment, and the method comprises the steps: constructing an initial attack graph based on asset topology data and component vulnerability data of a target system, considering the influence brought by a security policy of asset configuration, determining the attack success probability corresponding to each edge in the initial attack graph, and determining the attack success probability of each edge in the initial attack graph; the method comprises the following steps of: obtaining an initial attack graph, optimizing the initial attack graph according to the initial attack graph to obtain an optimized attack graph, and then solving a minimum cut set in the optimized attack graph to generate a set of minimum edges capable of cutting off all paths from an initial node to a final node, namely a minimum disposal set. Therefore, by analyzing the minimum disposal set on the constructed attack graph, the vulnerability disposal efficiency is effectively improved, the security operation cost is reduced, and meanwhile, the attack graph is optimized according to the security policy of asset configuration, so that the information expression of the attack graph is more accurate, and the vulnerability disposal accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a system vulnerability attack handling method, program product, storage medium and device. Background Art

[0002] At present, due to the development of cloud computing and the Internet of Things, many critical infrastructure systems such as energy and transportation are vulnerable to cyber attacks. In particular, attackers use known or unknown 0day vulnerabilities to attack, which can cause great losses when the system lacks effective protection mechanisms or the vulnerabilities are not handled in time. However, the operation and maintenance costs of critical information systems or critical infrastructure are high, and they cannot be shut down for a long time. Even for small infrastructure systems, it costs a lot to deal with all related vulnerabilities in a short time. Therefore, the market is in urgent need of a solution that can improve the efficiency of system vulnerability attack handling and reduce security operation costs. Summary of the invention

[0003] The purpose of this application is to provide a system vulnerability attack handling method, program product, storage medium and device, aiming to solve the problems of low system vulnerability attack handling efficiency and high security operation cost existing in related technologies.

[0004] In a first aspect, the present application provides a method for handling system vulnerability attacks, comprising: constructing an initial attack graph based on asset topology data and component vulnerability data of a target system; the asset topology data includes data representing connectivity between assets in the target system; determining the attack success probability corresponding to each edge in the initial attack graph according to the security policy of the asset configuration, optimizing the initial attack graph according to the attack success probability, and obtaining an optimized attack graph; generating a minimum disposal set by solving the minimum cut set in the optimized attack graph, and determining edges to be repaired or cut according to the minimum disposal set.

[0005] In the above implementation process, based on the asset topology data and component vulnerability data of the target system, the initial attack graph is constructed, and the impact of the security policy of the asset configuration is considered to determine the attack success probability corresponding to each edge in the initial attack graph, so as to optimize the initial attack graph and obtain the optimized attack graph. After that, by solving the minimum cut set in the optimized attack graph, the minimum edge set that can cut off all paths from the initial node to the final node is generated, that is, the minimum disposal set, so that the security operation personnel can repair or cut off the edges corresponding to the minimum disposal set to effectively protect the system security. In this way, by analyzing the minimum disposal set on the constructed attack graph, the efficiency of vulnerability disposal is effectively improved and the cost of security operation is reduced. At the same time, the attack graph is optimized according to the security policy of the asset configuration, so that the information expression of the attack graph is more accurate, and the accuracy of vulnerability disposal is improved.

[0006] Furthermore, in some embodiments, the labels of the edges of the initial attack graph represent vulnerability attack methods that an attacker may exploit.

[0007] In the above implementation process, labels are set in the initial attack graph to indicate the vulnerability attack methods that attackers may exploit, so that security operations personnel can understand the attacker's attack mode and thus develop a more effective defense strategy.

[0008] Further, in some embodiments, the security policy includes a network configuration policy; the security policy configured according to the assets determines the attack success probability corresponding to each edge in the initial attack graph, including: for any edge in the initial attack graph, if the port on which the connectivity between the two nodes connected by the edge depends conflicts with the vulnerability attack method corresponding to the label of the edge, the attack success probability corresponding to the edge is set to zero, otherwise it is set to one.

[0009] In the above implementation process, the security policy of asset configuration may include a network configuration policy. When the network configuration policy does not conflict with the vulnerability attack method, the probability of successful attack is one, otherwise it is zero. In this way, the real possibility of the attack graph is optimized and the accuracy of the information expressed by the attack graph is improved.

[0010] Further, in some embodiments, the security policy includes encryption technology and / or intrusion detection system settings; the security policy configured according to the assets determines the attack success probability corresponding to each edge in the initial attack graph, including: for any edge in the initial attack graph, based on the encryption effect corresponding to the encryption algorithm used when transmitting data between two nodes connected by the edge, and / or, based on the probability that the intrusion detection system detects access between two nodes connected by the edge as suspicious access, determining the attack success probability corresponding to the edge.

[0011] In the above implementation process, when the security policy of asset configuration includes encryption technology, the probability of attack success is determined according to the encryption effect corresponding to the encryption algorithm. When the security policy of asset configuration includes intrusion detection system settings, the probability of attack success is set according to the probability that the intrusion detection system detects the access corresponding to the edge as suspicious access. In this way, the information expression of the optimized attack graph is more accurate.

[0012] Furthermore, in some embodiments, optimizing the initial attack graph according to the attack success probability includes: in the initial attack graph, deleting the edges whose attack success probability is zero.

[0013] In the above implementation process, after determining the attack success probability corresponding to each edge in the initial attack graph, if the attack success probability corresponding to a certain edge is 0, the edge can be removed to achieve pruning and optimization of the attack graph, thereby improving the efficiency of subsequent mining of the minimum set of edges that need to be processed.

[0014] Furthermore, in some embodiments, the weights of the edges of the optimized attack graph are determined based on the attack success probability corresponding to the edges and the importance of the information obtained on the vertices pointed to by the edges and their targets; the minimum disposal set is obtained by solving the minimum cut set of the optimized attack graph using the Stoer-Wagner algorithm.

[0015] In the above implementation process, a specific method for solving the minimum cut set in the optimized attack graph is provided.

[0016] Further, in some embodiments, the minimum treatment set includes a set of labels of edges corresponding to the minimum cut set.

[0017] In the above implementation process, the generated minimum disposal set can be the minimum set of vulnerability types that need to be disposed of. In this way, security operations personnel can quickly obtain corresponding disposal methods based on the minimum disposal set, thereby effectively improving vulnerability disposal efficiency.

[0018] In the second aspect, the present application provides a system vulnerability attack handling device, including: a construction module, which is used to construct an initial attack graph based on the asset topology data and component vulnerability data of the target system; the asset topology data includes data representing the connectivity between assets in the target system; an optimization module, which is used to determine the attack success probability corresponding to each edge in the initial attack graph according to the security policy of the asset configuration, and optimize the initial attack graph according to the attack success probability to obtain an optimized attack graph; a generation module, which is used to generate a minimum handling set by solving the minimum cut set in the optimized attack graph, and determine the edges to be repaired or cut according to the minimum handling set.

[0019] In a third aspect, the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the first aspects when executing the computer program.

[0020] In a fourth aspect, the present application provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the first aspects.

[0021] In a fifth aspect, the present application provides a computer program product, which, when running on a computer, enables the computer to execute the method as described in any one of the first aspects.

[0022] Other features and advantages disclosed in the present application will be described in the following description, or some features and advantages can be inferred or determined without doubt from the description, or can be learned by implementing the above-mentioned technology disclosed in the present application.

[0023] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A flowchart of a method for handling a system vulnerability attack provided in an embodiment of the present application;

[0026] Figure 2 A schematic diagram of an attack graph constructed based on asset access relationships and component vulnerability data provided in an embodiment of the present application;

[0027] Figure 3 A schematic diagram of the asset topology after disposal according to the minimum disposal set provided in an embodiment of the present application;

[0028] Figure 4 A block diagram of a system vulnerability attack handling device provided in an embodiment of the present application;

[0029] Figure 5 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0031] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0032] As described in the background technology, the related art has the problems of low efficiency in handling system vulnerability attacks and high security operation costs. Based on this, the embodiment of the present application provides a system vulnerability attack handling solution to solve the above problems.

[0033] Next, the implementation process of the embodiment of the present application is introduced:

[0034] like Figure 1 As shown, Figure 1 : is a flow chart of a method for handling a system vulnerability attack provided by an embodiment of the present application, the method comprising:

[0035] Step 101: construct an initial attack graph based on the asset topology data and component vulnerability data of the target system; the asset topology data includes data representing connectivity between assets in the target system;

[0036] An attack graph is a graphical representation method used to describe attack scenarios that an attacker can implement. In this embodiment, for the target system, its asset topology data and component vulnerability data are obtained to construct an initial attack graph, laying a good data foundation for subsequent analysis and identification of the minimum disposal set. The target system here can be any network system that needs to protect system data security, such as an energy system, a transportation system, etc., and an asset in the target system can be a host, a server, or a security device, etc.

[0037] The asset topology data mentioned in this step includes data representing the connectivity between assets in the target system, for example, which can be obtained through c i.j To represent the connectivity between the i-th asset and the j-th asset, if the i-th asset has the permission to access the j-th asset, or the two assets are connected by network, then c i.j =1, otherwise c i.j=0. Based on this asset topology data, the asset access relationship in the target system can be obtained, and the asset access relationship can be used to preliminarily construct an asset topology map. The component vulnerability data mentioned in this step can be data associated with defects or weaknesses in the hardware, software or protocol in the target system, which may be exploited by attackers to access, tamper with or destroy system resources in an unauthorized manner. Based on the attack of vulnerability exploitation, under certain conditions, the vulnerability can be used to attack the asset, thereby obtaining the target's permission level, and further gradually penetrate according to the asset topology or network accessibility, so that different attack paths or sequences can be formed. Therefore, in this embodiment, based on the asset topology data and component vulnerability data, the attack path formed when the vulnerability on any asset is exploited by the attacker can be obtained, so as to construct the initial attack graph. At this time, the initial attack graph is a directed graph consisting of two parts: vertices and directed edges. The vertices are the asset identifiers corresponding to the assets, and the edges represent the order of the attacker's attack behaviors.

[0038] In some embodiments, the label of the initial attack graph mentioned in this step indicates the vulnerability attack method that the attacker may exploit. That is, the generated initial attack graph can be a directed graph with labels, and the labels of the edges indicate the attacks that the attacker may perform to obtain the permissions of the corresponding assets. The vulnerability attack methods here may include cross-site scripting attacks, remote code execution, forged credentials, unauthorized access, and the like. For example, V1 represents a cross-site scripting attack. When an attacker exploits Web script and HTML code injection vulnerabilities on asset r1 to obtain root access rights to asset r2, in the initial attack graph, the edge between the vertex corresponding to asset r1 and the vertex corresponding to asset r2 points to the vertex corresponding to asset r2 and is labeled V1, which means that the attacker may exploit a cross-site scripting attack on asset r1 to obtain permissions for asset r2. In this way, through this initial attack graph, security operations personnel can understand the attacker's attack mode and thus develop a more effective defense strategy.

[0039] In step 102, according to the security policy of the asset configuration, the attack success probability corresponding to each edge in the initial attack graph is determined, and the initial attack graph is optimized according to the attack success probability to obtain an optimized attack graph;

[0040] This step means: since internal or external access between assets is restricted by security policies, on the basis of the established initial attack graph, the impact of the security policy of asset configuration is considered, and the attack success probability corresponding to each edge is determined, so as to optimize the initial attack graph, make the information expression of the attack graph more accurate, thereby improving the efficiency and accuracy of handling system vulnerability attacks.

[0041] In some embodiments, the security policy mentioned in this step may include a network configuration policy; accordingly, the security policy mentioned in this step, based on the asset configuration, determines the attack success probability corresponding to each edge in the initial attack graph, which may include: for any edge in the initial attack graph, if the port on which the connectivity between the two nodes connected by the edge depends conflicts with the vulnerability attack method corresponding to the label of the edge, the attack success probability corresponding to the edge is set to zero, otherwise it is set to one.

[0042] That is to say, the security policy of asset configuration can include network configuration policy, such as firewall configuration, port restriction, etc. For each edge in the initial attack graph, when the network configuration policy does not conflict with the corresponding vulnerability attack method, the attack success probability is determined to be 1, and when the network configuration policy conflicts with the corresponding vulnerability attack method, the attack success probability is determined to be 0. For example, the connection between asset r1 and asset r4 can only be achieved through a specific port, which conflicts with the corresponding vulnerability attack method V3, which will further affect the possible paths of the attack graph. Therefore, the attack success probability of the edge between the vertex corresponding to asset r1 and the vertex corresponding to asset r4 is set to 0, thus optimizing the real possibility of the attack graph and improving the accuracy of the information expressed by the attack graph.

[0043] In some embodiments, the security policy mentioned in this step may include encryption technology and / or intrusion detection system settings; accordingly, the security policy mentioned in this step based on the asset configuration to determine the attack success probability corresponding to each edge in the initial attack graph may include: for any edge in the initial attack graph, based on the encryption effect corresponding to the encryption algorithm used when transmitting data between the two nodes connected by the edge, and / or, based on the probability that the intrusion detection system detects the access between the two nodes connected by the edge as suspicious access, determining the attack success probability corresponding to the edge.

[0044] That is to say, the security policy of asset configuration can include encryption technology, that is, the encryption algorithm used between assets to limit data transmission, such as RSA encryption algorithm, AES encryption algorithm, etc. Then, for each edge in the initial attack graph, the probability of attack success is the encryption effect of the corresponding encryption algorithm. For example, two assets transmit data through a symmetric encryption algorithm, such as AES encryption algorithm. Since the possibility of decryption is large, the possibility of successful attack by the attacker is high. Therefore, the probability of attack success of the edge between the two assets can be set to a large probability value. In addition, the security policy of asset configuration can include intrusion detection system settings. The probability of network defense equipment detecting suspicious access will affect the attack graph to a certain extent. Therefore, for each edge in the initial attack graph, the probability of attack success is set based on the probability that the intrusion detection system detects the corresponding access as suspicious access. In this way, the information expression of the optimized attack graph is more accurate.

[0045] It should be noted that the security policy for asset configuration may include network configuration policy, encryption technology and intrusion detection system settings at the same time. In addition, in some embodiments, the security policy may also include other contents, such as password management, permission settings, etc.

[0046] Further, in some embodiments, the optimization of the initial attack graph according to the attack success probability mentioned in this step may include: in the initial attack graph, deleting the edges with zero attack success probability. That is, after determining the attack success probability corresponding to each edge in the initial attack graph, if the attack success probability corresponding to a certain edge is 0, the edge may be removed to achieve pruning and optimization of the attack graph, thereby improving the efficiency of subsequently mining the minimum set of edges that need to be processed.

[0047] In step 103, a minimum treatment set is generated by solving a minimum cut set in the optimized attack graph, and edges to be repaired or cut are determined according to the minimum treatment set.

[0048] This step means: in order to reduce the cost of handling system vulnerability attacks, the optimized attack graph is analyzed to find the set of minimum edges that can cut off all paths from the initial node to the final node, that is, the minimum handling set, and it is converted into the problem of solving the minimum cut set in the optimized attack graph. In this way, security operators can repair or cut off the corresponding edges according to the minimum handling set, thereby achieving the purpose of protecting system security.

[0049] In some embodiments, the weights of the edges of the optimized attack graph mentioned in this step can be determined based on the attack success probability corresponding to the edge and the importance of the information obtained on the vertex to which the edge points and its target; accordingly, the minimum disposal set mentioned in this step can be obtained by using the Stoer-Wagner algorithm to solve the minimum cut set of the optimized attack graph. That is to say, the Stoer-Wagner algorithm can be used to solve the minimum cut set in the optimized attack graph. This algorithm gradually reduces the scale of the graph in a recursive manner and finally obtains the global minimum cut. During its iteration, the weight of the edge is the key factor in updating the cut set. Therefore, in order to improve the accuracy of the minimum disposal set finally generated, the weight of the corresponding edge is set based on the attack success probability corresponding to the edge and the importance of the information obtained on the vertex to which the edge points and its target. For example, the weight μ of the edge between the vertex corresponding to asset r1 and the vertex corresponding to asset r2 is 1,2 , we can get the attack success probability P of this edge 1,2 , combined with the vertex to which the edge points, that is, the importance of the information obtained on asset r2 and its target The weight of the edge can be obtained Among them, the target of asset r2 is the downstream node of the node corresponding to asset r2. If the information obtained on asset r2 and its downstream nodes is the root permission on important assets, then the importance A higher value can be set. If the information obtained is general user permissions on general assets, the importance is higher. A lower value can be set. In this way, after determining the weights of each edge, the minimum cut set can be solved by the Stoer-Wagner algorithm to generate the minimum treatment set.

[0050] Furthermore, in the case where the labels of the edges of the attack graph represent the vulnerability attack methods that the attacker may exploit, the minimum disposal set mentioned in this step may include the set of labels of the edges corresponding to the minimum cut set. In other words, the generated minimum disposal set may be the minimum set of vulnerability types that need to be disposed of. For example, there are N edges corresponding to the solved minimum cut set, and the vulnerability attack methods corresponding to these N edges are V6, V5 and V4. Then the generated minimum disposal set may include {V6, V5, V4}. Based on the minimum disposal set, the security operator can determine the minimum set of vulnerability types that need to be disposed of, and then quickly obtain the corresponding disposal method, effectively improving the efficiency of vulnerability disposal.

[0051] In the embodiment of the present application, an initial attack graph is constructed based on the asset topology data and component vulnerability data of the target system, and the impact of the security policy of the asset configuration is considered to determine the attack success probability corresponding to each edge in the initial attack graph, thereby optimizing the initial attack graph to obtain an optimized attack graph. Afterwards, by solving the minimum cut set in the optimized attack graph, a set of minimum edges that can cut off all paths from the initial node to the final node, i.e., the minimum disposal set, is generated, so that security operators can repair or cut off the edges corresponding to the minimum disposal set to effectively protect system security. In this way, by analyzing the minimum disposal set on the constructed attack graph, the efficiency of vulnerability disposal is effectively improved and the cost of security operations is reduced. At the same time, the attack graph is optimized according to the security policy of the asset configuration, so that the information expression of the attack graph is more accurate, and the accuracy of vulnerability disposal is improved.

[0052] In order to explain the solution of this application in more detail, a specific embodiment is introduced below:

[0053] This embodiment provides a system vulnerability attack handling solution with minimal cost, which can be applied to the process of rapid and effective handling of vulnerabilities in security analysis products or scenarios for exposure analysis and vulnerability management or security scenarios. The specific process of this solution includes:

[0054] S201, construct an attack graph based on asset access relationships and component vulnerability data;

[0055] Specifically, this step is the basic data processing process of the analysis. First, the asset topology data and component vulnerability data are obtained. Assume that the asset set is R = {r i , i∈[1,N]}, that is, there are N assets in the system, and the accessibility or network connectivity between assets is defined by C={c i.j ,i∈[1,N],j∈[1,N],i≠j}, where when the asset r i and assets j When connected, c i.j =1, when asset r i and assets j When disconnected, c i.j =0; the topological set C represents the connectivity between assets, and the asset topological map can be preliminarily constructed based on this set;

[0056] Based on the component vulnerability data, the vulnerabilities on each asset can be determined. The categories of these vulnerabilities include but are not limited to: Cross-site scripting attacks: exploiting Web script and HTML code injection vulnerabilities to allow attackers to obtain root access rights to the target; Remote code execution: exploiting vulnerabilities on high-risk ports of some protocols to achieve attacks; Forged credentials: exploiting weak passwords or weak password credentials to allow attackers to obtain user access rights to the target; Unauthorized access: exploiting vulnerabilities on the Web server on 80 / TCP to allow attackers to obtain corresponding permissions;

[0057] Attacks based on vulnerability exploitation can exploit vulnerabilities to attack assets under certain conditions, thereby obtaining the target's permission level and further penetrating step by step based on asset topology or network accessibility. This can form different attack paths or sequences to build a Figure 2 The attack graph shown,the generated attack graph is a labeled directed graph, whose vertices are the corresponding asset identifiers,,and the edge labels represent the vulnerability attack methods that,the attacker may exploit, which are replaced by V1 to V6 respectively.,Each path from the initial node to the final node represents the attack path that,the attacker may reuse;

[0058] S202, optimizing the attack graph;

[0059] Specifically, internal or external access between assets is restricted by network security policies. Based on the established attack graph, the impact of the security policies of asset configuration needs to be considered. These policies also provide decisions for the subsequent division of the minimum segmentation. The security policies here can include one or more of network configuration policies, encryption technology, and intrusion detection system settings.

[0060] For network configuration policies, such as firewall configuration and port restrictions, when the network configuration policy of a certain edge in the attack graph does not conflict with the vulnerability attack method, the attack success probability of the edge is determined to be 1, otherwise the attack success probability of the edge is determined to be 0;

[0061] Regarding encryption technology, when two assets transmit data through an encryption protocol, the probability of successful attack on the edge between the corresponding vertices of the two assets is the encryption effect of the corresponding encryption algorithm;

[0062] For the intrusion detection system setting, the attack success probability of a certain edge in the attack graph can be set as the estimated detection accuracy of the intrusion detection system;

[0063] By combining the above strategies, we can get the asset r i and assets j The attack success probability P of the edge between i,j , if it is 0, then the asset r i and assets jThe edges between them are removed to achieve pruning and optimization of the attack graph;

[0064] S203, analyzing and identifying the minimum disposal set;

[0065] Specifically, the optimized attack graph is analyzed, and the goal of the analysis is to find the minimum number of attacks and the minimum edge set that can cut off all paths from the initial node to the final node, which is called the minimum disposal set. In this embodiment, the problem of identifying the minimum disposal set is transformed into the problem of finding the minimum cut set in the graph;

[0066] As for the method of solving the minimum cut set, the Stoer-Wagner algorithm is used, and its general process is:

[0067] Step 1: Initialize the cut set to an empty set;

[0068] Step 2: Select any node as the initial node;

[0069] Step 3: For the remaining nodes, calculate the sum of the weights of the edges connecting them to the current node, and select the node with the largest sum of weights as the next node; the weights are set as follows:

[0070]

[0071] Among them, μ i,j Represents asset r i and assets j The weight of the edge between them; Represents asset r j and the importance of the information obtained on its target;

[0072] Step 4: Merge the current node and the next node to get a new node;

[0073] Step 5: Repeat steps 3 and 4 until all nodes are merged;

[0074] Step 6: According to the final cut set, split the graph into two disjoint subgraphs;

[0075] Step 7: If the weight of the cut set is less than the current minimum cut set, update the current minimum cut set;

[0076] Step 8: Repeat steps 2 to 7 until all nodes have been operated once as initial nodes;

[0077] The final set obtained is the minimum output disposal set;

[0078] S204, repair or cut off the edge corresponding to the minimum disposal set;

[0079] Specifically, the attacker's attack activities between assets can be mitigated or eliminated by repairing their vulnerabilities, which corresponds to deleting the corresponding edges from the attack graph. For all the corresponding edges in the minimum disposal set, they are deleted from the attack graph, making it unreachable from the initial node to the final node, thereby achieving the purpose of protecting system security;

[0080] The asset topology after disposal according to the minimum disposal set is as follows Figure 3 As shown by Figure 3 It can be seen that the minimum disposal set includes {V6, V5, V4}. After deleting its corresponding edge, from the initial node r1 to the final node r 14 is unreachable.

[0081] This embodiment scheme effectively improves the efficiency of vulnerability handling by analyzing the minimum handling set on the constructed attack graph, so that the system security can be restored as soon as possible; based on the mining and learning method of the attack graph model, automatic analysis and identification are performed to determine the minimum defense measures required to protect the system from attacks in a feasible way, and these minimum defense measures can be quickly applied to the vulnerability attack handling process; and the algorithm has strong applicability and simple data input, and can be applied to a variety of security scenarios; especially for a variety of complex vulnerability attack scenarios, the corresponding handling methods can be quickly obtained based on the required data, and it is widely applicable.

[0082] Corresponding to the embodiments of the aforementioned method, the present application also provides embodiments of a system vulnerability attack handling device and a terminal using the same:

[0083] like Figure 4 As shown, Figure 4 : is a block diagram of a system vulnerability attack handling device provided by an embodiment of the present application, the device comprising:

[0084] A construction module 41 is used to construct an initial attack graph based on the asset topology data and component vulnerability data of the target system; the asset topology data includes data representing connectivity between assets in the target system;

[0085] An optimization module 42 is used to determine the attack success probability corresponding to each edge in the initial attack graph according to the security policy of the asset configuration, and optimize the initial attack graph according to the attack success probability to obtain an optimized attack graph;

[0086] The generating module 43 is used to generate a minimum treatment set by solving the minimum cut set in the optimized attack graph, and determine the edge to be repaired or cut according to the minimum treatment set.

[0087] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.

[0088] This application also provides an electronic device, see Figure 5 , Figure 5 A block diagram of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 510, a communication interface 520, a memory 530, and at least one communication bus 540. The communication bus 540 is used to realize direct connection and communication between these components. The communication interface 520 of the electronic device in the embodiment of the present application is used to communicate signaling or data with other node devices. The processor 510 may be an integrated circuit chip with signal processing capabilities.

[0089] The processor 510 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. The processor 510 may be a microprocessor, or the processor 510 may be any conventional processor, etc.

[0090] The memory 530 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electric erasable programmable read-only memory (EEPROM), etc. The memory 530 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 510, the electronic device can execute the above-mentioned Figure 1 The method embodiment involves various steps.

[0091] Optionally, the electronic device may further include a storage controller and an input / output unit.

[0092] The memory 530, storage controller, processor 510, peripheral interface, input and output unit components are directly or indirectly electrically connected to each other to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses 540. The processor 510 is used to execute executable modules stored in the memory 530, such as software function modules or computer programs included in the electronic device.

[0093] The input and output unit is used to provide users with the task creation and to create a start optional time period or preset execution time for the task to realize the interaction between the user and the server. The input and output unit can be, but is not limited to, a mouse and a keyboard.

[0094] Understandably, Figure 5 The structure shown is for illustration only, and the electronic device may also include Figure 5 More or fewer components as shown, or with Figure 5 Different configurations are shown. Figure 5 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0095] An embodiment of the present application further provides a storage medium having instructions stored thereon. When the instructions are run on a computer, the computer program is executed by a processor to implement the method described in the method embodiment. To avoid repetition, the method will not be described here.

[0096] The present application also provides a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0097] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0098] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0099] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0100] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0101] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0102] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for handling system vulnerability attacks, characterized in that: include: Constructing an initial attack graph based on the asset topology data and component vulnerability data of the target system; the asset topology data includes data representing connectivity between assets in the target system; Determine the attack success probability corresponding to each edge in the initial attack graph according to the security policy of the asset configuration, and optimize the initial attack graph according to the attack success probability to obtain an optimized attack graph; The minimum cut set is solved in the optimized attack graph to generate a minimum treatment set, and the edge to be repaired or cut is determined according to the minimum treatment set.

2. The method according to claim 1, characterized in that The labels of the edges of the initial attack graph represent the vulnerability attack methods that the attacker may exploit.

3. The method according to claim 2, characterized in that The security policy includes a network configuration policy; the determining the attack success probability corresponding to each edge in the initial attack graph according to the security policy configured by the asset includes: For any edge in the initial attack graph, if the port on which the connectivity between the two nodes connected by the edge depends conflicts with the vulnerability attack method corresponding to the label of the edge, the attack success probability corresponding to the edge is set to zero, otherwise it is set to one.

4. The method according to claim 1, characterized in that: The security policy includes encryption technology and / or intrusion detection system settings; the security policy configured according to the asset determines the attack success probability corresponding to each edge in the initial attack graph, including: For any edge in the initial attack graph, the attack success probability corresponding to the edge is determined based on the encryption effect corresponding to the encryption algorithm used when transmitting data between the two nodes connected by the edge, and / or based on the probability that the intrusion detection system detects the access between the two nodes connected by the edge as suspicious access.

5. The method according to claim 3 or 4, characterized in that: The optimizing the initial attack graph according to the attack success probability includes: In the initial attack graph, the edges with zero attack success probability are deleted.

6. The method according to claim 1, characterized in that The weight of the edge of the optimized attack graph is determined based on the attack success probability corresponding to the edge and the importance of the information obtained on the vertex pointed by the edge and its target; The minimum disposal set is obtained by using the Stoer-Wagner algorithm to solve the minimum cut set of the optimized attack graph.

7. The method according to claim 2, characterized in that The minimum treatment set includes a set of labels of edges corresponding to the minimum cut set.

8. A computer program product, characterized in that When the computer program product is executed on a computer, the computer is enabled to perform the method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images