System vulnerability attack handling method, program product, storage medium and device

Abstract

The application provides a system vulnerability attack disposal method, program product, storage medium and equipment. In the method, based on asset topology data and component vulnerability data of a target system, an initial attack graph is constructed, the influence of a security policy of asset configuration is considered, the attack success probability corresponding to each edge in the initial attack graph is determined, the initial attack graph is optimized, an optimized attack graph is obtained, then, a minimum cut set is solved in the optimized attack graph, and a minimum edge set capable of cutting all paths from an initial node to a final node, that is, a minimum disposal set, is generated. In this way, by analyzing the minimum disposal set on the constructed attack graph, the vulnerability disposal efficiency is effectively improved, the security operation cost is reduced, meanwhile, the attack graph is optimized according to the security policy of asset configuration, the information expression of the attack graph is more accurate, and the accuracy of vulnerability disposal is improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method for handling system vulnerability attacks, a program product, a storage medium, and a device. Background Technology

[0002] Currently, due to the development of cloud computing and the Internet of Things (IoT), many critical infrastructure systems, such as energy and transportation, are vulnerable to cyberattacks. In particular, attacks exploiting known or unknown zero-day vulnerabilities can cause significant losses when systems lack effective protection mechanisms or are not addressed promptly. However, the operation and maintenance costs of critical information systems and infrastructure are high, and prolonged downtime for handling is unacceptable. Even for small infrastructure systems, addressing all relevant vulnerabilities in a short time is extremely costly. Therefore, there is an urgent need in the market for a solution that can improve the efficiency of system vulnerability attack handling and reduce security operation costs. Summary of the Invention

[0003] The purpose of this application is to provide a method, program product, storage medium and device for handling system vulnerability attacks, aiming to solve the problems of low efficiency in handling system vulnerability attacks and high security operation costs in related technologies.

[0004] In a first aspect, this application provides a method for handling system vulnerability attacks, comprising: constructing an initial attack graph based on asset topology data and component vulnerability data of a target system; the asset topology data including data representing the connectivity between assets in the target system; determining the attack success probability corresponding to each edge in the initial attack graph according to the security policy configured for the assets; optimizing the initial attack graph according to the attack success probability to obtain an optimized attack graph; generating a minimum handling set by solving for the minimum cut set in the optimized attack graph; and determining the edges to be repaired or cut according to the minimum handling set.

[0005] In the above implementation process, an initial attack graph is constructed based on the target system's asset topology data and component vulnerability data. Considering the impact of security policies in asset configuration, the attack success probability corresponding to each edge in the initial attack graph is determined. This initial attack graph is then optimized to obtain an optimized attack graph. Subsequently, by solving for the minimum cut set in the optimized attack graph, a set of minimum edges capable of cutting all paths from the initial node to the final node is generated, i.e., the minimum remediation set. This allows security operations personnel to repair or cut the edges corresponding to the minimum remediation set, effectively protecting system security. Thus, by analyzing the minimum remediation set on the constructed attack graph, vulnerability handling efficiency is effectively improved, and security operation costs are reduced. Furthermore, optimizing the attack graph according to the security policies in asset configuration makes the information representation of the attack graph more accurate, improving the accuracy of vulnerability handling.

[0006] Furthermore, in some embodiments, the labels of the edges of the initial attack graph indicate the vulnerability attack methods that an attacker may exploit.

[0007] In the above implementation process, labels are set in the initial attack graph to indicate the vulnerability attack methods that attackers may exploit, so that security operations personnel can understand the attacker's attack patterns and thus formulate more effective defense strategies.

[0008] Furthermore, in some embodiments, the security policy includes a network configuration policy; determining the attack success probability corresponding to each edge in the initial attack graph according to the security policy configured for the asset includes: for any edge in the initial attack graph, if the port on which the connectivity between the two nodes connected by the edge depends conflicts with the vulnerability attack method corresponding to the label of the edge, the attack success probability corresponding to the edge is set to zero; otherwise, it is set to one.

[0009] In the above implementation process, the security strategy for asset configuration can include network configuration strategy. When the network configuration strategy does not conflict with the vulnerability attack method, the probability of attack success is one; otherwise, it is zero. In this way, the real probability of the attack graph is optimized, and the accuracy of the information expressed by the attack graph is improved.

[0010] Furthermore, in some embodiments, the security strategy includes encryption technology and / or intrusion detection system settings; determining the attack success probability corresponding to each edge in the initial attack graph according to the security strategy configured for the asset includes: for any edge in the initial attack graph, determining the attack success probability corresponding to the edge based on the encryption effect of the encryption algorithm used when transmitting data between the two nodes connected by the edge, and / or, based on the probability that the intrusion detection system detects the access between the two nodes connected by the edge as suspicious access.

[0011] In the above implementation process, when the security policy of asset configuration includes encryption technology, the probability of successful attack is determined according to the encryption effect corresponding to the encryption algorithm. When the security policy of asset configuration includes intrusion detection system settings, the probability of successful attack is set according to the probability that the intrusion detection system detects the access corresponding to the edge as suspicious access. In this way, the information expression of the optimized attack graph is more accurate.

[0012] Furthermore, in some embodiments, optimizing the initial attack graph based on the attack success probability includes deleting edges in the initial attack graph where the attack success probability is zero.

[0013] In the above implementation process, after determining the attack success probability corresponding to each edge in the initial attack graph, if the attack success probability corresponding to a certain edge is 0, the edge can be removed to achieve pruning and optimization of the attack graph, thereby improving the efficiency of subsequently mining the minimum set of edges that need to be processed.

[0014] Furthermore, in some embodiments, the weights of the edges in the optimized attack graph are determined based on the attack success probability corresponding to the edge and the importance of the information obtained from the vertex and target pointed to by the edge; the minimum disposal set is obtained by solving the minimum cut set problem of the optimized attack graph using the Stoer-Wagner algorithm.

[0015] In the above implementation process, a specific method is provided for solving the minimum cut set in the optimized attack graph.

[0016] Furthermore, in some embodiments, the minimum disposal set includes a set of labels for the edges corresponding to the minimum cut set.

[0017] In the above implementation process, the generated minimum action set can be the minimum set of vulnerability types that need to be addressed. In this way, security operations personnel can quickly obtain the corresponding action methods based on the minimum action set, thereby effectively improving the efficiency of vulnerability handling.

[0018] Secondly, this application provides a system vulnerability attack handling device, comprising: a construction module, used to construct an initial attack graph based on asset topology data and component vulnerability data of a target system; the asset topology data includes data representing the connectivity between assets in the target system; an optimization module, used to determine the attack success probability corresponding to each edge in the initial attack graph according to the security policy configured for the assets, and optimize the initial attack graph according to the attack success probability to obtain an optimized attack graph; and a generation module, used to generate a minimum handling set by solving for the minimum cut set in the optimized attack graph, and determine the edges to be repaired or cut according to the minimum handling set.

[0019] Thirdly, this application provides an electronic device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the method described in any of the first aspects.

[0020] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described in any of the first aspects.

[0021] Fifthly, this application provides a computer program product that, when run on a computer, causes the computer to perform the method described in any of the first aspects.

[0022] Other features and advantages disclosed in this application will be set forth in the following description, or some features and advantages may be inferred from the description or determined without doubt, or may be learned by practicing the above-described technology disclosed in this application.

[0023] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A flowchart illustrating a system vulnerability attack handling method provided in this application embodiment;

[0026] Figure 2 A schematic diagram of an attack graph constructed based on asset access relationships and component vulnerability data, provided for an embodiment of this application;

[0027] Figure 3 A schematic diagram of the asset topology after disposal based on the minimum disposal set, provided for an embodiment of this application;

[0028] Figure 4 A block diagram of a system vulnerability attack handling device provided in an embodiment of this application;

[0029] Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0030] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0031] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0032] As described in the background section, related technologies suffer from low efficiency in handling system vulnerability attacks and high security operation costs. Therefore, this application provides a system vulnerability attack handling solution to address these problems.

[0033] The implementation process of the embodiments of this application will be described below:

[0034] like Figure 1 As shown, Figure 1 This is a flowchart of a system vulnerability attack handling method provided in an embodiment of this application, the method including:

[0035] Step 101: Construct an initial attack graph based on the asset topology data and component vulnerability data of the target system; the asset topology data includes data representing the connectivity between assets in the target system;

[0036] An attack graph is a graphical representation method used to describe attack scenarios that an attacker can carry out. In this embodiment, for the target system, its asset topology data and component vulnerability data are obtained to construct an initial attack graph, laying a solid data foundation for subsequent analysis and identification of the minimum acceptable response set. The target system can be any network system requiring data security protection, such as an energy system or a transportation system, and an asset within the target system can be a host, a server, or a security device, etc.

[0037] The asset topology data mentioned in this step includes data representing the connectivity between assets in the target system, for example, it can be accessed via c i.j Let c represent the connectivity between asset i and asset j. If asset i has permission to access asset j, or if the two assets are network-connected, then c is true. i.j =1, otherwise c i.j=0. Based on this asset topology data, the asset access relationships in the target system can be obtained, and an initial asset topology graph can be constructed using these asset access relationships. The component vulnerability data mentioned in this step can be data associated with defects or weaknesses in the hardware, software, or protocols of the target system. These defects may be exploited by attackers to access, tamper with, or damage system resources in an unauthorized manner. Vulnerability-based attacks can exploit vulnerabilities to attack assets under specific conditions, thereby obtaining the target's privilege level, and further penetrating step by step according to the asset topology or network reachability. This can form different attack paths or sequences. Therefore, in this embodiment, based on the asset topology data and component vulnerability data, the attack path formed when an attacker exploits a vulnerability on any asset can be obtained, thereby constructing an initial attack graph. At this time, the initial attack graph is a directed graph, consisting of vertices and directed edges. The vertices are the asset identifiers corresponding to the assets, and the edges represent the order of the attacker's attack actions.

[0038] In some embodiments, the labels on the initial attack graph mentioned in this step represent the vulnerability attack methods that an attacker might exploit. That is, the generated initial attack graph can be a labeled directed graph, where the edge labels indicate the attacks an attacker might perform to gain access to the corresponding assets. These vulnerability attack methods can include cross-site scripting (XSS) attacks, remote code execution, credential forgery, unauthorized access, and so on. For example, let V1 represent a cross-site scripting attack. When an attacker exploits Web script and HTML code injection vulnerabilities on asset r1 to gain root access to asset r2, then in the initial attack graph, the edge between the vertex corresponding to asset r1 and the vertex corresponding to asset r2 points to the vertex corresponding to asset r2 and is labeled V1, indicating that the attacker might use a cross-site scripting attack on asset r1 to gain access to asset r2. Thus, through this initial attack graph, security operations personnel can understand the attacker's attack patterns and develop more effective defense strategies.

[0039] In step 102, based on the security policy of the asset configuration, the attack success probability corresponding to each edge in the initial attack graph is determined, and the initial attack graph is optimized based on the attack success probability to obtain the optimized attack graph.

[0040] This step refers to: Since internal or external access between assets is restricted by security policies, based on the established initial attack graph, the impact of the security policies of asset configuration is considered, and the attack success probability corresponding to each edge is determined. This optimizes the initial attack graph, making the information expression of the attack graph more accurate, thereby improving the efficiency and accuracy of handling system vulnerability attacks.

[0041] In some embodiments, the security policy mentioned in this step may include a network configuration policy; accordingly, determining the attack success probability corresponding to each edge in the initial attack graph based on the security policy of the asset configuration mentioned in this step may include: for any edge in the initial attack graph, if the port on which the connectivity between the two nodes connected by the edge depends conflicts with the vulnerability attack method corresponding to the label of the edge, the attack success probability corresponding to the edge is set to zero, otherwise it is set to one.

[0042] In other words, asset configuration security policies can include network configuration policies, such as firewall configuration and port restrictions. For each edge in the initial attack graph, if the network configuration policy does not conflict with the corresponding vulnerability attack method, its attack success probability is set to 1; if the network configuration policy conflicts with the corresponding vulnerability attack method, its attack success probability is set to 0. For example, the connection between asset r1 and asset r4 can only be achieved through a specific port, which conflicts with its corresponding vulnerability attack method V3. This will further affect the possible paths in the attack graph. Therefore, the attack success probability of the edge between the vertex corresponding to asset r1 and the vertex corresponding to asset r4 is set to 0. This optimizes the true probability of the attack graph and improves the accuracy of the information expressed by the attack graph.

[0043] In some embodiments, the security strategy mentioned in this step may include encryption technology and / or intrusion detection system settings; accordingly, determining the attack success probability corresponding to each edge in the initial attack graph based on the security strategy configured for the asset mentioned in this step may include: for any edge in the initial attack graph, determining the attack success probability corresponding to the edge based on the encryption effect of the encryption algorithm used when transmitting data between the two nodes connected by the edge, and / or, based on the probability that the intrusion detection system detects the access between the two nodes connected by the edge as suspicious access.

[0044] In other words, the security strategy for asset configuration can include encryption technology, specifically encryption algorithms used to restrict data transmission between assets, such as RSA and AES encryption algorithms. For each edge in the initial attack graph, the probability of a successful attack is equivalent to the encryption effect of the corresponding encryption algorithm. For instance, if two assets transmit data using a symmetric encryption algorithm like AES, the probability of decryption is relatively high, leading to a higher probability of a successful attack. Therefore, the probability of a successful attack on the edge between these two assets can be set to a relatively high value. Furthermore, the security strategy for asset configuration can include intrusion detection system settings. The probability of network defense devices detecting suspicious access will influence the attack graph to some extent. Therefore, for each edge in the initial attack graph, the probability of a successful attack is set based on the probability that the intrusion detection system detects the corresponding access as suspicious. This makes the information representation of the optimized attack graph more accurate.

[0045] It should be noted that the security policy for asset configuration can include network configuration policy, encryption technology and intrusion detection system settings. In addition, in some embodiments, the security policy may also include other contents, such as password management, permission settings, etc.

[0046] Furthermore, in some embodiments, optimizing the initial attack graph based on the attack success probability mentioned in this step may include deleting edges in the initial attack graph where the attack success probability is zero. That is, after determining the attack success probability corresponding to each edge in the initial attack graph, if the attack success probability corresponding to a certain edge is 0, that edge can be removed, thus pruning and optimizing the attack graph and improving the efficiency of subsequently mining the minimum set of edges that need to be processed.

[0047] In step 103, a minimum cut set is generated by solving the minimum cut set in the optimized attack graph, and the edges to be repaired or cut are determined based on the minimum cut set.

[0048] This step refers to: in order to reduce the cost of dealing with system vulnerability attacks, analyzing the optimized attack graph to find the set of the smallest edges that can cut all paths from the initial node to the final node, i.e., the minimum disposal set. This is transformed into a problem of solving the minimum cut set in the optimized attack graph. In this way, security operators can repair or cut the corresponding edges based on the minimum disposal set, thereby achieving the goal of protecting system security.

[0049] In some embodiments, the edge weights of the optimized attack graph mentioned in this step can be determined based on the attack success probability corresponding to the edge and the importance of the information obtained from the vertex and target pointed to by the edge. Correspondingly, the minimum disposal set mentioned in this step can be obtained by solving the minimum cut set problem of the optimized attack graph using the Stoer-Wagner algorithm. That is, the Stoer-Wagner algorithm can be used to solve for the minimum cut set in the optimized attack graph. This algorithm gradually reduces the size of the graph recursively until it finds the global minimum cut. During its iteration, the edge weights are a key factor in updating the cut set. Therefore, to improve the accuracy of the final generated minimum disposal set, the weights of the corresponding edges are set based on the attack success probability corresponding to the edge and the importance of the information obtained from the vertex and target pointed to by the corresponding edge. For example, the weight μ of the edge between the vertex corresponding to asset r1 and the vertex corresponding to asset r2... 1,2 The probability P of a successful attack on that side can be obtained. 1,2 Combining the vertex that the edge points to, that is, the importance of the information obtained from asset r2 and its target. The weight of that edge can be obtained. In this context, the target of asset r2 is the downstream node of the node corresponding to asset r2. If the information obtained from asset r2 and its downstream nodes constitutes root privileges on an important asset, then the importance level is determined. A higher value can be set if the information it obtains pertains to general user permissions on general assets, thus increasing the importance level. A lower value can be set. In this way, after determining the weights of each edge, the minimum cut set can be solved using the Stoer-Wagner algorithm, thereby generating the minimum disposal set.

[0050] Furthermore, when the edge labels in the attack graph represent the vulnerability attack methods that an attacker might exploit, the minimum treatment set mentioned in this step can include the set of edge labels corresponding to the minimum cut set. In other words, the generated minimum treatment set can be the minimum set of vulnerability types that need to be addressed. For example, if the solved minimum cut set has N edges, and the vulnerability attack methods corresponding to these N edges are V6, V5, and V4, then the generated minimum treatment set can include {V6, V5, V4}. Based on this minimum treatment set, security operations personnel can determine the minimum set of vulnerability types that need to be addressed, thereby quickly obtaining the corresponding treatment methods and effectively improving vulnerability handling efficiency.

[0051] In this embodiment, an initial attack graph is constructed based on the asset topology data and component vulnerability data of the target system. Considering the impact of security policies in asset configuration, the attack success probability corresponding to each edge in the initial attack graph is determined. This initial attack graph is then optimized to obtain an optimized attack graph. Subsequently, by solving for the minimum cut set in the optimized attack graph, a set of minimum edges capable of cutting all paths from the initial node to the final node is generated, i.e., the minimum remediation set. This allows security operations personnel to repair or cut the edges corresponding to the minimum remediation set, effectively protecting system security. Thus, by analyzing the minimum remediation set on the constructed attack graph, vulnerability handling efficiency is effectively improved, and security operation costs are reduced. Furthermore, optimizing the attack graph according to the security policies in asset configuration makes the information representation of the attack graph more accurate, improving the accuracy of vulnerability handling.

[0052] To provide a more detailed explanation of the solution in this application, a specific embodiment is described below:

[0053] This embodiment provides a system vulnerability attack mitigation solution with minimal cost. This solution can be applied to the rapid and effective handling of vulnerabilities in security analysis products or scenarios, specifically for exposure surface analysis and vulnerability management or protection. The specific process of this solution includes:

[0054] S201. Construct an attack graph based on asset access relationships and component vulnerability data;

[0055] Specifically, this step is the basic data processing procedure for analysis. First, it obtains asset topology data and component vulnerability data. Assume the asset set is R = {r i ,i∈[1,N]}, meaning there are N assets in the system, and the accessibility or network connectivity between assets is determined by C={c i.j Let ,i∈[1,N],j∈[1,N],i≠j} represent the asset r, where i∈[1,N],j≠j. i and assets r j When connected, c i.j =1, when asset r i and assets r j When not connected, c i.j =0; The topology set C represents the connectivity between assets, and an asset topology graph can be initially constructed based on this set;

[0056] Based on component vulnerability data, vulnerabilities in various assets can be identified. These vulnerabilities include, but are not limited to: Cross-site scripting (XSS): Exploiting Web script and HTML code injection vulnerabilities to give attackers root access to the target; Remote code execution: Exploiting vulnerabilities on high-risk ports of certain protocols to carry out attacks; Credential forgery: Exploiting weak passwords or credentials to give attackers user access to the target; Unauthorized access: Exploiting vulnerabilities in web servers on port 80 / TCP to give attackers the corresponding privileges.

[0057] Vulnerability-based attacks can exploit vulnerabilities to attack assets under specific conditions, thereby gaining access to the target's privilege levels. Further, based on the asset's topology or network reachability, attacks can be progressively penetrated, forming different attack paths or sequences to construct a sophisticated attack network. Figure 2 The attack graph shown is a labeled directed graph, where vertices are corresponding asset identifiers, and edge labels represent potential vulnerability exploits by the attacker, denoted by V1 to V6 respectively. Each path from the initial node to the final node represents a potentially reusable attack path.

[0058] S202, Optimize the attack graph;

[0059] Specifically, internal or external access between assets is restricted by network security policies. Based on the established attack graph, the impact of security policies on asset configuration needs to be considered. These policies also provide decisions for the subsequent minimum segmentation. The security policies here may include one or more of network configuration policies, encryption technologies, and intrusion detection system settings.

[0060] For network configuration policies, such as firewall configuration and port restrictions, if the network configuration policy of a certain edge in the attack graph does not conflict with the vulnerability attack method, the success probability of the attack on that edge is set to 1; otherwise, the success probability of the attack on that edge is set to 0.

[0061] Regarding encryption technology, when two assets transmit data through an encryption protocol, the probability of a successful attack on the edge between the corresponding vertices of these two assets is equal to the encryption effect of the corresponding encryption algorithm.

[0062] For intrusion detection system settings, the probability of a successful attack on a certain edge in the attack graph can be set as the estimated detection accuracy of the intrusion detection system.

[0063] By combining the above strategies, we can obtain asset r. i and assets r j The probability P of successfully attacking the edge between them i,j If it is 0, then the asset r will be... i and assets r jRemove the edges between them to prune and optimize the attack graph;

[0064] S203, Analyze and identify the minimum set of actions;

[0065] Specifically, the optimized attack graph is analyzed. The goal of the analysis is to find the minimum number of attacks and the minimum set of edges that can cut all paths from the initial node to the final node. This set is called the minimum disposal set. In this embodiment, the problem of identifying the minimum disposal set is transformed into the problem of finding the minimum cut set in the graph.

[0066] For finding the minimum cut set, the Stoer-Wagner algorithm is used, and its general process is as follows:

[0067] Step 1: Initialize the cut set as an empty set;

[0068] Step 2: Select any node as the initial node;

[0069] Step 3: For the remaining nodes, calculate the sum of the weights of their edges connected to the current node, and select the node with the largest sum of weights as the next node; where the weights are set as follows:

[0070]

[0071] Where, μ i,j Represents asset r i and assets r j The weight of the edge between them; Represents asset r j The importance of the information obtained regarding its target;

[0072] Step 4: Merge the current node and the next node to obtain a new node;

[0073] Step 5: Repeat steps 3 and 4 until all nodes have been merged;

[0074] Step 6: Based on the final cut set, divide the graph into two disjoint subgraphs;

[0075] Step 7: If the weight of the cut set is less than the current minimum cut set, then update the current minimum cut set;

[0076] Step 8: Repeat steps 2 through 7 until all nodes have been operated on once as the initial node;

[0077] The final set obtained is the minimum set of disposals output;

[0078] S204. Repair or cut the edges corresponding to the minimum set of disposals;

[0079] Specifically, attackers' offensive activities between assets can be mitigated or eliminated by patching vulnerabilities. This corresponds to removing the corresponding edges from the attack graph. All edges corresponding to the minimum set of solutions are removed from the attack graph, making the path from the initial node to the final node unreachable, thereby protecting system security.

[0080] The asset topology after disposal based on the minimum disposal set is as follows: Figure 3 As shown, by Figure 3 It can be seen that the minimum set of disposals includes {V6, V5, V4}. After deleting the corresponding edges, the distance from the initial node r1 to the final node r... 14 It is unreachable.

[0081] This embodiment effectively improves vulnerability handling efficiency and enables rapid system security recovery by analyzing the minimum set of measures on the constructed attack graph. Based on the attack graph model's mining and learning method, it performs automated analysis and identification to determine the minimum defensive measures required to protect the system from attacks in a feasible manner. These minimum defensive measures can be quickly applied to the vulnerability attack handling process. Furthermore, the algorithm has strong applicability, simple data input, and can be applied to various security scenarios. Especially for various complex vulnerability attack scenarios, it can quickly obtain corresponding handling methods based on the required data, making it widely applicable.

[0082] Corresponding to the embodiments of the aforementioned methods, this application also provides embodiments of a system vulnerability attack handling device and a terminal for its application:

[0083] like Figure 4 As shown, Figure 4 This is a block diagram of a system vulnerability attack handling device provided in an embodiment of this application. The device includes:

[0084] Module 41 is used to construct an initial attack graph based on the asset topology data and component vulnerability data of the target system; the asset topology data includes data representing the connectivity between assets in the target system;

[0085] Optimization module 42 is used to determine the attack success probability corresponding to each edge in the initial attack graph according to the security policy of the asset configuration, and optimize the initial attack graph according to the attack success probability to obtain the optimized attack graph.

[0086] The generation module 43 is used to generate a minimum disposal set by solving the minimum cut set in the optimized attack graph, and to determine the edges to be repaired or cut according to the minimum disposal set.

[0087] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0088] This application also provides an electronic device, please refer to [link to application]. Figure 5 , Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of this application. The electronic device may include a processor 510, a communication interface 520, a memory 530, and at least one communication bus 540. The communication bus 540 is used to enable direct communication between these components. In this embodiment, the communication interface 520 of the electronic device is used for signaling or data communication with other node devices. The processor 510 may be an integrated circuit chip with signal processing capabilities.

[0089] The processor 510 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The processor 510 described above can be a microprocessor, or it can be any conventional processor.

[0090] The memory 530 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc. The memory 530 stores computer-readable instructions. When these computer-readable instructions are executed by the processor 510, the electronic device can perform the aforementioned operations. Figure 1 The various steps involved in the method implementation examples.

[0091] Alternatively, the electronic device may also include a storage controller and an input / output unit.

[0092] The memory 530, storage controller, processor 510, peripheral interface, and input / output unit are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses 540. The processor 510 is used to execute executable modules stored in the memory 530, such as software function modules or computer programs included in electronic devices.

[0093] The input / output unit is used to provide users with the ability to create tasks and to set optional start periods or preset execution times for those tasks, thereby enabling user-server interaction. The input / output unit may be, but is not limited to, a mouse and keyboard.

[0094] Understandable. Figure 5 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown. Figure 5 The components shown can be implemented using hardware, software, or a combination thereof.

[0095] This application also provides a storage medium storing instructions. When the instructions are run on a computer, the computer program is executed by a processor to implement the method described in the method embodiment. To avoid repetition, the method will not be described again here.

[0096] This application also provides a computer program product that, when run on a computer, causes the computer to perform the method described in the method embodiment.

[0097] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0098] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0099] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0100] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0101] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0102] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for handling system vulnerability attacks, characterized in that, include: An initial attack graph is constructed based on the asset topology data and component vulnerability data of the target system; the asset topology data includes data representing the connectivity between assets in the target system. Based on the security policy of the asset configuration, the attack success probability corresponding to each edge in the initial attack graph is determined, and the initial attack graph is optimized based on the attack success probability to obtain the optimized attack graph. By solving the minimum cut set in the optimized attack graph, a minimum disposal set is generated, and the edges to be repaired or cut are determined based on the minimum disposal set. The security strategy includes encryption technology and / or intrusion detection system settings; determining the attack success probability corresponding to each edge in the initial attack graph based on the security strategy configured for the assets includes: For any edge in the initial attack graph, the success probability of the attack corresponding to the edge is determined based on the encryption effect of the encryption algorithm used when transmitting data between the two nodes connected by the edge, and / or the probability that the intrusion detection system detects the access between the two nodes connected by the edge as suspicious access. The optimization of the initial attack graph based on the attack success probability includes: In the initial attack graph, edges with a success probability of zero are deleted.

2. The method according to claim 1, characterized in that, The labels on the edges of the initial attack graph indicate the vulnerability attack methods that the attacker may exploit.

3. The method according to claim 2, characterized in that, The security policy includes a network configuration policy; determining the attack success probability corresponding to each edge in the initial attack graph based on the security policy configured for the assets includes: For any edge in the initial attack graph, if the port on which the connectivity between the two nodes connected by the edge depends conflicts with the vulnerability attack method corresponding to the edge's label, the attack success probability corresponding to the edge is set to zero; otherwise, it is set to one.

4. The method according to claim 1, characterized in that, The weights of the edges in the optimized attack graph are determined based on the attack success probability corresponding to the edge and the importance of the information obtained from the vertex and target to which the edge points. The minimum disposal set is obtained by solving the minimum cut set problem on the optimized attack graph using the Stoer-Wagner algorithm.

5. The method according to claim 2, characterized in that, The minimum disposal set includes the set of labels for the edges corresponding to the minimum cut set.

6. A computer program product, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the method as described in any one of claims 1 to 5.

7. A computer-readable storage medium, characterized in that, It stores a computer program thereon, which, when executed by a processor, implements the method as described in any one of claims 1 to 5.

8. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method as described in any one of claims 1 to 5.

Images