Attack behavior analysis method and device, equipment, storage medium and product

Abstract

The invention discloses an attack behavior analysis method and device, equipment, a storage medium and a product, and the method comprises the steps: obtaining alarm information related to a network attack behavior, and carrying out the processing of the alarm information, and obtaining attack behavior information; matching the attack behavior information with expert knowledge in a network attack behavior knowledge base to obtain at least one attack type, and generating an attack behavior graph; carrying out attack behavior correlation analysis on the attack behavior graph to generate at least one possible attack path; and performing hazard degree evaluation on each possible attack path to obtain a hazard degree analysis result corresponding to each possible attack path. According to the attack behavior analysis method disclosed by the invention, the attack behavior graph is generated for the attack behaviors, then the possible attack paths are generated, and the harm degree of each path is evaluated, so that the potential attack paths can be found, the analysis of the attack behaviors is more comprehensive, and the evaluation of the attack harm degree is more accurate.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an attack behavior analysis method, device, equipment, storage medium and product. Background Art

[0002] With the development of the Internet, the accompanying security issues are becoming more and more serious. At present, network attack technologies are developing rapidly and becoming more complex and diverse. Network attacks have evolved from simple virus propagation to complex attack chains covering lateral movement, multiple carriers, and multiple platforms. The diversity of network attack technologies is not only reflected in the attack methods, but also in their multi-step and multi-stage attack characteristics. At the same time, it does not only involve the exploitation of a single security vulnerability, but also includes a series of interrelated steps such as tampering, penetration, privilege escalation, and data theft.

[0003] Today, the analysis methods for IoT attack behaviors mainly include attack detection and tracing methods based on machine learning, attack graph generation methods based on vulnerabilities, attack association detection methods based on knowledge graphs, and network data packet sample generation methods based on GANs. However, the existing methods have the following main problems: (1) The data format used by most attack association analysis systems generally supports specific data collection modules or anomaly detection systems, and cannot fully utilize all the alarm information in a large-scale system; (2) When using only machine learning algorithms, it is difficult to utilize the accumulated expert knowledge, and it is also impossible to perform attack behavior impact analysis by setting the importance of each network asset. If only knowledge base information is used, it is difficult to respond to emerging threats and attack behaviors. Summary of the invention

[0004] The present invention provides an attack behavior analysis method, device, equipment, storage medium and product to achieve comprehensive and accurate analysis of network attack behavior.

[0005] According to one aspect of the present invention, there is provided a method for analyzing attack behavior, comprising:

[0006] Acquire warning information related to network attack behavior and process the warning information to obtain attack behavior information;

[0007] Matching the attack behavior information with expert knowledge in a network attack behavior knowledge base to obtain at least one attack type and generate an attack behavior graph;

[0008] Performing attack behavior correlation analysis on the attack behavior graph to generate at least one possible attack path;

[0009] A hazard level assessment is performed on each of the possible attack paths to obtain a hazard level analysis result corresponding to each of the possible attack paths.

[0010] Furthermore, the warning information is processed to obtain attack behavior information, including:

[0011] Sorting the alarm information in order of timestamps to obtain alarm sequence information;

[0012] The format of the alarm sequence information is standardized, and redundant information therein is removed to obtain the attack behavior information.

[0013] Furthermore, the attack behavior information is matched with expert knowledge in a network attack behavior knowledge base to obtain at least one attack type, including:

[0014] constructing an attack behavior feature vector according to the attack behavior information, and performing clustering processing to obtain at least one attack behavior cluster;

[0015] Each of the attack behavior clusters is matched with the expert knowledge in the network attack behavior knowledge base to obtain the attack type corresponding to each of the attack behavior clusters.

[0016] Furthermore, an attack behavior graph is generated, including:

[0017] Dividing the attack types corresponding to each of the attack behavior clusters into attack stages;

[0018] Performing pattern recognition and frequent pattern mining on the attack behavior information, determining the relationship between each of the attack behavior information, and generating an attack behavior feature database;

[0019] The attack behavior information is used as nodes, the relationship between each attack behavior information is used as an edge, and the attack behavior graph is formed according to the sequence of attack stages.

[0020] Further, performing attack behavior association analysis on the attack behavior graph to generate at least one possible attack path includes:

[0021] Taking a node in the attack behavior graph as a target node, and determining the support of the target node by the remaining nodes in the attack behavior graph;

[0022] Taking the set of nodes whose support for the target node is greater than the minimum support as the frequent itemset of the target node;

[0023] Sort the nodes in the frequent itemset according to timestamp and attack stage to obtain a potential attack chain of the target node;

[0024] Extracting the head attack node and the tail attack node of the potential attack chain, and generating all possible attack paths with the head attack node and the tail attack node as initial nodes in the attack behavior graph;

[0025] The next node in the attack behavior graph is taken as the target node, and the step of determining the support of the remaining nodes in the attack behavior graph for the target node is returned to be executed until all nodes in the attack behavior graph are traversed to obtain all possible attack paths.

[0026] Furthermore, the hazard level of each possible attack path is evaluated to obtain the hazard level analysis results corresponding to each possible attack path, including:

[0027] For each of the possible attack paths, scoring each node on the possible attack path according to a preset scoring index;

[0028] The scores of each node are weighted and summed, and the weighted sum result is used as the hazard level analysis result of the possible attack path.

[0029] According to another aspect of the present invention, there is provided an attack behavior analysis device, comprising:

[0030] An attack behavior information acquisition module is used to acquire warning information related to network attack behaviors and process the warning information to obtain attack behavior information;

[0031] An attack behavior graph generation module, used to match the attack behavior information with expert knowledge in a network attack behavior knowledge base, obtain at least one attack type, and generate an attack behavior graph;

[0032] A possible attack path generation module, used to perform attack behavior association analysis on the attack behavior graph to generate at least one possible attack path;

[0033] The hazard level analysis module is used to evaluate the hazard level of each possible attack path and obtain the hazard level analysis result corresponding to each possible attack path.

[0034] Optionally, the attack behavior information acquisition module is further used to:

[0035] Sorting the alarm information in order of timestamps to obtain alarm sequence information;

[0036] The format of the alarm sequence information is standardized, and redundant information therein is removed to obtain the attack behavior information.

[0037] Optionally, the attack behavior graph generation module is further used to:

[0038] constructing an attack behavior feature vector according to the attack behavior information, and performing clustering processing to obtain at least one attack behavior cluster;

[0039] Each of the attack behavior clusters is matched with the expert knowledge in the network attack behavior knowledge base to obtain the attack type corresponding to each of the attack behavior clusters.

[0040] Optionally, the attack behavior graph generation module is further used to:

[0041] Dividing the attack types corresponding to each of the attack behavior clusters into attack stages;

[0042] Performing pattern recognition and frequent pattern mining on the attack behavior information, determining the relationship between each of the attack behavior information, and generating an attack behavior feature database;

[0043] The attack behavior information is used as nodes, the relationship between each attack behavior information is used as an edge, and the attack behavior graph is formed according to the sequence of attack stages.

[0044] Optionally, the possible attack path generation module is also used to:

[0045] Taking a node in the attack behavior graph as a target node, and determining the support of the target node by the remaining nodes in the attack behavior graph;

[0046] Taking the set of nodes whose support for the target node is greater than the minimum support as the frequent itemset of the target node;

[0047] Sort the nodes in the frequent itemset according to timestamp and attack stage to obtain a potential attack chain of the target node;

[0048] Extracting the head attack node and the tail attack node of the potential attack chain, and generating all possible attack paths with the head attack node and the tail attack node as initial nodes in the attack behavior graph;

[0049] The next node in the attack behavior graph is taken as the target node, and the step of determining the support of the remaining nodes in the attack behavior graph for the target node is returned to be executed until all nodes in the attack behavior graph are traversed to obtain all possible attack paths.

[0050] Optionally, the Hazard Analysis Module is also used to:

[0051] For each of the possible attack paths, scoring each node on the possible attack path according to a preset scoring index;

[0052] The scores of each node are weighted and summed, and the weighted sum result is used as the hazard level analysis result of the possible attack path.

[0053] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0054] at least one processor; and

[0055] a memory communicatively connected to the at least one processor; wherein,

[0056] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the attack behavior analysis method described in any embodiment of the present invention.

[0057] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the attack behavior analysis method described in any embodiment of the present invention when executed.

[0058] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program / instruction. When the computer program / instruction is executed by a processor, the steps of the attack behavior analysis method described in any embodiment of the present invention are implemented.

[0059] The attack behavior analysis method disclosed in the present invention first obtains the alarm information related to the network attack behavior and processes the alarm information to obtain the attack behavior information; then matches the attack behavior information with the expert knowledge in the network attack behavior knowledge base to obtain at least one attack type and generate an attack behavior graph; then performs attack behavior association analysis on the attack behavior graph to generate at least one possible attack path; finally, evaluates the degree of harm of each possible attack path to obtain the analysis result of the degree of harm corresponding to each possible attack path. The attack behavior analysis method disclosed in the present invention generates an attack behavior graph for the attack behavior, and then generates possible attack paths and evaluates the degree of harm of each path, which can discover potential attack paths, make the analysis of the attack behavior more comprehensive, and make the evaluation of the degree of harm of the attack more accurate.

[0060] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0062] Figure 1 is a flow chart of an attack behavior analysis method provided according to Embodiment 1 of the present invention;

[0063] Figure 2 is a schematic diagram of the structure of an attack behavior analysis device provided according to Embodiment 2 of the present invention;

[0064] Figure 3 It is a schematic diagram of the structure of an electronic device for implementing the attack behavior analysis method of the third embodiment of the present invention. DETAILED DESCRIPTION

[0065] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0066] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0067] Embodiment 1

[0068] Figure 1 This is a flow chart of an attack behavior analysis method provided in the first embodiment of the present invention. This embodiment is applicable to the situation of analyzing the harm of network attack behavior. The method can be executed by an attack behavior analysis device. The attack behavior analysis device can be implemented in the form of hardware and / or software. The attack behavior analysis device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0069] S110: Acquire warning information related to network attack behavior and process the warning information to obtain attack behavior information.

[0070] Among them, network attack behavior refers to the behavior of unauthorized persons illegally accessing, stealing, tampering with, disabling or destroying data, applications or other assets in computer networks, systems or digital devices through various technical means. Alarm information is the operating system logs collected for various network attack behaviors and related warning information in abnormal detection systems at all levels. Attack behavior information is the attack behavior extracted from the alarm information after data processing.

[0071] In this embodiment, the alarm information of the operating system log and the abnormal detection system at all levels can be collected, and then the alarm information is preprocessed. The way of collecting information can be to collect, integrate and represent all data related to the network attack, and the clue data extraction involves extracting data related to a specific network attack event from various sources (such as log files, intrusion detection systems or other monitoring tools). The log source can select multiple sources according to the operating system, software platform, application program, network equipment, third-party security tools, etc. The form of the collected alarm information can be a feature vector / captured pcap file content containing the attack behavior type. The way to process the alarm information can be to establish an entity object of the attack alarm information, then integrate and sort the attack alarm information, obtain the alarm sequence information, and finally remove the redundant information therein.

[0072] Optionally, the method for processing the alarm information to obtain the attack behavior information may be: sorting the alarm information in timestamp order to obtain alarm sequence information; standardizing the format of the alarm sequence information and removing redundant information therein to obtain the attack behavior information.

[0073] Specifically, when processing the alarm information, the alarm information can be defined as: a i =(i, type, timestamp, protocol, sIP, dIP, sPort, dPort, priority), where the information described is the sequence number, type, timestamp, protocol, source IP, destination IP, source port, destination port and importance of the network attack behavior. Then the alarm information can be integrated and sorted in the order of timestamp to obtain the alarm sequence information, which is defined as aS n ={a1,a2,…,a i ,…}, where a t .timestamp m ​.timestamp, where (1 ≤ t < m ≤ i), and n represents the nth anomaly detection system. Since the formats and category names of the alarm messages generated by different algorithms and systems are different, the format of the alarm sequence information generated by each system can be standardized to unify information such as attack types, attack severities, and timestamp formats. Finally, after preprocessing multiple alarm sequence messages, content aggregation is performed, and the attack information is removed using a method based on attribute similarity.

[0074] Among them, when using the method based on attribute similarity to remove redundant information in the alarm sequence information, the similarity of two alarm messages can be calculated to determine whether two attack alarm messages belong to the same action, that is:

[0075]

[0076]

[0077] where similarity is the similarity weight function of each attribute in the alarm message, which contains 5 attributes. If all 5 attributes of two alarm messages are the same, their similarity calculation is 1. For two alarm messages with a similarity calculation of 1, if their timestamp information is still the same, they are considered redundant information and are deleted from the combined alarm sequence information. Finally, an attack behavior information sequence AS without redundancy is obtained n ={A1, A2, …, A i ,…}.

[0078] S120. Match the attack behavior information with the expert knowledge in the network attack behavior knowledge base to obtain at least one attack type and generate an attack behavior graph.

[0079] Among them, the network attack behavior knowledge base is a selected knowledge base and model for network attack behaviors, which contains the attacker's attack life cycle and the goals of each attack stage. The attack behavior graph is a graph formed by using the attack behavior information as nodes, the relationships between the nodes as edges, and in the order of the attack stages.

[0080] In this embodiment, after obtaining the attack behavior information, clustering can be performed on the attack behavior information to obtain one or more "clusters", and each cluster will represent a group of similar attack behaviors. Then, combining the expert knowledge in the network attack behavior knowledge base, the "representative" attack behaviors of each cluster are matched with the multi-stage process in the attack action to obtain a unified description of the attack type and attack stage, and through association analysis and pattern recognition, the attack pattern is found to generate an attack behavior feature database. Finally, using the attack behavior information as nodes and in the order of the attack stages, an attack behavior graph is formed.

[0081] Optionally, the method of matching the attack behavior information with the expert knowledge in the network attack behavior knowledge base to obtain at least one attack type may be: constructing an attack behavior feature vector based on the attack behavior information, and performing clustering processing to obtain at least one attack behavior cluster; matching each attack behavior cluster with the expert knowledge in the network attack behavior knowledge base to obtain the attack type corresponding to each attack behavior cluster.

[0082] Specifically, the time, type, IP address, port, and importance of the network attack behavior described in the attack behavior information can be extracted to construct a feature vector corresponding to each attack behavior information, that is, an attack behavior feature vector. Then all attack behaviors can be clustered. The clustering method can be a clustering algorithm such as K-means. Through clustering, at least one attack behavior cluster can be obtained, and each cluster will represent a group of similar attack behaviors. After the clustering is completed, continuous comparison and adjustment are made to associate each cluster with the expert knowledge in the network attack behavior knowledge base, so that each cluster corresponds to an attack type. Among them, there are 14 types of attacks included in the network attack behavior knowledge base: reconnaissance, resource development, initial access, execution, persistence, privilege escalation, defense bypass, credential acquisition, discovery, lateral movement, collection, command control, data exfiltration, and influence.

[0083] Furthermore, the method for generating an attack behavior graph may be: dividing the attack types corresponding to each attack behavior cluster into attack stages; performing pattern recognition and frequent pattern mining on the attack behavior information, determining the relationship between each attack behavior information, and generating an attack behavior feature database; using the attack behavior information as nodes, the relationship between each attack behavior information as edges, and forming an attack behavior graph in the order of the attack stages.

[0084] Specifically, after obtaining the attack types of the attack behavior information, the attack types can be divided into information collection stage, initial invasion stage, base establishment stage, control channel establishment stage, and target host destruction stage according to the attack stage. The corresponding relationship between the attack type and the attack stage is shown in Table 1:

[0085] Table 1 Correspondence between attack types and attack stages

[0086]

[0087]

[0088] For example, for attack behavior information (201, network scanning, 2024-09-16 10:00:00, TCP, 203.0.113.50, 192.168.1.100, 33333, 80, 3) and (202, vulnerability detection, 2024-09-16 10:10:00,HTTP,203.0.113.50,192.168.1.100,44444,80,2). The former is of type network scanning. Attacker 203.0.113.50 scans port 80 of intranet server 192.168.1.100 through TCP protocol. Since the scan itself does not directly cause damage, it can be marked as priority 3, indicating medium risk. The latter is of type vulnerability detection. Attacker 203.0.113.50 uses HTTP protocol to scan vulnerabilities on intranet server 192.168.1.100 in order to discover potential system weaknesses. The priority is 2, indicating that this behavior is relatively more threatening. Both attacks are carried out by the same source IP (203.0.113.50) against the same target (192.168.1.100) in a similar time period, and the attack types are port scanning and vulnerability detection respectively. These attack behaviors can be classified into the same cluster through the K-means clustering algorithm, indicating that they are highly similar. According to the characteristics and purpose of the attack behavior, network scanning and vulnerability detection are both reconnaissance types in the network attack behavior knowledge base. Attackers usually collect basic information of the target network in this type, such as open ports, running services and vulnerabilities, as a prerequisite for further attacks. Furthermore, this attack type can be divided into the information collection attack stage.

[0089] After dividing the attack phase, according to the clustering results, combined with the source IP of the attack behavior, different types of attacks initiated by the same source IP can be identified, and similar attack chains can be identified, such as finding that the same IP has both DDoS and SQL injection attack behaviors. Preferably, the attack behavior information can be pattern recognized and frequently mined, and the relationship between the attack behaviors can be analyzed to find the frequently occurring attack combination patterns, and the attack patterns found can be used to generate an attack behavior feature database. Among them, the attack behavior feature database can be a relational database (such as MySQL), and the fields in the database can include pattern ID (primary key), frequent attack combination patterns, associated source IP list, attack type corresponding to the attack combination pattern, attack phase, frequency of occurrence of the pattern (high, medium, low), risk level (high, medium, low) and time when the pattern is identified. Subsequently, as new attack behavior information is captured, new clusters can be generated through cluster analysis, and features can be extracted, and new data can be updated to the database. It can also be judged by similarity matching (such as Euclidean distance, cosine similarity) whether the newly captured attack behavior is similar to the high-risk attack pattern known in history, and corresponding warnings or alarms can be made.

[0090] When constructing the attack behavior graph, the attack correlation function can be used to calculate the correlation between two nodes. If the correlation is higher than the threshold, the node is added to the attack graph and a directed edge is added in the order of the attack phase or the timestamp order.

[0091] The calculation formula of correlation is as follows:

[0092]

[0093] Among them, A i and A j are two attack behavior information, δ k is the weight of the kth attribute, F k (A i , A j ) is the correlation function of the kth attribute.

[0094] For the calculation of the correlation of attack category attributes, after dividing the attack stages, the following formula is used for calculation:

[0095]

[0096] Among them, α is A i and A j The difference in attack phase.

[0097] The following formula is used to calculate the correlation of IP address attributes:

[0098] F IP (A i , A j )=max{f(A i sIP, A j .sIP), f(A i .dIP, A j ·dIP)}

[0099]

[0100] Among them, f is the IP address association calculation function, h is the number of valid bytes for comparison, P is the position code of the current byte in the IP address, B is the total length of the IP address, and σ indicates whether the current byte is similar in the two IP addresses.

[0101] The following formula is used to calculate the correlation of time attributes:

[0102]

[0103] ΔT=|A i .timestamp-A j.timestamp|

[0104] Traverse all nodes and calculate the correlation between each two nodes, and finally get the attack behavior graph.

[0105] S130: Perform attack behavior association analysis on the attack behavior graph to generate at least one possible attack path.

[0106] Among them, the possible attack path is the attack behavior path obtained according to the possible associations between nodes.

[0107] In this embodiment, after obtaining the attack behavior graph, the support, confidence and other information between the nodes in the graph can be calculated, and then the association rules between the nodes can be obtained, and the potential attack behavior chain can be obtained. At the same time, for the head and tail of the potential attack behavior chain, possible attack paths can be found and generated in the attack graph respectively. Preferably, the node2vec method of random walk can be used to generate the attack path.

[0108] Optionally, the method of performing attack behavior association analysis on the attack behavior graph to generate at least one possible attack path may be: taking a node in the attack behavior graph as the target node, and determining the support of the remaining nodes in the attack behavior graph for the target node; taking the set of nodes whose support for the target node is greater than the minimum support as the frequent item set of the target node; sorting each node in the frequent item set according to timestamp and attack stage to obtain a potential attack chain of the target node; extracting the head attack node and the tail attack node of the potential attack chain, and generating all possible attack paths in the attack behavior graph with the head attack node and the tail attack node as initial nodes respectively; taking the next node in the attack behavior graph as the target node, and returning to execute the step of determining the support of the remaining nodes in the attack behavior graph for the target node, until all nodes in the attack behavior graph are traversed to obtain all possible attack paths.

[0109] Specifically, for the target node in the attack behavior graph, the frequent item set G can be defined as l ={A i , A j , ..., A t} is a collection of a series of attack behavior information, where all attack behavior information is related to a certain attack behavior information A l The support of is always greater than the minimum support, and the attack behavior information A l That is, the target node. Among them, the support of two attack behavior information represents the ratio of the number of times these two attack behaviors appear together in the entire attack behavior information sequence, and the calculation method is:

[0110]

[0111] Among them, N(A i , Aj ) represents the number of times two attack behaviors appear together in the attack behavior information sequence, Indicates the total number of all attack behavior information, support(A i , A j ) represents the support between the i-th attack behavior and the j-th attack behavior.

[0112] According to the support, we can find all the frequent item sets of the target node. l The attack behavior information in is sorted by timestamp and attack stage, so as to obtain potential attack chains in the frequent item set. For all potential attack chains, the head attack node A of the potential attack chain is extracted s With tail attack node A e , respectively, with A s With A e is the initial node, and all possible attack paths are generated in the attack behavior graph through the random walk algorithm, which is defined as R iN ={A i ,A j ,…,A N}, where R iN Indicates A i is the possible attack path of the initial node. Then the next node in the attack behavior graph is taken as the target node, and the step of determining the support of the remaining nodes in the attack behavior graph to the target node is returned until all nodes in the attack behavior graph are traversed, and finally the set of all possible attack paths AR = {R 11 ,R 12 ,…,R iN}.

[0113] S140: Evaluate the degree of harm of each possible attack path to obtain a harm degree analysis result corresponding to each possible attack path.

[0114] In this embodiment, after all possible attack paths are obtained, the degree of harm of each possible attack path can be scored respectively. For possible attack paths with scores higher than a threshold, the IP nodes contained therein can be recorded, the reachability in the attack behavior graph can be calculated, and the degree of harm of the attack can be further estimated, and finally the degree of harm analysis results corresponding to each possible attack path can be obtained.

[0115] Optionally, a method for evaluating the degree of hazard of each possible attack path and obtaining a hazard degree analysis result corresponding to each possible attack path may be: for each possible attack path, scoring each node on the possible attack path according to a preset scoring index; performing a weighted summation on the score of each node, and using the weighted summation result as the hazard degree analysis result of the possible attack path.

[0116] Specifically, when scoring each node on a possible attack path, both basic indicators and environmental indicators can be considered.

[0117] When scoring based on basic indicators, the nodes in the path are scored for attack vectors, attack complexity, permission requirements, user interactions, confidentiality impact, integrity impact, and availability impact, and the basic indicator score S is obtained. i_base For example, in the analysis of node A1, the attack vector is remote attack (1.0 points), the attack complexity is high (0.6 points), the permission requirement is no authentication required (1.0 points), the user interaction is no interaction required (1.0 points), the confidentiality impact is partial (0.7 points), the integrity impact is partial (0.7 points), and the availability impact is partial (0.7 points). Therefore, S 1_base =10×attack vector×attack complexity×authority requirement×user interaction×(confidentiality impact×weight+integrity impact×weight+availability impact×weight)=4.2 points.

[0118] When scoring based on environmental indicators, the nodes in the path are scored for the confidentiality requirements, integrity requirements, and availability requirements of the IP devices of the nodes, and the score S is obtained. i_inv .

[0119] When evaluating the degree of harm of the entire possible attack path, the risk scores of each node on the entire possible attack path can be weighted and summed. The calculation formula is as follows:

[0120]

[0121] In the formula, S R is the severity score of the possible attack path, (S i_base +S i_inv ) is node A i The hazard level score, P(A i ) indicates transfer to the current node A i The probability, P(A i , A i-1 ) represents the probability of transferring from the previous node to the current node, P e (A i ) represents the probability of the initial node of the path.

[0122] Furthermore, after obtaining the hazard level score of each possible attack path, for the possible attack paths with scores higher than the threshold, the IP nodes contained therein can be recorded, and the reachability in the attack behavior graph can be further calculated:

[0123] Reachability = P(A1) × P(A2,A1) × ... × P(A i ,A i-1 )

[0124] The final hazard level analysis results corresponding to each possible attack path include: possible attack paths, hazard level scores corresponding to each possible attack path, and reachability.

[0125] The attack behavior analysis method provided by the embodiment of the present invention first obtains the alarm information related to the network attack behavior and processes the alarm information to obtain the attack behavior information; then matches the attack behavior information with the expert knowledge in the network attack behavior knowledge base to obtain at least one attack type and generate an attack behavior graph; then performs attack behavior association analysis on the attack behavior graph to generate at least one possible attack path; finally, evaluates the degree of harm of each possible attack path to obtain the degree of harm analysis result corresponding to each possible attack path. The attack behavior analysis method disclosed in the present invention generates an attack behavior graph for the attack behavior, and then generates possible attack paths and evaluates the degree of harm of each path, which can discover potential attack paths, make the analysis of the attack behavior more comprehensive, and make the evaluation of the degree of harm of the attack more accurate.

[0126] Embodiment 2

[0127] Figure 2 A schematic diagram of the structure of an attack behavior analysis device provided in the second embodiment of the present invention is shown in FIG. Figure 2 As shown, the device includes: an attack behavior information acquisition module 310, an attack behavior graph generation module 320, a possible attack path generation module 330 and a harm degree analysis module 340.

[0128] The attack behavior information acquisition module 310 is used to acquire warning information related to network attack behaviors and process the warning information to obtain attack behavior information.

[0129] The attack behavior graph generation module 320 is used to match the attack behavior information with the expert knowledge in the network attack behavior knowledge base to obtain at least one attack type and generate an attack behavior graph.

[0130] The possible attack path generation module 330 is used to perform attack behavior association analysis on the attack behavior graph to generate at least one possible attack path.

[0131] The harm level analysis module 340 is used to evaluate the harm level of each possible attack path and obtain the harm level analysis result corresponding to each possible attack path.

[0132] Optionally, the attack behavior information acquisition module 310 is further used to:

[0133] The alarm information is sorted in the order of timestamps to obtain alarm sequence information; the format of the alarm sequence information is standardized and redundant information is removed to obtain attack behavior information.

[0134] Optionally, the attack behavior graph generation module 320 is further used to:

[0135] An attack behavior feature vector is constructed according to the attack behavior information, and clustering is performed to obtain at least one attack behavior cluster; each attack behavior cluster is matched with expert knowledge in a network attack behavior knowledge base to obtain an attack type corresponding to each attack behavior cluster.

[0136] Optionally, the attack behavior graph generation module 320 is further used to:

[0137] The attack types corresponding to each attack behavior cluster are divided into attack stages; pattern recognition and frequent pattern mining are performed on the attack behavior information to determine the relationship between each attack behavior information and generate an attack behavior feature database; the attack behavior information is used as the node, the relationship between each attack behavior information is used as the edge, and an attack behavior graph is formed in the order of the attack stages.

[0138] Optionally, the possible attack path generation module 330 is further used for:

[0139] A node in the attack behavior graph is taken as the target node, and the support of the remaining nodes in the attack behavior graph for the target node is determined; the set of nodes whose support for the target node is greater than the minimum support is taken as the frequent item set of the target node; the nodes in the frequent item set are sorted according to the timestamp and the attack stage to obtain the potential attack chain of the target node; the head attack node and the tail attack node of the potential attack chain are extracted, and all possible attack paths with the head attack node and the tail attack node as the initial nodes are generated in the attack behavior graph; the next node in the attack behavior graph is taken as the target node, and the step of determining the support of the remaining nodes in the attack behavior graph for the target node is returned to execute until all nodes in the attack behavior graph are traversed to obtain all possible attack paths.

[0140] Optionally, the hazard level analysis module 340 is further used to:

[0141] For each possible attack path, each node on the possible attack path is scored according to the preset scoring indicators; the scores of each node are weighted and summed, and the weighted sum result is used as the hazard level analysis result of the possible attack path.

[0142] The attack behavior analysis device provided in the embodiment of the present invention can execute the attack behavior analysis method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0143] Embodiment 3

[0144] Figure 3 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0145] like Figure 3 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0146] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0147] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the analysis method of attack behavior.

[0148] In some embodiments, the attack behavior analysis method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the attack behavior analysis described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the attack behavior analysis method in any other appropriate manner (e.g., by means of firmware).

[0149] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0150] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0151] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0152] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0153] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0154] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0155] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0156] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for analyzing attack behavior, characterized in that: include: Acquire warning information related to network attack behavior and process the warning information to obtain attack behavior information; Matching the attack behavior information with expert knowledge in a network attack behavior knowledge base to obtain at least one attack type and generate an attack behavior graph; Performing attack behavior correlation analysis on the attack behavior graph to generate at least one possible attack path; A hazard level assessment is performed on each of the possible attack paths to obtain a hazard level analysis result corresponding to each of the possible attack paths.

2. The method according to claim 1, characterized in that The warning information is processed to obtain attack behavior information, including: Sorting the alarm information in order of timestamps to obtain alarm sequence information; The format of the alarm sequence information is standardized, and redundant information therein is removed to obtain the attack behavior information.

3. The method according to claim 1, characterized in that The attack behavior information is matched with the expert knowledge in the network attack behavior knowledge base to obtain at least one attack type, including: constructing an attack behavior feature vector according to the attack behavior information, and performing clustering processing to obtain at least one attack behavior cluster; Each of the attack behavior clusters is matched with the expert knowledge in the network attack behavior knowledge base to obtain the attack type corresponding to each of the attack behavior clusters.

4. The method according to claim 3, characterized in that Generate attack behavior graph, including: Dividing the attack types corresponding to each of the attack behavior clusters into attack stages; Performing pattern recognition and frequent pattern mining on the attack behavior information, determining the relationship between each of the attack behavior information, and generating an attack behavior feature database; The attack behavior information is used as nodes, the relationship between each attack behavior information is used as an edge, and the attack behavior graph is formed according to the sequence of attack stages.

5. The method according to claim 1, characterized in that Performing attack behavior correlation analysis on the attack behavior graph to generate at least one possible attack path includes: Taking a node in the attack behavior graph as a target node, and determining the support of the target node by the remaining nodes in the attack behavior graph; Taking the set of nodes whose support for the target node is greater than the minimum support as the frequent itemset of the target node; Sort the nodes in the frequent itemset according to timestamp and attack stage to obtain a potential attack chain of the target node; Extracting the head attack node and the tail attack node of the potential attack chain, and generating all possible attack paths with the head attack node and the tail attack node as initial nodes in the attack behavior graph; The next node in the attack behavior graph is taken as the target node, and the step of determining the support of the remaining nodes in the attack behavior graph for the target node is returned to be executed until all nodes in the attack behavior graph are traversed to obtain all possible attack paths.

6. The method according to claim 1, characterized in that Perform a hazard level assessment on each of the possible attack paths to obtain a hazard level analysis result corresponding to each of the possible attack paths, including: For each of the possible attack paths, scoring each node on the possible attack path according to a preset scoring index; The scores of each node are weighted and summed, and the weighted sum result is used as the hazard level analysis result of the possible attack path.

7. An attack behavior analysis device, characterized in that: include: An attack behavior information acquisition module is used to acquire warning information related to network attack behaviors and process the warning information to obtain attack behavior information; An attack behavior graph generation module, used to match the attack behavior information with expert knowledge in a network attack behavior knowledge base, obtain at least one attack type, and generate an attack behavior graph; A possible attack path generation module, used to perform attack behavior association analysis on the attack behavior graph to generate at least one possible attack path; The hazard level analysis module is used to evaluate the hazard level of each possible attack path and obtain the hazard level analysis result corresponding to each possible attack path.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the attack behavior analysis method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the attack behavior analysis method according to any one of claims 1 to 6 when executed.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the attack behavior analysis method according to any one of claims 1 to 6 are implemented.

Images