A method, apparatus, device, storage medium, and product for analyzing attack behavior.

Abstract

This invention discloses a method, apparatus, device, storage medium, and product for analyzing attack behavior. The method includes: acquiring alarm information related to network attack behavior and processing the alarm information to obtain attack behavior information; matching the attack behavior information with expert knowledge in a network attack behavior knowledge base to obtain at least one attack type and generating an attack behavior graph; performing attack behavior correlation analysis on the attack behavior graph to generate at least one possible attack path; and assessing the severity of each possible attack path to obtain the severity analysis result corresponding to each possible attack path. The attack behavior analysis method disclosed in this invention generates an attack behavior graph based on the attack behavior, then generates possible attack paths and assesses the severity of each path, which can discover potential attack paths, making the analysis of attack behavior more comprehensive and the assessment of the severity of attacks more accurate.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, device, storage medium, and product for analyzing attack behavior. Background Technology

[0002] With the development of the internet, the accompanying security problems have become increasingly serious. Currently, cyberattack techniques are rapidly evolving, becoming more complex and diverse. Cyberattacks have evolved from simple virus propagation to complex attack chains encompassing lateral movement, multiple carriers, and multiple platforms. The diversity of cyberattack techniques is not only reflected in attack methods but also in their multi-step, multi-stage attack characteristics. Furthermore, it involves not only the exploitation of single security vulnerabilities but also a series of interrelated steps such as tampering, penetration, privilege escalation, and data theft.

[0003] Current methods for analyzing IoT attacks mainly include machine learning-based attack detection and tracing methods, vulnerability-based attack graph generation methods, knowledge graph-based attack correlation detection methods, and GAN-based network packet sample generation methods. However, existing methods have the following main problems: (1) Most attack correlation analysis systems use data formats that generally support specific data acquisition modules or anomaly detection systems, making it impossible to fully utilize all alarm information in a large-scale system; (2) When using machine learning algorithms alone, it is difficult to utilize accumulated expert knowledge, and it is also impossible to analyze the impact of attack behavior by setting the importance of each network asset. If only knowledge base information is used, it is difficult to cope with newly emerging threats and attack behaviors. Summary of the Invention

[0004] This invention provides a method, apparatus, device, storage medium, and product for analyzing attack behavior, so as to achieve comprehensive and accurate analysis of network attack behavior.

[0005] According to one aspect of the present invention, a method for analyzing attack behavior is provided, comprising:

[0006] Obtain alarm information related to network attack behavior and process the alarm information to obtain attack behavior information;

[0007] The attack behavior information is matched with expert knowledge in the network attack behavior knowledge base to obtain at least one attack type and generate an attack behavior graph.

[0008] Perform attack behavior correlation analysis on the attack behavior graph to generate at least one possible attack path;

[0009] The severity of each possible attack path is assessed, and the severity analysis results corresponding to each possible attack path are obtained.

[0010] Furthermore, the alarm information is processed to obtain attack behavior information, including:

[0011] The alarm information is sorted according to timestamp order to obtain alarm sequence information;

[0012] The alarm sequence information is formatted and redundant information is removed to obtain the attack behavior information.

[0013] Furthermore, the attack behavior information is matched with expert knowledge in a network attack behavior knowledge base to obtain at least one attack type, including:

[0014] Based on the attack behavior information, an attack behavior feature vector is constructed and clustered to obtain at least one attack behavior cluster;

[0015] Each attack behavior cluster is matched with expert knowledge in the network attack behavior knowledge base to obtain the attack type corresponding to each attack behavior cluster.

[0016] Furthermore, an attack behavior graph is generated, including:

[0017] The attack types corresponding to each of the aforementioned attack behavior clusters are divided into attack phases;

[0018] The attack behavior information is subjected to pattern recognition and frequent pattern mining to determine the relationship between each attack behavior information and generate an attack behavior feature database.

[0019] The attack behavior information is used as nodes, the relationships between the attack behavior information are used as edges, and the attack behavior graph is formed according to the order of the attack stages.

[0020] Furthermore, attack behavior correlation analysis is performed on the attack behavior graph to generate at least one possible attack path, including:

[0021] Take one node in the attack behavior graph as the target node, and determine the support level of the other nodes in the attack behavior graph for the target node;

[0022] The set of nodes whose support for the target node is greater than the minimum support is taken as the frequent itemset of the target node;

[0023] The nodes in the frequent itemset are sorted according to timestamp and attack stage to obtain the potential attack chain of the target node.

[0024] Extract the head attack node and tail attack node of the potential attack chain, and generate all possible attack paths in the attack behavior graph with the head attack node and the tail attack node as the initial nodes respectively.

[0025] Take the next node in the attack behavior graph as the target node, and return to the step of determining the support of the remaining nodes in the attack behavior graph for the target node, until all nodes in the attack behavior graph have been traversed and all possible attack paths have been obtained.

[0026] Furthermore, the severity of each possible attack path is assessed to obtain the severity analysis results corresponding to each possible attack path, including:

[0027] For each of the possible attack paths, each node on the possible attack path is scored according to a preset scoring index;

[0028] The scores of each node are weighted and summed, and the weighted sum is used as the result of the hazard analysis of the possible attack paths.

[0029] According to another aspect of the present invention, an attack behavior analysis apparatus is provided, comprising:

[0030] The attack behavior information acquisition module is used to acquire alarm information related to network attack behavior and process the alarm information to obtain attack behavior information;

[0031] The attack behavior graph generation module is used to match the attack behavior information with expert knowledge in the network attack behavior knowledge base to obtain at least one attack type and generate an attack behavior graph.

[0032] The possible attack path generation module is used to perform attack behavior correlation analysis on the attack behavior graph and generate at least one possible attack path.

[0033] The hazard level analysis module is used to assess the hazard level of each of the possible attack paths and obtain the hazard level analysis results corresponding to each of the possible attack paths.

[0034] Optionally, the attack behavior information acquisition module is also used for:

[0035] The alarm information is sorted according to timestamp order to obtain alarm sequence information;

[0036] The alarm sequence information is formatted and redundant information is removed to obtain the attack behavior information.

[0037] Optionally, the attack behavior graph generation module is also used for:

[0038] Based on the attack behavior information, an attack behavior feature vector is constructed and clustered to obtain at least one attack behavior cluster;

[0039] Each attack behavior cluster is matched with expert knowledge in the network attack behavior knowledge base to obtain the attack type corresponding to each attack behavior cluster.

[0040] Optionally, the attack behavior graph generation module is also used for:

[0041] The attack types corresponding to each of the aforementioned attack behavior clusters are divided into attack phases;

[0042] The attack behavior information is subjected to pattern recognition and frequent pattern mining to determine the relationship between each attack behavior information and generate an attack behavior feature database.

[0043] The attack behavior information is used as nodes, the relationships between the attack behavior information are used as edges, and the attack behavior graph is formed according to the order of the attack stages.

[0044] Optionally, the attack path generation module may also be used for:

[0045] Take one node in the attack behavior graph as the target node, and determine the support level of the other nodes in the attack behavior graph for the target node;

[0046] The set of nodes whose support for the target node is greater than the minimum support is taken as the frequent itemset of the target node;

[0047] The nodes in the frequent itemset are sorted according to timestamp and attack stage to obtain the potential attack chain of the target node.

[0048] Extract the head attack node and tail attack node of the potential attack chain, and generate all possible attack paths in the attack behavior graph with the head attack node and the tail attack node as the initial nodes respectively.

[0049] Take the next node in the attack behavior graph as the target node, and return to the step of determining the support of the remaining nodes in the attack behavior graph for the target node, until all nodes in the attack behavior graph have been traversed and all possible attack paths have been obtained.

[0050] Optionally, the hazard analysis module is also used for:

[0051] For each of the possible attack paths, each node on the possible attack path is scored according to a preset scoring index;

[0052] The scores of each node are weighted and summed, and the weighted sum is used as the result of the hazard analysis of the possible attack paths.

[0053] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0054] At least one processor; and

[0055] A memory communicatively connected to the at least one processor; wherein,

[0056] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the attack behavior analysis method described in any embodiment of the present invention.

[0057] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the attack behavior analysis method described in any embodiment of the present invention.

[0058] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program / instructions, which, when executed by a processor, implement the steps of the attack behavior analysis method described in any embodiment of the present invention.

[0059] The attack behavior analysis method disclosed in this invention first acquires and processes alarm information related to network attack behavior to obtain attack behavior information; then, it matches the attack behavior information with expert knowledge in a network attack behavior knowledge base to obtain at least one attack type and generates an attack behavior graph; next, it performs attack behavior correlation analysis on the attack behavior graph to generate at least one possible attack path; finally, it assesses the severity of each possible attack path to obtain the severity analysis result corresponding to each possible attack path. This attack behavior analysis method, which generates an attack behavior graph based on the attack behavior, then generates possible attack paths and assesses the severity of each path, can discover potential attack paths, making the analysis of attack behavior more comprehensive and the assessment of the severity of attacks more accurate.

[0060] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 This is a flowchart of an attack behavior analysis method provided according to Embodiment 1 of the present invention;

[0063] Figure 2 This is a schematic diagram of the structure of an attack behavior analysis device provided according to Embodiment 2 of the present invention;

[0064] Figure 3 This is a schematic diagram of the structure of an electronic device that implements the attack behavior analysis method of Embodiment 3 of the present invention. Detailed Implementation

[0065] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0066] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0067] Example 1

[0068] Figure 1 This is a flowchart of an attack behavior analysis method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where the harm of network attack behavior needs to be analyzed. The method can be executed by an attack behavior analysis device, which can be implemented in hardware and / or software and can be configured in an electronic device. Figure 1 As shown, the method includes:

[0069] S110. Obtain alarm information related to network attack behavior and process the alarm information to obtain attack behavior information.

[0070] Network attacks refer to unauthorized access to, theft, alteration, disabling, or damage to data, applications, or other assets in computer networks, systems, or digital devices through various technical means. Alarm information comprises operating system logs and relevant warnings from anomaly detection systems at all levels, collected in response to various network attack behaviors. Attack behavior information consists of the attack behaviors extracted from the alarm information after data processing.

[0071] In this embodiment, operating system logs and alarm information from various levels of anomaly detection systems can be collected, and then the alarm information is preprocessed. Information collection can involve collecting, integrating, and representing all data related to network attacks. Clue data extraction involves extracting data related to specific network attack events from various sources (such as log files, intrusion detection systems, or other monitoring tools). Log sources can be selected from multiple sources based on the operating system, software platform, application, network device, third-party security tools, etc. The collected alarm information can be in the form of feature vectors containing attack behavior types / captured pcap file content. Alarm information processing can involve creating entity objects of attack alarm information, then integrating and sorting the attack alarm information to obtain alarm sequence information, and finally removing redundant information.

[0072] Optionally, the method for processing alarm information to obtain attack behavior information can be: sorting the alarm information in timestamp order to obtain alarm sequence information; standardizing the format of the alarm sequence information and removing redundant information to obtain attack behavior information.

[0073] Specifically, when processing alarm information, alarm information can be defined as: a i = (i, type, timestamp, protocol, sIP, dIP, sPort, dPort, priority), where the information described is, in order, the sequence number, type, timestamp, protocol, source IP, destination IP, source port, destination port, and importance of the network attack behavior. Then, the alarm information can be integrated and sorted according to the timestamp order to obtain alarm sequence information, which is defined as aS. n ={a1,a2,…,a i ,…}, where a t .timestamp m ​.timestamp, where (1 ≤ t < m ≤ i), and n represents the nth anomaly detection system. Since the alert information formats and category names generated by different algorithms and systems are different, the alert sequence information generated by each system can be format-standardized to unify information such as attack types, attack severities, and timestamp formats. Finally, after preprocessing multiple alert sequence information, content aggregation is performed, and the attack information is removed using a method based on attribute similarity.

[0074] Among them, when using the method based on attribute similarity to remove redundant information in the alert sequence information, the similarity of two alert messages can be calculated to determine whether two attack alert messages belong to the same action, that is:

[0075]

[0076]

[0077] where similarity is the similarity weight function of each attribute in the alert message, which contains 5 attributes. If all 5 attributes of two alert messages are the same, their similarity calculation is 1. For two alert messages with a similarity calculation of 1, if their timestamp information is still the same, they are considered redundant information and are deleted in the combined alert sequence information. Finally, an attack behavior information sequence AS without redundancy is obtained n ={A1, A2, …, A i ,…}.

[0078] S120. Match the attack behavior information with the expert knowledge in the network attack behavior knowledge base to obtain at least one attack type and generate an attack behavior graph.

[0079] Among them, the network attack behavior knowledge base is a selected knowledge base and model for network attack behaviors, which contains the attacker's attack life cycle and the goals of each attack stage. The attack behavior graph is a graph formed by using the attack behavior information as nodes, the relationships between nodes as edges, and in the order of attack stages.

[0080] In this embodiment, after obtaining the attack behavior information, clustering can be performed on the attack behavior information to obtain one or more "clusters", and each cluster will represent a group of similar attack behaviors. Then, combining the expert knowledge in the network attack behavior knowledge base, the "representative" attack behaviors of each cluster are matched with the multi-stage process in the attack action to obtain a unified description of the attack type and attack stage, and through association analysis and pattern recognition, the attack pattern is found to generate an attack behavior feature database. Finally, using the attack behavior information as nodes and in the order of attack stages, an attack behavior graph is formed.

[0081] Optionally, the method for matching attack behavior information with expert knowledge in the network attack behavior knowledge base to obtain at least one attack type can be: constructing an attack behavior feature vector based on the attack behavior information and performing clustering processing to obtain at least one attack behavior cluster; matching each attack behavior cluster with expert knowledge in the network attack behavior knowledge base to obtain the attack type corresponding to each attack behavior cluster.

[0082] Specifically, information describing the network attack behavior, such as time, type, IP address, port, and importance, can be extracted from the attack behavior information to construct a feature vector corresponding to each attack behavior, i.e., the attack behavior feature vector. Then, all attack behaviors can be clustered using clustering algorithms such as K-means. Clustering yields at least one attack behavior cluster, with each cluster representing a group of similar attack behaviors. After clustering, continuous comparison and adjustment are performed, associating each cluster with expert knowledge in a network attack behavior knowledge base, so that each cluster corresponds to an attack type. The network attack behavior knowledge base can contain 14 attack types: reconnaissance, resource exploitation, initial access, execution, persistence, privilege escalation, defense bypass, credential acquisition, discovery, lateral movement, collection, command and control, data leakage, and impact.

[0083] Furthermore, the method for generating an attack behavior graph can be as follows: divide the attack types corresponding to each attack behavior cluster into attack stages; perform pattern recognition and frequent pattern mining on the attack behavior information to determine the relationship between each attack behavior information and generate an attack behavior feature database; use the attack behavior information as nodes, the relationship between each attack behavior information as edges, and form an attack behavior graph according to the order of attack stages.

[0084] Specifically, after obtaining information on the attack types of the attack behaviors, the attack types can be divided according to the attack stages: information gathering stage, initial intrusion stage, outpost establishment stage, control channel establishment stage, and target host destruction stage. The correspondence between attack types and attack stages is shown in Table 1.

[0085] Table 1. Correspondence between attack types and attack stages

[0086]

[0087]

[0088] For example, regarding attack behavior information (201, Network Scan, 2024-09-16 10:00:00, TCP, 203.0.113.50, 192.168.1.100, 33333, 80, 3) and (202, Vulnerability Detection, 2024-09-16) The attacks, both at 10:10:00, HTTP, 203.0.113.50, 192.168.1.100, 44444, 80, 2), are classified as follows: The first attack (type: network scan) involves the attacker (203.0.113.50) scanning port 80 of the internal server 192.168.1.100 via TCP. Since the scan itself does not directly cause damage, it can be marked as priority 3, indicating a medium risk. The second attack (type: vulnerability detection) involves the attacker (203.0.113.50) performing a vulnerability scan on the internal server 192.168.1.100 using HTTP, aiming to discover potential system weaknesses. Its priority is 2, indicating a relatively more threatening behavior. Both attacks were launched by the same source IP (203.0.113.50) against the same target (192.168.1.100) within a similar timeframe, and the attack types are port scanning and vulnerability detection, respectively. K-means clustering can group these attack behaviors into the same cluster, indicating a high degree of similarity. Based on the characteristics and purpose of the attack behaviors, network scanning and vulnerability probing both fall under the reconnaissance type within the network attack behavior knowledge base. Attackers typically gather basic information about the target network in this type, such as open ports, running services, and vulnerabilities, as a prerequisite for further attacks. Furthermore, this attack type can be categorized into an information gathering attack phase.

[0089] After segmenting the attack phases, based on the clustering results and the source IP of the attack behavior, different types of attacks originating from the same source IP can be identified, as well as similar attack chains. For example, it can be discovered that the same IP is simultaneously involved in DDoS and SQL injection attacks. Preferably, pattern recognition and frequent pattern mining can be performed on the attack behavior information. By analyzing the relationships between attack behaviors, frequently occurring attack combinations can be identified, and the identified attack patterns can be used to generate an attack behavior feature database. This database can be a relational database (such as MySQL), and its fields can include pattern ID (primary key), frequent attack combinations, a list of associated source IPs, the attack type corresponding to the attack combination, the attack phase, the frequency of occurrence of the pattern (high, medium, low), the risk level (high, medium, low), and the time when the pattern was identified. Subsequently, as new attack behavior information is captured, new clusters can be generated through cluster analysis, features can be extracted, and the new data can be updated in the database. Alternatively, similarity matching (such as Euclidean distance and cosine similarity) can be used to determine whether newly captured attack behaviors are similar to historically known high-risk attack patterns, and corresponding warnings or alerts can be issued.

[0090] When constructing an attack behavior graph, an attack correlation function can be used to calculate the correlation between two nodes. If the correlation is higher than a threshold, the node is added to the attack graph and directed edges are added in the order of the attack phase or the timestamp order.

[0091] The formula for calculating the correlation degree is as follows:

[0092]

[0093] Among them, A i and A j These are two sets of attack behavior information, δ k F is the weight of the k-th attribute. k (A i A j ) is the correlation function for the k-th attribute.

[0094] For calculating the correlation of attack category attributes, after dividing the attack phases, the following formula is used:

[0095]

[0096] Where α is A i and A j The difference between the attack phases.

[0097] The following formula is used to calculate the correlation degree of IP address attributes:

[0098] F IP (A i A j )=max{f(A i ·sIP, A j .sIP), f(A i .dIP, A j ·dIP)}

[0099]

[0100] Where f is the IP address correlation calculation function, h is the number of valid bytes for comparison, P is the position code of the current byte in the IP address, B is the total length of the IP address, and σ indicates whether the current byte is similar in the two IP addresses.

[0101] The following formula is used to calculate the correlation degree of the time attribute:

[0102]

[0103] ΔT=|A i .timestamp-A j.timestamp|

[0104] By traversing all nodes and calculating the degree of association between each pair of nodes, the attack behavior graph is finally obtained.

[0105] S130. Perform attack behavior correlation analysis on the attack behavior graph to generate at least one possible attack path.

[0106] Among them, the possible attack paths are attack behavior paths obtained based on the possible associations between nodes.

[0107] In this embodiment, after obtaining the attack behavior graph, information such as support and confidence between nodes in the graph can be calculated to obtain the association rules between nodes and potential attack behavior chains. Simultaneously, for the head and tail of the potential attack behavior chains, possible attack paths are found and generated in the attack graph. Preferably, the node2vec method with random walks can be used to generate attack paths.

[0108] Optionally, the method for performing attack behavior association analysis on the attack behavior graph to generate at least one possible attack path can be as follows: taking one node in the attack behavior graph as the target node, determining the support of the other nodes in the attack behavior graph for the target node; taking the set of nodes whose support for the target node is greater than the minimum support as the frequent itemset of the target node; sorting the nodes in the frequent itemset according to timestamp and attack stage to obtain the potential attack chain of the target node; extracting the head attack node and tail attack node of the potential attack chain, and generating all possible attack paths in the attack behavior graph with the head attack node and tail attack node as the initial nodes respectively; taking the next node in the attack behavior graph as the target node, returning to the step of determining the support of the other nodes in the attack behavior graph for the target node, until all nodes in the attack behavior graph are traversed and all possible attack paths are obtained.

[0109] Specifically, for the target node in the attack behavior graph, a frequent itemset G can be defined. l ={A i A j A t} is a collection of attack behavior information, where all attack behavior information relates to a certain attack behavior information A. l The support is always greater than the minimum support, attack behavior information A l That is, the target node. The support of two attack behaviors represents the proportion of times these two attack behaviors occur together in the entire attack behavior information sequence, and is calculated as follows:

[0110]

[0111] Among them, N(A) i Aj The number of times two attack behaviors appear together in the attack behavior information sequence is represented by ). This represents the total number of all attack behavior information, support(A) i A j ) represents the support between the i-th attack and the j-th attack.

[0112] Based on support, all frequent itemsets of the target node can be found, and for all frequent itemsets G... l The attack behavior information is sorted by timestamp and attack stage to obtain potential attack chains from the frequent itemset. For all potential attack chains, the head attack node A is extracted. s With tail attack node A e , respectively with A s With A e Starting with a node, a random walk algorithm is used to generate all possible attack paths in the attack behavior graph, denoted as R. iN ={A i A j ,…,A N}, where R iN Indicates A i The initial node represents the possible attack paths. Then, the next node in the attack behavior graph is taken as the target node, and the process returns to determine the support of the remaining nodes in the attack behavior graph for the target node. This continues until all nodes in the attack behavior graph have been traversed, ultimately resulting in the set of all possible attack paths AR = {R...}. 11 ,R 12 ,…,R iN}

[0113] S140. Assess the severity of each possible attack path and obtain the severity analysis results corresponding to each possible attack path.

[0114] In this embodiment, after obtaining all possible attack paths, the severity of each possible attack path can be scored. For possible attack paths with scores higher than the threshold, the IP nodes they contain can be recorded, the reachability in the attack behavior graph can be calculated, and the severity of the attack can be further estimated. Finally, the severity analysis results corresponding to each possible attack path can be obtained.

[0115] Optionally, the method for assessing the severity of each possible attack path and obtaining the severity analysis results corresponding to each possible attack path can be as follows: for each possible attack path, score each node on the possible attack path according to the preset scoring index; perform a weighted summation of the scores of each node, and use the weighted summation result as the severity analysis result of the possible attack path.

[0116] Specifically, when scoring each node on a potential attack path, both basic metrics and environmental metrics can be considered.

[0117] When scoring based on fundamental metrics, each node in the path is scored in terms of attack vector, attack complexity, access requirements, user interaction, confidentiality impact, integrity impact, and availability impact, resulting in a fundamental metric score S. i_base For example, in the analysis of node A1, the attack vector is a remote attack (1.0 point), the attack complexity is high (0.6 points), the permission requirement is no authentication required (1.0 point), the user interaction is no interaction required (1.0 point), the impact on confidentiality is partial (0.7 points), the impact on integrity is partial (0.7 points), and the impact on availability is partial (0.7 points). Therefore, S 1_base =10 × attack vector × attack complexity × access requirements × user interaction × (confidentiality impact × weight + integrity impact × weight + availability impact × weight) = 4.2 points.

[0118] When scoring based on environmental indicators, each node in the path is scored regarding the confidentiality, integrity, and availability requirements of its IP device, resulting in a score S. i_inv .

[0119] When evaluating the severity of a potential attack path, the risk scores of each node along the path can be weighted and summed. The calculation formula is as follows:

[0120]

[0121] In the formula, S R It is a severity rating of potential attack paths, (S) i_base +S i_inv ) is node A i The severity score, P(A) i ) indicates a transition to the current node A i The probability, P(A) i A i-1 P represents the probability of transitioning from the previous node to the current node. e (A i ) represents the probability of the initial node of the path.

[0122] Furthermore, after obtaining the severity score of each possible attack path, for those possible attack paths with scores higher than the threshold, the IP nodes they contain can be recorded, and their reachability in the attack behavior graph can be further calculated:

[0123] Reachability = P(A1) × P(A2,A1) × ... × P(A i A i-1 )

[0124] The final analysis results of the harm level of each possible attack path include: possible attack path, harm level score of each possible attack path, and reachability.

[0125] The attack behavior analysis method provided in this invention first acquires and processes alarm information related to network attack behavior to obtain attack behavior information; then, it matches the attack behavior information with expert knowledge in a network attack behavior knowledge base to obtain at least one attack type and generates an attack behavior graph; next, it performs attack behavior correlation analysis on the attack behavior graph to generate at least one possible attack path; finally, it assesses the severity of each possible attack path to obtain the severity analysis result corresponding to each possible attack path. The attack behavior analysis method disclosed in this invention generates an attack behavior graph for attack behavior, then generates possible attack paths and assesses the severity of each path, which can discover potential attack paths, making the analysis of attack behavior more comprehensive and the assessment of the severity of attacks more accurate.

[0126] Example 2

[0127] Figure 2 This is a schematic diagram of the structure of an attack behavior analysis device provided in Embodiment 2 of the present invention, as shown below. Figure 2 As shown, the device includes: an attack behavior information acquisition module 310, an attack behavior graph generation module 320, a possible attack path generation module 330, and a hazard level analysis module 340.

[0128] The attack behavior information acquisition module 310 is used to acquire alarm information related to network attack behavior and process the alarm information to obtain attack behavior information.

[0129] The attack behavior graph generation module 320 is used to match attack behavior information with expert knowledge in the network attack behavior knowledge base to obtain at least one attack type and generate an attack behavior graph.

[0130] The potential attack path generation module 330 is used to perform attack behavior correlation analysis on the attack behavior graph and generate at least one potential attack path.

[0131] The hazard analysis module 340 is used to assess the hazard level of each possible attack path and obtain the hazard level analysis results corresponding to each possible attack path.

[0132] Optionally, the attack behavior information acquisition module 310 is also used for:

[0133] The alarm information is sorted by timestamp to obtain alarm sequence information; the alarm sequence information is standardized in format and redundant information is removed to obtain attack behavior information.

[0134] Optionally, the attack behavior graph generation module 320 is also used for:

[0135] Attack behavior feature vectors are constructed based on attack behavior information and clustered to obtain at least one attack behavior cluster. Each attack behavior cluster is matched with expert knowledge in the network attack behavior knowledge base to obtain the attack type corresponding to each attack behavior cluster.

[0136] Optionally, the attack behavior graph generation module 320 is also used for:

[0137] The attack behavior clusters are divided into attack stages; pattern recognition and frequent pattern mining are performed on the attack behavior information to determine the relationship between each attack behavior information and generate an attack behavior feature database; attack behavior information is used as nodes, the relationship between each attack behavior information is used as edges, and an attack behavior graph is formed according to the order of attack stages.

[0138] Optionally, the attack path generation module 330 may also be used for:

[0139] Take one node in the attack behavior graph as the target node and determine the support of the other nodes in the attack behavior graph for the target node. Take the set of nodes whose support for the target node is greater than the minimum support as the frequent itemset of the target node. Sort the nodes in the frequent itemset according to timestamp and attack stage to obtain the potential attack chain of the target node. Extract the head attack node and tail attack node of the potential attack chain and generate all possible attack paths in the attack behavior graph with the head attack node and tail attack node as the initial nodes respectively. Take the next node in the attack behavior graph as the target node and return to execute the step of determining the support of the other nodes in the attack behavior graph for the target node until all nodes in the attack behavior graph are traversed and all possible attack paths are obtained.

[0140] Optionally, the hazard analysis module 340 is also used for:

[0141] For each possible attack path, each node on the possible attack path is scored according to the preset scoring index; the scores of each node are weighted and summed, and the weighted sum is used as the result of the analysis of the degree of harm of the possible attack path.

[0142] The attack behavior analysis device provided in the embodiments of the present invention can execute the attack behavior analysis method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0143] Example 3

[0144] Figure 3 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0145] like Figure 3 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0146] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0147] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as methods for analyzing attack behavior.

[0148] In some embodiments, the attack behavior analysis method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the attack behavior analysis described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the attack behavior analysis method by any other suitable means (e.g., by means of firmware).

[0149] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0150] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0151] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0152] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0153] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0154] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0155] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0156] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for analyzing attack behavior, characterized in that, include: Obtain alarm information related to network attack behavior and process the alarm information to obtain attack behavior information; Based on the attack behavior information, an attack behavior feature vector is constructed and clustered to obtain at least one attack behavior cluster. Each attack behavior cluster is matched with expert knowledge in a network attack behavior knowledge base to obtain the attack type corresponding to each attack behavior cluster. The attack types corresponding to each attack behavior cluster are divided into attack stages. Pattern recognition and frequent pattern mining are performed on the attack behavior information to determine the relationship between each attack behavior information and generate an attack behavior feature database. Using the attack behavior information as nodes and the relationship between each attack behavior information as edges, an attack behavior graph is formed according to the order of attack stages. Take one node in the attack behavior graph as the target node, and determine the support level of the other nodes in the attack behavior graph for the target node; The set of nodes whose support for the target node is greater than the minimum support is taken as the frequent itemset of the target node; The nodes in the frequent itemset are sorted according to timestamp and attack stage to obtain the potential attack chain of the target node; the head attack node and the tail attack node of the potential attack chain are extracted, and all possible attack paths with the head attack node and the tail attack node as the initial nodes are generated in the attack behavior graph; the next node in the attack behavior graph is taken as the target node, and the step of determining the support of the remaining nodes in the attack behavior graph for the target node is returned to execute until all nodes in the attack behavior graph are traversed and all possible attack paths are obtained. The severity of each possible attack path is assessed, and the severity analysis results corresponding to each possible attack path are obtained.

2. The method according to claim 1, characterized in that, The alarm information is processed to obtain attack behavior information, including: The alarm information is sorted according to timestamp order to obtain alarm sequence information; The alarm sequence information is formatted and redundant information is removed to obtain the attack behavior information.

3. The method according to claim 1, characterized in that, The severity of each possible attack path is assessed to obtain the severity analysis results corresponding to each possible attack path, including: For each of the possible attack paths, each node on the possible attack path is scored according to a preset scoring index; The scores of each node are weighted and summed, and the weighted sum is used as the result of the hazard analysis of the possible attack paths.

4. An analysis device for attack behavior, characterized in that, include: The attack behavior information acquisition module is used to acquire alarm information related to network attack behavior and process the alarm information to obtain attack behavior information; An attack behavior graph generation module is used to construct attack behavior feature vectors based on the attack behavior information, and perform clustering processing to obtain at least one attack behavior cluster; match each attack behavior cluster with expert knowledge in a network attack behavior knowledge base to obtain the attack type corresponding to each attack behavior cluster; divide the attack types corresponding to each attack behavior cluster into attack stages; perform pattern recognition and frequent pattern mining on the attack behavior information to determine the relationship between each attack behavior information and generate an attack behavior feature database; and form an attack behavior graph using the attack behavior information as nodes, the relationship between each attack behavior information as edges, and according to the order of attack stages. The possible attack path generation module is used to take one node in the attack behavior graph as the target node, determine the support of the other nodes in the attack behavior graph for the target node, and take the set of nodes whose support for the target node is greater than the minimum support as the frequent itemset of the target node. The nodes in the frequent itemset are sorted according to timestamp and attack stage to obtain the potential attack chain of the target node; the head attack node and the tail attack node of the potential attack chain are extracted, and all possible attack paths with the head attack node and the tail attack node as the initial nodes are generated in the attack behavior graph; the next node in the attack behavior graph is taken as the target node, and the step of determining the support of the remaining nodes in the attack behavior graph for the target node is returned to execute until all nodes in the attack behavior graph are traversed and all possible attack paths are obtained. The hazard level analysis module is used to assess the hazard level of each of the possible attack paths and obtain the hazard level analysis results corresponding to each of the possible attack paths.

5. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the attack behavior analysis method according to any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the analysis method for the attack behavior according to any one of claims 1-3.

7. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the attack behavior analysis method as described in any one of claims 1-3.

Images