Knowledge base construction method, complete attack graph generation method, electronic equipment and storage medium
By building a knowledge base for vulnerability attack mode and generating a complete attack map, the problem of incomplete attack maps in the existing technology is solved, the completeness of attack maps is improved, and a more comprehensive understanding of the network security situation can be achieved.
Patent Information
- Application Number
- CN202411296791.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-14
- Publication Date
- 2025-02-11
AI Technical Summary
What is used in the prior art is not an attribute attack map, which results in the acquired attack map being not complete and cannot meet the complex security needs of modern network environments.
By building a knowledge base for vulnerability attack modes, it includes building a network topology diagram based on a surviving host, acquiring a single-host vulnerability database, merging it into a global vulnerability database, and classifying and identifying attack modes, and generating a knowledge base for vulnerability attack modes. Then, a complete attack map is generated based on the knowledge base, including initializing the attacker's initial node collection, traversing the connected host list, generating attack map elements, and building a complete attack map.
By building a knowledge base for vulnerability attack mode and generating a complete attack map, the completeness of the attack map is improved, and a more comprehensive understanding of the interaction between vulnerabilities and host assets and their impact on network security situations can be achieved.
Smart Images
Figure CN119416220A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a knowledge base construction, a complete attack graph generation method, an electronic device, and a storage medium. Background Art
[0002] In today's cybersecurity landscape, facing an increasingly complex threat landscape, enterprises must employ advanced technologies to protect their critical assets. The concept of attack graphs, which reveal the attacker's successful network penetration by representing all possible attack paths, has become a key tool in this task. As network environments become increasingly diverse and complex, simple vulnerability scanning is no longer sufficient. By constructing and analyzing network attack graphs, we can gain a deeper understanding of the interactions between vulnerabilities and host assets, and their impact on the network security landscape, providing organizations with comprehensive risk insights.
[0003] An attack graph is a tool used to construct multi-stage attack paths, where each path represents a chain of exploits that an attacker could use to penetrate a network. Therefore, attack graph technology is crucial for understanding not only where vulnerabilities exist, but also how they are most likely to be exploited, and what this means for organizations protecting high-value assets.
[0004] In the prior art, attribute attack graphs are not used, and planned segmentation and pruning must be performed, and the attack graph obtained is not a complete attack graph. Summary of the Invention
[0005] The present application provides a method for constructing a vulnerability attack pattern knowledge base, a method for generating a complete attack graph, an electronic device, and a computer storage medium.
[0006] To solve the above technical problems, the present application proposes a method for constructing a vulnerability attack pattern knowledge base, the construction method comprising: constructing a network topology map based on surviving hosts; obtaining a single-host vulnerability database for each host in the network topology map, wherein the single-host vulnerability database includes feature description information for each vulnerability entry; merging the single-host vulnerability databases of all hosts in the network topology map into a global vulnerability database, wherein the vulnerability information vector of the global vulnerability database includes feature description information for all vulnerability entries; performing attack pattern classification and identification on the vulnerability entries in the global vulnerability database based on the vulnerability information vector to generate a vulnerability attack pattern knowledge base.
[0007] Among them, the method of classifying and identifying attack patterns of vulnerability entries in the global vulnerability database based on the vulnerability information vector to generate a vulnerability attack pattern knowledge base includes: analyzing the vulnerability attack pattern corresponding to each vulnerability entry based on the feature description information of the vulnerability information vector; obtaining a list of vulnerability sets that meet each vulnerability attack pattern; obtaining the exploitation premise and exploitation consequence of each vulnerability entry in the vulnerability set list; constructing a vulnerability attack pattern vector based on the vulnerability attack pattern, the vulnerability set list, the exploitation premise and the exploitation consequence; and classifying and identifying attack patterns of vulnerability entries in the global vulnerability database based on the vulnerability attack pattern vector to generate a vulnerability attack pattern knowledge base.
[0008] Among them, obtaining the exploitation premise and exploitation consequence of each vulnerability entry in the vulnerability set list includes: analyzing the configuration environment and usage conditions of each vulnerability entry to extract candidate exploitation premises and candidate exploitation consequences of the vulnerability entry; judging whether there is an OR relationship between the candidate exploitation premise and the candidate exploitation consequence; if so, decomposing and refining the OR relationship between the candidate exploitation premise and the candidate exploitation consequence until the obtained exploitation premise and exploitation consequence do not have an OR relationship, storing the exploitation premise in the exploitation premise set, and storing the exploitation consequence in the exploitation consequence set.
[0009] Among them, the construction method also includes: using natural language processing to extract text segmentations of each vulnerability entry in the single-host vulnerability database; performing part-of-speech tagging on the text segmentations; based on the part-of-speech tagging results of all text segmentations, analyzing the semantic connections between the various text segmentations of each vulnerability entry, and generating feature description information for each vulnerability entry.
[0010] Among them, obtaining the single-host vulnerability database of each host in the network topology diagram includes: obtaining a dynamic vulnerability list and a static vulnerability list of each host; merging the dynamic vulnerability list and the static vulnerability list, and removing duplicate vulnerability entries to generate a single-host vulnerability database for each host.
[0011] To solve the above technical problems, the present application proposes a method for generating a complete attack graph, which includes: obtaining a vulnerability attack pattern knowledge base through the above-mentioned construction method; initializing the attacker's initial node set based on the vulnerability attack pattern knowledge base; traversing each unmarked node in the initial node combination to obtain a list of connected hosts; traversing each unmarked node in the connected host list to generate an attack graph element; and generating the complete attack graph based on all attack graph elements.
[0012] Among them, the attack graph elements include directed edges of the attack graph; traversing each unmarked node in the connected host list to generate attack graph elements includes: obtaining the attack pattern vector of each unmarked node based on the vulnerability attack pattern knowledge base; determining whether the premise conditions in the attack pattern vector match the variable information; if so, generating directed edges of the attack graph according to the attack pattern vector.
[0013] The directed edges of the attack graph are used to represent attack patterns and vulnerabilities with the greatest attack probability, wherein the attack probability is determined by variable information of the attack pattern vector.
[0014] To solve the above technical problems, the present application proposes an electronic device, which includes a memory and a processor coupled to the memory; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the above-mentioned construction method and / or generation method.
[0015] In order to solve the above technical problems, the present application proposes a computer storage medium, which is used to store program data. When the program data is executed by a computer, it is used to implement the above construction method and / or generation method.
[0016] Different from the existing technology, the beneficial effects of this application are as follows: the electronic device constructs a network topology map based on surviving hosts; obtains a single-host vulnerability database for each host in the network topology map, wherein the single-host vulnerability database includes characteristic description information of each vulnerability entry; merges the single-host vulnerability databases of all hosts in the network topology map into a global vulnerability database, wherein the vulnerability information vector of the global vulnerability database includes characteristic description information of all vulnerability entries; and classifies and identifies attack patterns for vulnerability entries in the global vulnerability database based on the vulnerability information vector to generate a vulnerability attack pattern knowledge base. Through the above method, a vulnerability attack pattern knowledge base is constructed, and the completeness of the attack graph is improved. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0018] Figure 1 This is a flowchart of an embodiment of a method for constructing a vulnerability attack pattern knowledge base provided by the present application;
[0019] Figure 2 This is the construction method of the vulnerability attack pattern knowledge base provided by this application Figure 1 Schematic diagram of the flow of sub-steps of step S14;
[0020] Figure 3 This is a flow chart of an embodiment of a method for generating a complete attack graph provided by the present application;
[0021] Figure 4 This is a flow chart of another embodiment of the complete attack graph generation method provided by the present application;
[0022] Figure 5 This is a structural diagram of an embodiment of an electronic device provided by the present application;
[0023] Figure 6 It is a structural diagram of an embodiment of a computer storage medium provided by this application. DETAILED DESCRIPTION
[0024] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.
[0025] The target recognition method of the present application is applied to an electronic device, wherein the electronic device of the present application can be a server or a system comprising a server and a local terminal. Accordingly, the various components of the electronic device, such as the various units, subunits, modules, and submodules, can be all provided in the server or separately provided in the server and the local terminal.
[0026] Furthermore, the above-mentioned server can be hardware or software. When the server is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or it can be implemented as a single server. When the server is software, it can be implemented as multiple software or software modules, such as software or software modules used to provide distributed servers, or it can be implemented as a single software or software module, which is not specifically limited here. In some possible implementations, the target recognition method of the embodiment of the present application can be implemented by a processor calling computer-readable instructions stored in a memory.
[0027] The attribute attack graph is proposed to solve the attribute explosion problem of the state attack graph. It treats the security elements in the network as independent attribute vertices. The same vulnerability on the same host corresponds to only one attribute vertex in the graph. Therefore, compared with the state attack graph, the attribute attack graph is faster to generate, has a simpler structure, and is more adaptable to large-scale networks.
[0028] Attribute attack graphs typically contain two types of vertices and edges. Vertices are categorized into two types: conditional vertices, which indicate the attacker's current permissions; and vulnerability vertices, which represent vulnerable services and the permissions an attacker can obtain by exploiting the vulnerability. Edges are categorized into two types: edges from conditions to vulnerabilities represent the vulnerability's preconditions, and edges from vulnerabilities to conditions represent the vulnerability's postconditions.
[0029] For an attribute attack graph, an atomic attack node is a vulnerability vertex. For any vulnerability vertex in the attack graph, the vulnerability can only be successfully exploited when all preconditions are met. For any condition vertex, as long as any vulnerability that serves as a postcondition can be successfully exploited, the condition node is considered to be satisfied.
[0030] Therefore, for the attribute attack graph AG = (C, V, E), for any q∈V, Pre(q) is the set of preconditions and Post(q) is the set of postconditions, then (∧Pre(q))→(∧Post(q)), indicating that the vulnerability can be exploited when all preconditions are met, thereby satisfying all postconditions of the vulnerability.
[0031] Existing attack path parallel planning systems and methods for large-scale industrial control scenarios have the following shortcomings:
[0032] Since we use a state attack graph instead of an attribute attack graph, we need to face the problem of state combination explosion that may occur when planning the attack path under the complete scenario. Therefore, we need to use graph segmentation technology through topological information segmentation to split the complete scenario information into multiple small-scale scenarios smaller than the topological scale threshold. The attack graph finally obtained is not a complete attack graph.
[0033] Existing attack graph generation methods and devices based on knowledge graphs have the following disadvantages:
[0034] In constructing a knowledge graph, relationships between entities and between entities and attributes are extracted from the information source. Attributes of specified entities are obtained from the information source. These relationships and attributes are extracted using a conditional random field model. Based on the existing entities, relationships, and attributes in the knowledge graph, and based on the attack conditions and attack methods, knowledge inference is performed on the attack success rate and attack benefit, establishing new relationships or attributes to expand the knowledge graph. The success rate and attack benefit are based solely on knowledge inference, which can be categorized as precise or imprecise. This method utilizes imprecise inference based on probabilistic methods. The attack success rate and attack benefit may contain data errors. Imprecise inference cannot guarantee the accuracy of the conclusions drawn, so the conclusions drawn are not necessarily accurate.
[0035] This application relates to a graph search algorithm strategy based on precise reasoning. A graph search algorithm is an algorithm that searches for a path from a starting point to an end point in a graph structure. A graph structure is a nonlinear data structure consisting of nodes and edges, where nodes represent data entities and edges represent relationships between nodes. The goal of a graph search algorithm is to find the optimal path from a starting point to an end point, making the search process more efficient and accurate. Clearly, the reliability of the results of precise reasoning is greater than that of imprecise reasoning.
[0036] See also Figure 1 , Figure 1 This is a flow chart of an embodiment of a method for constructing a vulnerability attack pattern knowledge base provided by this application.
[0037] like Figure 1 As shown, the specific steps are as follows:
[0038] Step S11: construct a network topology map based on the surviving hosts.
[0039] The target network contains multiple hosts. The electronic device detects the target network, finds the surviving hosts in the target network, and builds a network topology map.
[0040] Step S12: Obtain a single-host vulnerability database for each host in the network topology diagram.
[0041] In an embodiment of the present application, the single-host vulnerability database includes feature description information of each vulnerability entry.
[0042] In one embodiment of the present application, the electronic device obtains a dynamic vulnerability list and a static vulnerability list of each host; merges the dynamic vulnerability list and the static vulnerability list, and removes duplicate vulnerability entries from the list to generate a single-host vulnerability database for each host.
[0043] Specifically, the electronic device performs a dynamic vulnerability scan and a static host image scan on each host, obtaining a dynamic vulnerability list and a static vulnerability list, respectively. The dynamic vulnerability list and the static vulnerability list are merged, duplicate vulnerability entries are removed, and the list of connected hosts is added to obtain a single-host vulnerability database.
[0044] The single-host vulnerability database element is constructed as follows:
[0045] 1) Host ID: used to identify the unique host in the target network;
[0046] 2) Original vulnerability information: Original vulnerability description information obtained locally or from a third party, including notification time, vulnerability impact level, and other information.
[0047] 3) List of connected hosts: A list of other hosts that the host can connect to, including but not limited to hosts that are connected through connectivity methods such as the data link layer, network layer, and application layer.
[0048] Step S13: Merge the single-host vulnerability databases of all hosts in the network topology diagram into a global vulnerability database.
[0049] The vulnerability information vector of the global vulnerability database includes the feature description information of all vulnerability entries.
[0050] The electronic device scans all hosts in the target network in sequence and merges all single-host vulnerability databases to generate a global vulnerability database.
[0051] Specifically, the elements in the global vulnerability database are constructed as follows:
[0052] 1) Host ID: used to identify the unique host in the target network;
[0053] 2) List of connected hosts: A list of other hosts that the host can connect to, including but not limited to hosts that are connected through connectivity methods such as the data link layer, network layer, and application layer.
[0054] 3) Vulnerability information vector: This vector contains structured feature description information about the vulnerability.
[0055] Step S14: classify and identify attack patterns of vulnerability entries in the global vulnerability database based on the vulnerability information vector to generate a vulnerability attack pattern knowledge base.
[0056] Specifically, this application proposes steps S141 to S145 as sub-steps of step S14 to generate a vulnerability attack pattern knowledge base. Figure 2 , Figure 2 This is the construction method of the vulnerability attack pattern knowledge base provided by this application Figure 1 Schematic diagram of the flow of sub-steps of step S14.
[0057] like Figure 2 The specific steps are as follows:
[0058] Step S141: Analyze the vulnerability attack pattern corresponding to each vulnerability entry based on the feature description information of the vulnerability information vector.
[0059] Specifically, the electronic device performs a detailed analysis of its configuration environment, usage conditions and other descriptive information based on the vulnerability list and variable information in the vulnerability attack pattern vector.
[0060] Step S142: Obtain a list of vulnerability sets that satisfy each vulnerability attack pattern.
[0061] Specifically, the electronic device obtains a vulnerability set list corresponding to each vulnerability attack mode.
[0062] Step S143: Obtain the exploitation prerequisite and exploitation consequence of each vulnerability entry in the vulnerability collection list.
[0063] Specifically, the electronic device analyzes the configuration environment and usage conditions of each vulnerability entry, and extracts candidate exploitation prerequisites and candidate exploitation consequences of the vulnerability entry.
[0064] Furthermore, the electronic device determines whether there is a relationship between the candidate utilization premise and the candidate utilization consequence.
[0065] If the candidate utilization premise and the candidate utilization consequence have an OR relationship, the electronic device will decompose and refine the OR relationship between the candidate utilization premise and the candidate utilization consequence until the obtained utilization premise and the utilization consequence do not have an OR relationship, and store the utilization premise in the utilization premise set and the utilization consequence in the utilization consequence set.
[0066] Specifically, the electronic device performs a detailed analysis of its configuration environment, usage conditions and other descriptive information based on the vulnerability list and variable information in the vulnerability attack pattern vector; extracts the premise for exploiting the vulnerability information; extracts the consequences of exploiting the vulnerability information; determines whether the premise and the consequences contain an "or" relationship, and if not, stores the information in the corresponding sets of premise and consequence; if they contain an "or" relationship, decomposes and refines the "or" relationship.
[0067] Step S144: Constructing a vulnerability attack pattern vector based on the vulnerability attack pattern, the vulnerability set list, the exploitation premise, and the exploitation consequence.
[0068] Among them, the vector element data format is<Name,VulList,Vars,Pre,Eff> , where Name is the name of the vulnerability attack mode, VulList is the list of vulnerability sets that meet the attack mode; Vars is the associated variable information, such as protocol, port number, access file permissions, etc.; Pre and Eff respectively represent the premise and consequences of the attack mode being exploitable, that is, the premise of occurrence and the consequences caused to the host.
[0069] In the embodiment of this application, 12 attack modes are specified, and Name belongs to the set <Local_Root,Local_User、Local_Integrity,Local_Confidentiality,Local_Dos,Local_None,Remote_Root,Remote_User,Remote_Integrity,Remote_Confidentiality,Remote_Dos,Remote_None> VulList is a list of vulnerabilities that satisfy this attack pattern. Vars is associated variable information, such as protocol, port number, and file access permissions. Pre and Eff represent the prerequisites and consequences for exploiting this attack pattern, respectively.
[0070] Step S145: classify and identify the attack patterns of vulnerability entries in the global vulnerability database based on the vulnerability attack pattern vectors to generate a vulnerability attack pattern knowledge base.
[0071] Specifically, the electronic device classifies and identifies attack patterns of different vulnerability entries in the global vulnerability database based on the vulnerability attack pattern vector, establishes a vulnerability knowledge base, and annotates each vulnerability entry with exploitable premise and consequence information.
[0072] In one embodiment of the present application, the electronic device uses natural language processing to pre-process each vulnerability entry in the single-host vulnerability database to structure it. The specific steps are as follows:
[0073] The electronic device uses natural language processing to extract text segmentation of each vulnerability entry in the single-host vulnerability database; performs part-of-speech tagging on the text segmentation; and based on the part-of-speech tagging results of all text segmentations, analyzes the semantic connection between each text segmentation of each vulnerability entry to generate feature description information for each vulnerability entry.
[0074] Specifically, electronic devices can search for the core content of vulnerability description information and classify text content through word segmentation. In one embodiment of the present application, a dictionary-based word segmentation algorithm is used. Furthermore, part-of-speech tagging is performed based on word segmentation analysis to identify the part of speech of words and mark them as verbs, adjectives, or other types. Semantic dependency analysis aims to analyze the semantic connections between the individual word segmentation results in a sentence and present them in a structured form.
[0075] A complete attack graph is a collection of all possible attack paths, given the attacker's initial permissions. This is a circular attribute attack graph. Because this graph preserves all possible attack paths, traversal analysis can easily list all paths to a specific target without missing any paths. Therefore, security administrators can use this graph to gain a more comprehensive understanding of network security performance and make appropriate security deployments based on this understanding.
[0076] To ensure the completeness of the attack graph, this application uses an improved backtracking algorithm to generate the attack graph. This application also proposes a method for generating a complete attack graph. For details, please refer to Figure 3-Figure 4 , Figure 3 This is a flow chart of an embodiment of a method for generating a complete attack graph provided by this application. Figure 4 This is a flowchart of another embodiment of the complete attack graph generation method provided by this application.
[0077] like Figure 3 As shown, the specific steps are as follows:
[0078] Step S21: Initialize the attacker's initial node set based on the vulnerability attack pattern knowledge base.
[0079] Among them, the vulnerability attack pattern knowledge base is obtained through the vulnerability attack pattern knowledge base construction method in any embodiment of the present application.
[0080] Specifically, the attacker's initial node set S0 (n1, n2, .., nm) is initialized, and each node is initialized with relevant information such as permissions, host information, and attack pattern vector.
[0081] Step S22: traverse each unmarked node in the initial node combination to obtain a list of connected hosts.
[0082] The electronic device selects any unmarked node n in the initial node set S0 n , get the host list H1(h1,h2,…,h m ).
[0083] Step S23: traverse each unmarked node in the connected host list to generate an attack graph element.
[0084] Specifically, the electronic device obtains any unmarked node h in the connected host list H1. n .
[0085] In the embodiment of the present application, the attack graph element includes the directed edge of the attack graph.
[0086] Specifically, the electronic device obtains an attack pattern vector of each unlabeled node based on a vulnerability attack pattern knowledge base; determines whether a precondition in the attack pattern vector matches variable information; and if so, generates directed edges of an attack graph according to the attack pattern vector.
[0087] In an embodiment of the present application, directed edges in the attack graph are used to represent attack patterns and vulnerabilities with the greatest attack probability, wherein the attack probability is determined by variable information of the attack pattern vector.
[0088] Specifically, if Figure 4 As shown, the electronic device determines the node h n The electronic device checks whether the prerequisite information (Pre) in the attack pattern vector matches the Vars information and updates the association between the consequence information of the previous node and the prerequisite information of the current node. If a match occurs, the electronic device generates a directed edge in the complete attack graph based on the attack pattern vector in the vulnerability attack pattern knowledge base. This directed edge describes the attack pattern and the vulnerability with the highest attack probability, which is determined by the Vars information in the attack pattern vector.
[0089] Step S24: Generate the complete attack graph according to all attack graph elements.
[0090] Furthermore, the electronic device determines whether the connected host list of the node is empty. If not, the electronic device determines whether the connected host lists of all nodes are marked. If all are marked, a final complete attack graph is generated.
[0091] The hybrid mode attack graph generation method of attack graph modeling analysis in this application uses a network model of key attributes such as host vulnerability and network connectivity, and performs complete attack graph modeling. It adopts a precise reasoning graph search algorithm strategy to draw a set of all possible attack paths, thus ensuring the accuracy of the final result.
[0092] This application belongs to an attribute attack graph. Since the attack graph has been proven to be complete and retains all possible attack paths and removes duplicate paths, traversal analysis can easily list all paths to a specific target without causing path loss. Moreover, since it is not a state attack graph, there is no state combination explosion problem.
[0093] In the process of generating the attack graph, for the sake of completeness, this application allows the appearance of "circles" in the attack graph. To prevent entering an infinite loop, a marking method is used to break the loop; the improved backtracking attack graph generation algorithm is based on depth-first search, which can ensure that each attack path is independent and does not interfere with each other; in the improved backtracking attack graph generation algorithm, each attack path indicates the attack mode and the vulnerability with the greatest possibility of attack; the improved backtracking attack graph generation algorithm selectively updates the cause and consequence information each time a directed edge is generated, so as to be as close to the actual situation as possible.
[0094] In order to implement the method for constructing a vulnerability attack pattern knowledge base and / or the method for generating a complete attack graph of the above embodiment, this application also provides an electronic device. Figure 5 , Figure 5 It is a structural diagram of an embodiment of an electronic device provided by this application.
[0095] like Figure 5 As shown, the electronic device 600 of this embodiment includes a processor 61 , a memory 62 , an input / output device 63 , and a bus 64 .
[0096] The processor 61 , the memory 62 , and the input / output device 63 are respectively connected to a bus 64 . The memory 62 stores a computer program, and the processor 61 is used to execute the computer program to implement the target recognition method of the above embodiment.
[0097] In this embodiment, the processor 61 may also be referred to as a CPU (Central Processing Unit). The processor 61 may be an integrated circuit chip with signal processing capabilities. The processor 61 may also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The processor 61 may also be a GPU (Graphics Processing Unit), also known as a display core, visual processor, or display chip. This is a microprocessor specifically designed for image processing on computers, workstations, game consoles, and some mobile devices (such as tablets and smartphones). The purpose of a GPU is to convert and drive the display information required by the computer system and provide horizontal scanning signals to the display to control the correct display of the display. It is a key component connecting the display to the computer motherboard. A graphics card, as a key component of a computer host, is responsible for outputting display graphics. A general-purpose processor may be a microprocessor, or the processor 61 may be any conventional processor.
[0098] This application also provides a computer storage medium, such as Figure 6 As shown, the computer storage medium 700 is used to store a computer program 71. When the computer program 71 is executed by the processor, it is used to implement the method for constructing a vulnerability attack pattern knowledge base and / or the method for generating a complete attack graph as described in the present application.
[0099] The methods involved in the embodiments of the present application, when implemented in the form of software functional units and sold or used as independent products, can be stored in a device, such as a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.
[0100] The above description is only an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present invention, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. A method for constructing a vulnerability attack pattern knowledge base, characterized in that: The construction method comprises: Build a network topology diagram based on surviving hosts; Acquire a single-host vulnerability database of each host in the network topology diagram, wherein the single-host vulnerability database includes feature description information of each vulnerability entry; Merging the single-host vulnerability databases of all hosts in the network topology diagram into a global vulnerability database, wherein the vulnerability information vector of the global vulnerability database includes feature description information of all vulnerability entries; Based on the vulnerability information vector, attack pattern classification and identification are performed on vulnerability entries in the global vulnerability database to generate a vulnerability attack pattern knowledge base.
2. The construction method according to claim 1, characterized in that: The step of classifying and identifying attack patterns of vulnerability entries in the global vulnerability database based on the vulnerability information vector to generate a vulnerability attack pattern knowledge base includes: Analyze the vulnerability attack mode corresponding to each vulnerability entry based on the feature description information of the vulnerability information vector; Get a list of vulnerability sets that satisfy each vulnerability attack mode; Obtaining the exploitation premise and exploitation consequence of each vulnerability entry in the vulnerability set list; Constructing a vulnerability attack pattern vector based on the vulnerability attack pattern, the vulnerability set list, the exploitation premise, and the exploitation consequence; Based on the vulnerability attack pattern vector, attack pattern classification and identification are performed on vulnerability entries in the global vulnerability database to generate a vulnerability attack pattern knowledge base.
3. The construction method according to claim 2, characterized in that: The obtaining of the exploitation premise and exploitation consequence of each vulnerability entry in the vulnerability set list includes: Analyze the configuration environment and usage conditions of each vulnerability entry to extract candidate exploitation prerequisites and candidate exploitation consequences of the vulnerability entry; Determine whether the candidate utilization premise and the candidate utilization consequence exist or are related; If so, the OR relationship between the candidate utilization premise and the candidate utilization consequence is decomposed and refined until the obtained utilization premise and utilization consequence do not have an OR relationship, and the utilization premise is stored in a utilization premise set, and the utilization consequence is stored in a utilization consequence set.
4. The construction method according to claim 1, characterized in that: The construction method also includes: Extracting text segmentation of each vulnerability entry in the single-host vulnerability database using natural language processing; Performing part-of-speech tagging on the text segmentation; Based on the part-of-speech tagging results of all text segmentations, the semantic connections of the text segmentations of each vulnerability entry are analyzed to generate feature description information of each vulnerability entry.
5. The construction method according to claim 1, characterized in that: The obtaining of a single host vulnerability database of each host in the network topology diagram includes: Obtaining a dynamic vulnerability list and a static vulnerability list of each host; The dynamic vulnerability list and the static vulnerability list are merged, and duplicate vulnerability entries are removed to generate a single host vulnerability database for each host.
6. A method for generating a complete attack graph, characterized in that: The generation method comprises: Obtaining a vulnerability attack pattern knowledge base through the construction method described in any one of claims 1 to 5; Initializing an attacker's initial node set based on the vulnerability attack pattern knowledge base; Traversing each unmarked node in the initial node combination to obtain a list of connected hosts; Traversing each unmarked node in the connected host list to generate an attack graph element; The complete attack graph is generated according to all attack graph elements.
7. The generation method according to claim 6, characterized in that: The attack graph elements include directed edges of the attack graph; The traversing each unmarked node in the connected host list to generate an attack graph element includes: Acquire an attack pattern vector of each unmarked node based on the vulnerability attack pattern knowledge base; Determining whether the precondition in the attack pattern vector matches the variable information; If so, generate directed edges of an attack graph according to the attack pattern vector.
8. The generation method according to claim 7, characterized in that: The directed edges of the attack graph are used to represent attack patterns and vulnerabilities with the greatest attack probability, wherein the attack probability is determined by variable information of the attack pattern vector.
9. An electronic device, characterized in that: The electronic device includes a memory and a processor coupled to the memory; The memory is used to store program data, and the processor is used to execute the program data to implement the construction method and / or generation method as described in any one of claims 1 to 8.
10. A computer storage medium, characterized in that: The computer storage medium is used to store program data, and when the program data is executed by a computer, it is used to implement the construction method and / or generation method as described in any one of claims 1 to 8.