Industrial control intrusion detection method and system based on ATTCK framework

Abstract

The embodiment of the invention provides a method and a device based on ATTamp; the invention discloses an industrial control intrusion detection method and system of a CK framework, and belongs to the technical field of intrusion detection. The method comprises the following steps: collecting and standardizing required related data, and reproducing each attack technology to generate an initial attack detection rule; comparing the attack event information with an initial attack detection rule, and identifying an attack behavior; identifying false-report and / or missing-report attack behaviors as optimization attack behavior targets, and executing iterative optimization attack detection rules on each optimization attack behavior target to obtain an optimization attack behavior set; and constructing a knowledge graph based on the optimized attack behavior set and the corresponding attack event information, and executing intrusion real-time monitoring based on the knowledge graph. According to the scheme of the invention, automatic attack behavior detection and optimization are realized, the defense capability for the intrusion attack of the industrial control system is greatly improved, and meanwhile, through continuous iterative optimization, the accuracy and real-time performance of attack detection are ensured.

Description

Technical Field

[0001] The present invention relates to the field of intrusion detection technology, and in particular to an industrial control intrusion detection method based on the ATT&CK framework and an industrial control intrusion detection system based on the ATT&CK framework. Background Art

[0002] The existing ATT&CK framework provides a common language and knowledge graph for describing intrusion behaviors. By recording attackers' tactics and techniques based on real-life attack events, it has developed into a full-lifecycle behavior analysis model covering enterprise intranets, mobile environments, multiple platforms, and multiple sources of data. This framework is of great significance for understanding attacker behavior and formulating mitigation measures. However, in the application of industrial control systems (ICS), existing solutions have the following problems:

[0003] 1) Although the ATT&CK framework has been extended to the industrial control field and introduced a specific tactical and technical matrix, it mainly focuses on the classification and description of attack techniques and lacks a systematic analysis of the entire intrusion attack life cycle. Industrial control systems have different structural and operational characteristics from traditional IT systems. In particular, their high requirements for security and stability make it particularly important to have a deep understanding of each link in the attack chain. The existing ATT&CK framework cannot fully meet the complex defense needs of industrial control systems.

[0004] 2) Although the mid-level abstract model used in the ATT&CK framework can effectively link attack behaviors with defense measures, it is still insufficient for real-time response to intrusion attacks in industrial control systems. In industrial control systems, attacks are more destructive, and attackers may directly access the control panel through the Internet, threatening the security of national critical infrastructure. However, the existing framework does not provide enough fine-grained analysis, making it difficult to accurately identify the connection between continuous attack behaviors and the attack targets behind them.

[0005] 3) The increasingly close connection between industrial control systems and corporate office networks and the Internet has further increased their risk of being exposed to external attacks. Although existing security protection technologies, such as vulnerability scanning, encryption authentication, access control, and intrusion detection, can guarantee the security of industrial control systems to a certain extent, it is difficult for existing technologies to achieve accurate and efficient detection and defense when faced with new and highly complex attack methods.

[0006] Therefore, for the network security protection of industrial control systems, a more comprehensive attack behavior knowledge base is urgently needed to achieve comprehensive and accurate industrial control intrusion detection. Summary of the invention

[0007] The purpose of the embodiments of the present invention is to provide an industrial control intrusion detection method and system based on the ATT&CK framework, so as to at least solve the problem of low accuracy and comprehensiveness of industrial control intrusion detection caused by the current lack of a more comprehensive attack behavior knowledge base.

[0008] In order to achieve the above-mentioned objectives, the first aspect of the present invention provides an industrial control intrusion detection method based on the ATT&CK framework, the method comprising: selecting attack technology based on the ATT&CK framework, collecting and standardizing the required relevant data, and reproducing each attack technology based on the collected relevant data to generate an initial attack detection rule; based on the predefined rules and the relevant data, collecting attack event information in real time, and comparing the attack event information with the initial attack detection rules to identify attack behaviors; based on the identification results, identifying false positives and / or missed negatives as optimized attack behavior targets, and iteratively optimizing attack detection rules for each optimized attack behavior target until there are no false positives and / or missed negatives, and obtaining an optimized attack behavior set; constructing a knowledge graph based on the optimized attack behavior set and the corresponding attack event information, and performing real-time intrusion monitoring based on the knowledge graph.

[0009] Optionally, the method selects attack technology based on the ATT&CK framework, collects and standardizes the required relevant data, including: based on the selected attack technology, determining the data component and data source corresponding to the attack technology; based on the data source of the determined data component, performing corresponding data component and data source extraction, and constructing a corresponding data component set and data source set; performing standardization processing on the data component set and data source set based on a predetermined data format to obtain the data component set and data source set in a standard format; performing relevant data collection based on the data component set and data source set in the standard format, and correspondingly performing standardization of the collected data to obtain the required relevant data.

[0010] Optionally, based on the collected relevant data, each attack technique is reproduced to generate initial attack detection rules, including: traversing all selected attack techniques, reproducing each attack technique based on a pre-built script or attack tool, and collecting process data during the reproduction process; after each reproduction is completed, collecting the reproduction result information of the corresponding attack technology; based on the process data and the corresponding reproduction result information, constructing the detection rules of the corresponding attack technology as the initial attack detection rules of the corresponding attack technology.

[0011] Optionally, the attack event information is compared with the initial attack detection rules to identify the attack behavior, including: standardizing the attack event information collected in real time to obtain standardized attack event information; comparing the standardized attack event information with the initial attack detection rules to determine whether there is a corresponding matching relationship; and identifying the attack behavior based on the matching relationship determination result. If there is no matching relationship, the corresponding attack behavior is determined to be a missed attack behavior; if there is a matching relationship, it is determined whether the matched attack behavior is a correct attack behavior, and if so, it is determined to be a correctly identified attack behavior, and if not, it is determined to be a falsely reported attack behavior.

[0012] Optionally, based on the recognition result, identifying false positives and / or missed positives as the target of optimizing the attack behavior includes: if there is no matching relationship, determining the corresponding attack behavior to be a missed positive attack behavior; if there is a matching relationship, determining whether the matched attack behavior is a correct attack behavior; if so, determining it to be a correctly identified attack behavior; if not, determining it to be a false positive attack behavior.

[0013] Optionally, the iterative optimization of attack detection rules for each optimized attack behavior target includes: S1) for each optimized attack behavior target, feature extraction is performed based on statistics and / or machine learning algorithms, and improved model training is performed based on the extracted features; S2) based on the improved model training, detection rule updates are performed for attack techniques corresponding to the optimized attack behavior target, and corresponding optimized attack behavior target detection is re-established based on the updated detection rules; steps S1) to S2) are repeated until the corresponding optimized attack behavior target is not identified as false and / or missed.

[0014] Optionally, the construction of a knowledge graph based on the optimized attack behavior set and the corresponding attack event information includes: constructing an attack behavior attack chain based on the attack event information of each attack behavior in the optimized attack behavior set and the initial attack detection rules; constructing an attack knowledge graph and a network knowledge graph based on the supply chain respectively; wherein the attack knowledge graph is used to record the attack behavior of a single host; the network knowledge graph is used for cross-host correlation analysis, reflecting the connection and interaction between network entities in real time, so as to identify lateral movement and the attack relationship between different hosts in the network.

[0015] Optionally, the real-time intrusion monitoring based on the knowledge graph includes: collecting event information of the target monitoring system in real time, analyzing the event information based on the knowledge graph to determine whether it is an attack behavior; if it is an attack behavior, identifying the attack behavior type based on the knowledge graph, and pushing the identification result to the monitoring end.

[0016] The second aspect of the present invention provides an industrial control intrusion detection system based on the ATT&CK framework, the system comprising: a collection unit, used to select attack technology based on the ATT&CK framework, collect and standardize the required relevant data, and reproduce each attack technology based on the collected relevant data to generate an initial attack detection rule; an identification unit, used to collect attack event information in real time based on predefined rules and the relevant data, and compare the attack event information with the initial attack detection rules to identify attack behavior; an optimization unit, used to identify false positive and / or missed negative attack behaviors based on the identification results as optimized attack behavior targets, and iteratively optimize the attack detection rules for each optimized attack behavior target until there are no false positive and / or missed negative attack behaviors, and obtain an optimized attack behavior set; a monitoring unit, used to construct a knowledge graph based on the optimized attack behavior set and the corresponding attack event information, and perform real-time intrusion monitoring based on the knowledge graph.

[0017] On the other hand, the present invention provides a computer-readable storage medium, which stores instructions, which, when executed on a computer, enable the computer to execute the above-mentioned industrial control intrusion detection method based on the ATT&CK framework.

[0018] Through the above technical scheme, the scheme of the present invention selects attack technology based on the ATT&CK framework, standardizes and collects relevant data, and reproduces the attack technology to generate initial attack detection rules, thereby realizing accurate identification of intrusion behavior. By comparing the attack event information collected in real time with the initial attack detection rules generated in advance, the attack behavior can be effectively identified to ensure the accuracy of detection. In addition, through the identification and optimization of false positives and false negatives, the system can iteratively improve the attack detection capability, reduce false positives and false negatives, and finally obtain an optimized set of attack behaviors. Based on these optimization results, the constructed knowledge graph can comprehensively display the attack behavior and its association, and provide effective support for real-time monitoring of intrusion. This scheme realizes automated attack behavior detection and optimization, greatly improves the defense capability against intrusion attacks on industrial control systems, and at the same time ensures the accuracy and real-time nature of attack detection through continuous iterative optimization.

[0019] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0021] Figure 1It is a flowchart of the steps of an industrial control intrusion detection method based on the ATT&CK framework provided by an embodiment of the present invention;

[0022] Figure 2 It is a schematic diagram of an attack knowledge graph provided by an embodiment of the present invention;

[0023] Figure 3 It is a schematic diagram of a network knowledge graph provided by an embodiment of the present invention;

[0024] Figure 4 It is a system structure diagram of an industrial control intrusion detection system based on the ATT&CK framework provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The specific implementation of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the present invention, and is not used to limit the present invention.

[0026] Figure 1 This is a method flow chart of an industrial control intrusion detection method based on the ATT&CK framework provided by an embodiment of the present invention. Figure 1 As shown, an embodiment of the present invention provides an industrial control intrusion detection method based on the ATT&CK framework, and the method includes:

[0027] Step S10: Select attack techniques based on the ATT&CK framework, collect and standardize the required relevant data, and reproduce each attack technique based on the collected relevant data to generate initial attack detection rules.

[0028] Specifically, based on the selected attack technology, the data components and data sources corresponding to the attack technology are determined; based on the data sources of the determined data components, the corresponding data components and data sources are extracted to construct the corresponding data component sets and data source sets; based on the predetermined data format, the data component sets and data source sets are standardized to obtain the data component sets and data source sets in the standard format; based on the data component sets and data source sets in the standard format, relevant data are collected, and the collected data are standardized accordingly to obtain the required relevant data.

[0029] In an embodiment of the present invention, through in-depth analysis of each attack technology, the specific data sources and the formats of the required data that it relies on in the actual detection process are determined. For example, different attack technologies may rely on multiple data sources such as network traffic, file system activities, or terminal logs. In order to ensure the accuracy and comprehensiveness of attack detection, a corresponding data component set and data source set must be constructed for each attack technology. On this basis, an extraction operation is performed for the determined data components and data sources to construct a complete data component set and data source set. This step ensures that each attack technology can obtain comprehensive supporting data under different operating environments, providing a solid data foundation for subsequent attack behavior detection.

[0030] Furthermore, by standardizing the data component set and data source set, data from different sources are uniformly converted into a predetermined standard data format. Standardization can not only eliminate the differences between different data sources, but also ensure that the data can be used and processed consistently during the detection process. This provides a good foundation for the efficient detection of attack technologies. With the support of standardized data, the system can perform further data collection operations based on the standardized component set and data source set. After the collected data has been standardized, it is ensured that they can be directly used in actual attack detection. This process greatly improves the efficiency and accuracy of data processing, reduces the generation of errors and redundant data, and thus provides timely and accurate data support for real-time intrusion detection.

[0031] Furthermore, based on the collected relevant data, each attack technique is reproduced to generate an initial attack detection rule, including: traversing all selected attack techniques, reproducing each attack technique based on a pre-built script or attack tool, and collecting process data during the reproduction process; after each reproduction is completed, collecting the reproduction result information of the corresponding attack technique; based on the process data and the corresponding reproduction result information, constructing the detection rule of the corresponding attack technique as the initial attack detection rule of the corresponding attack technique.

[0032] In an embodiment of the present invention, all selected attack techniques are traversed, and each attack technique is reproduced based on a pre-built script or attack tool. In this process, the attack tool simulates the attack behavior in the real world, involving multiple attack stages from initial access to lateral movement, privilege escalation, etc. The reproduction of each attack technique follows the tactics and techniques defined in the ATT&CK framework, so that it can cover different stages of the attack chain. During the reproduction process, the system will collect all relevant process data in real time, including every link of the attack execution, the system response log, and the output information of the attack tool.

[0033] Furthermore, after each attack technique is reproduced, the corresponding attack technique reproduction result information will be further collected, including whether the attack is successful, the specific manifestation of the attack behavior, the reaction of the target system, etc. This data not only helps to confirm the effectiveness of the reproduction, but also provides an important basis for subsequent attack behavior analysis. By collecting detailed data during the reproduction process, the system can ensure that all possible attack paths and variants are covered, thereby generating a comprehensive record of attack behavior.

[0034] Furthermore, based on the above process data and reproduction result information, detection rules for each attack technology will be constructed. These rules are designed based on the actual reproduced attack behavior and its system response, and can effectively capture the characteristics of specific attack technologies. In the process of rule construction, the system will consider the diversity of attack technologies and their impact on different systems to ensure that the rules are not only applicable to a single scenario, but can also be widely used for attack detection in different environments. These detection rules will serve as the initial attack detection rules and become an important basis for subsequent intrusion detection and attack behavior analysis.

[0035] Based on the solution of the present invention, actual process data and detection rules are generated by reproducing various attack techniques, thereby achieving an in-depth understanding and efficient detection of attack behaviors. Compared with traditional signature-based detection methods, this method is more dynamic and flexible because it can cope with complex and changing attack techniques, especially complex attacks such as advanced persistent threats (APTs). Through detailed analysis of process data, the system can not only improve the accuracy of attack detection, but also reduce the probability of missed reports and false alarms. Ultimately, this reproduction method based on process data greatly enhances the ability of intrusion detection systems to cope with complex attack scenarios, and provides stronger support for the security protection of critical infrastructure such as industrial control systems.

[0036] Step S20: Collect attack event information in real time, and compare the attack event information with the initial attack detection rules to identify attack behaviors.

[0037] Specifically, the attack event information is compared with the initial attack detection rules to identify the attack behavior, including: standardizing the attack event information collected in real time to obtain standardized attack event information; comparing the standardized attack event information with the initial attack detection rules to determine whether there is a corresponding matching relationship; identifying the attack behavior based on the matching relationship determination result. If there is no matching relationship, the corresponding attack behavior is determined to be a missed attack behavior; if there is a matching relationship, it is determined whether the matched attack behavior is a correct attack behavior, if so, it is determined to be a correctly identified attack behavior, if not, it is determined to be a falsely reported attack behavior.

[0038] In the embodiment of the present invention, the collected attack event information is standardized and the raw data is uniformly formatted into standardized attack event information for subsequent analysis and comparison operations. Standardization ensures that heterogeneous data from different data sources are processed in the same format, thereby improving the accuracy and efficiency of detection.

[0039] Furthermore, the standardized attack event information is compared with the pre-set initial attack detection rules. The attack detection rules are designed based on the attack technology reproduction process in the ATT&CK framework, covering the characteristics and specific manifestations of attack behaviors. By comparing the standardized attack event information and the detection rules, the system determines whether there is a match between the two. If there is a match, it means that the attack behavior may have been detected, and the system will further determine whether the matched attack behavior is the correct attack behavior. If it is correct, it means that the system has successfully identified the attack behavior; if it is not a correct match, it means that the detection result is a false positive, and the system needs to be adjusted and optimized.

[0040] On the contrary, if no matching relationship is detected, it means that the attack behavior has not been identified by the existing detection rules, and the system will judge it as a missed attack behavior. In this case, the system needs to update the detection rules according to the actual situation to avoid similar missed situations in the future.

[0041] Based on the solution of the present invention, it is not only possible to identify attack behaviors in real time, but also to continuously optimize attack detection rules during the detection process, thereby reducing the missed alarm rate and false alarm rate. The effect of this technical solution is that it uses real-time data and standardized processing, combined with initial detection rules, to quickly and efficiently identify attack behaviors. At the same time, through the dynamic adjustment and optimization of missed alarms and false alarms, the system realizes the iterative update of attack detection rules, making attack behavior detection more accurate and comprehensive, especially showing higher robustness when dealing with complex and diverse attack scenarios.

[0042] Step S30: Based on the recognition result, identify the attack behaviors with false positives and / or missed negatives as the optimized attack behavior targets, and iteratively optimize the attack detection rules for each optimized attack behavior target until there are no false positives and / or missed negatives, and obtain the optimized attack behavior set.

[0043] Specifically, based on the recognition result, identifying the false positive and / or missed negative attack behaviors as the target of optimizing the attack behaviors includes: if there is no matching relationship, determining the corresponding attack behavior as missed negative attack behavior; if there is a matching relationship, judging whether the matched attack behavior is the correct attack behavior, if so, determining it as the correctly identified attack behavior, if not, determining it as the false positive attack behavior.

[0044] In an embodiment of the present invention, during the process of real-time collection and analysis of attack event information, if there is no matching relationship with the detection rules, the attack behavior is identified as a missed attack behavior, indicating that the existing detection rules fail to effectively cover the attack scenario. Conversely, if there is a matching relationship, the system will further determine whether the matched attack behavior is a correctly identified attack behavior. If it is correctly identified, it means that the detection result is accurate; if not, it means that the detection is a false alarm, and the system needs to adjust it. For missed behaviors, the rules will be expanded according to the actual detection situation to cover more potential attack modes; for false alarm behaviors, the detection rules will be adjusted to avoid misjudgment of non-attack behaviors. This iterative optimization process significantly reduces the false alarm rate and missed alarm rate in attack detection, ensuring that complex attack behaviors can be identified and responded to more accurately.

[0045] Preferably, the iterative optimization of attack detection rules for each optimized attack behavior target includes: S1) for each optimized attack behavior target, feature extraction is performed based on statistics and / or machine learning algorithms, and improved model training is performed based on the extracted features; S2) based on the improved model training, detection rule updates are performed for attack techniques corresponding to the optimized attack behavior target, and corresponding optimized attack behavior target detection is re-established based on the updated detection rules; steps S1) to S2) are repeated until the corresponding optimized attack behavior target is not identified as false and / or missed.

[0046] In an embodiment of the present invention, for each identified optimized attack behavior target, feature extraction is performed based on statistical methods or machine learning algorithms. This process can identify key features in the attack behavior, such as traffic patterns, system call sequences, or file activity features. These features, as identifiers of attack behaviors, will be used to improve existing detection models. After feature extraction, based on these extracted features, the improved model is trained to improve the ability to identify related attack technologies. By continuously introducing new attack features, the model can be gradually optimized and show higher sensitivity to different attack patterns.

[0047] Furthermore, based on the improved model, the detection rules related to the corresponding attack technology are updated. The updated rules are based on the new features and model training results, and can more effectively capture previously undetected or misjudged attack behaviors. At the same time, the system will re-execute the detection of the attack behavior target based on the new detection rules to ensure that the detection rules can successfully identify the corresponding attack behavior in practical applications. This optimization process is iterative, and the system will continuously repeat steps S1) and S2). Each iteration will further optimize the rules through new feature extraction and model updates until the detection system can stably identify the corresponding attack behavior target and no longer have false positives or negatives. This iterative process not only improves the detection accuracy of the system, but also can dynamically adapt to new attack patterns and changing network environments, thereby ensuring that the detection rules are always kept in the best state.

[0048] Based on the scheme of the present invention, the detection rules are automatically optimized through statistical and machine learning techniques, thereby improving the adaptive ability of the system. Each iteration will significantly reduce the number of false positives and false negatives, making the identification of attack behaviors more accurate. At the same time, this iterative optimization process can also continuously enhance the ability to respond to new attack methods, especially when facing complex industrial control system attacks, and can effectively respond to changing attack behaviors. This self-improvement mechanism provides the attack detection system with greater robustness and flexibility, ensuring the security of the industrial control system.

[0049] Step S40: construct a knowledge graph based on the optimized attack behavior set and the corresponding attack event information, and perform real-time intrusion monitoring based on the knowledge graph.

[0050] Specifically, the construction of a knowledge graph based on an optimized attack behavior set and corresponding attack event information includes: constructing an attack behavior attack chain based on the attack event information of each attack behavior in the optimized attack behavior set and the initial attack detection rules; constructing an attack knowledge graph and a network knowledge graph based on the supply chain respectively; wherein the attack knowledge graph is used to record the attack behavior of a single host; the network knowledge graph is used for cross-host correlation analysis, reflecting the connection and interaction between network entities in real time, so as to identify lateral movement and the attack relationship between different hosts in the network.

[0051] Furthermore, based on the attack behaviors and their associated attack event information in the optimized attack behavior set, combined with the initial attack detection rules, the attack chain of each attack behavior is constructed. The attack chain is constructed by sorting out the time series, behavior characteristics and roles of each attack behavior in the attack process, and clarifying the position and role of each behavior in the attack chain. This attack chain is not limited to the analysis of a single event, but can trace the complete attack path through a series of attack behaviors, thereby revealing the attacker's behavior patterns and strategies.

[0052] Based on these attack chains, we will build the attack knowledge graph and network knowledge graph respectively. Figure 2 , the attack knowledge graph focuses on the attack behavior records of a single host, focusing on describing the attack process experienced by each host, including the technology, methods and attack stages of each attack. It provides a detailed reference for the protection of a single host, helping the system understand how attackers use specific vulnerabilities or technical means to penetrate a single target. Through this in-depth analysis of a single host, the attack knowledge graph can provide a specific basis for the improvement of defense strategies, especially in preventing the recurrence of the same type of attack behavior.

[0053] like Figure 3 The network knowledge graph is used for cross-host association analysis, reflecting the connection and interaction between various entities in the network in real time. It describes the connection status between hosts and between hosts and network resources, analyzes how attackers achieve lateral movement in the network, and how to expand the attack through communication and resource sharing between different hosts. The network knowledge graph can reveal how attackers exploit vulnerabilities in the network topology to spread attacks from one host to other hosts, and identify the attack relationships between hosts. Through this cross-host analysis, the system can more effectively identify complex behavior patterns in network attacks, such as lateral movement and backdoor implantation.

[0054] Based on the solution of the present invention, by constructing an attack knowledge graph and a network knowledge graph, it is possible to achieve a comprehensive understanding of attack behaviors and optimize defense strategies. The attack knowledge graph can help identify and record the attack process of a single host, thereby optimizing the protection strategy for a single target; the network knowledge graph can reveal the complex interactive relationships between hosts in the network, help identify attack paths between multiple hosts, and especially play a key role in detecting and preventing lateral movement attacks. The combination of these two knowledge graphs enables the system to comprehensively analyze attack behaviors at multiple levels and provide more accurate and timely defense response solutions.

[0055] Preferably, the real-time intrusion monitoring based on the knowledge graph includes: real-time collection of event information of the target monitoring system, analysis of the event information based on the knowledge graph, and determination of whether it is an attack behavior; if it is an attack behavior, identification of the attack behavior type based on the knowledge graph, and pushing the identification result to the monitoring terminal.

[0056] In an embodiment of the present invention, event information of the target monitoring system is collected in real time, and the event information may include multiple data sources such as network traffic, system logs, and process activities. Through the real-time collection of these data, it is possible to ensure timely monitoring of abnormal behaviors that may exist in the system. Then, the event information is analyzed using a pre-built knowledge graph. The knowledge graph integrates a wealth of industrial control system (ICS) attack behavior characteristics, vulnerability information, and related attack chain knowledge. By matching and analyzing with existing attack patterns in the knowledge graph, it is possible to quickly determine whether the collected event information belongs to an attack behavior. If the judgment result shows an attack behavior, the system will further identify the specific type of the attack behavior based on the knowledge graph, and identify what kind of attack method it is, such as a denial of service attack, malicious code implantation, etc. Finally, the system will push the identification results to the monitoring end for the security administrator to respond and process.

[0057] Figure 4 : is a system structure diagram of an industrial control intrusion detection system based on the ATT&CK framework provided by an embodiment of the present invention. Figure 4 As shown, an embodiment of the present invention provides an industrial control intrusion detection system based on the ATT&CK framework, and the system includes: a collection unit, which is used to select attack technology based on the ATT&CK framework, collect and standardize the required relevant data, and reproduce each attack technology based on the collected relevant data to generate an initial attack detection rule; an identification unit, which is used to collect attack event information in real time, and compare the attack event information with the initial attack detection rule to identify the attack behavior; an optimization unit, which is used to identify false positive and / or missed negative attack behaviors based on the identification results as optimized attack behavior targets, and iteratively optimize the attack detection rules for each optimized attack behavior target until there are no false positive and / or missed negative attack behaviors, and obtain an optimized attack behavior set; a monitoring unit, which is used to construct a knowledge graph based on the optimized attack behavior set and the corresponding attack event information, and perform real-time intrusion monitoring based on the knowledge graph.

[0058] An embodiment of the present invention also provides a computer-readable storage medium, which stores instructions, which, when executed on a computer, enable the computer to execute the above-mentioned industrial control intrusion detection method based on the ATT&CK framework.

[0059] Those skilled in the art will understand that all or part of the steps in the method for implementing the above-mentioned embodiments can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions for making a single-chip microcomputer, a chip or a processor (processor) perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0060] The optional embodiments of the present invention are described in detail above in conjunction with the accompanying drawings. However, the embodiments of the present invention are not limited to the specific details in the above embodiments. Within the technical concept of the embodiments of the present invention, the technical scheme of the embodiments of the present invention can be subjected to a variety of simple modifications, and these simple modifications all belong to the protection scope of the embodiments of the present invention. It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the embodiments of the present invention will not further describe various possible combinations.

[0061] In addition, various embodiments of the present invention may be arbitrarily combined, and as long as they do not violate the concept of the embodiments of the present invention, they should also be regarded as the contents disclosed in the embodiments of the present invention.

Claims

1. An industrial control intrusion detection method based on the ATT&CK framework, characterized in that: The method comprises: Select attack techniques based on the ATT&CK framework, collect and standardize the required relevant data, and reproduce each attack technique based on the collected relevant data to generate initial attack detection rules; Collect attack event information in real time, and compare the attack event information with the initial attack detection rules to identify attack behaviors; Based on the recognition results, identify the attack behaviors of false positives and / or missed negatives as the optimized attack behavior targets, and iteratively optimize the attack detection rules for each optimized attack behavior target until there are no false positives and / or missed negatives, thereby obtaining an optimized attack behavior set; A knowledge graph is constructed based on the optimized attack behavior set and the corresponding attack event information, and real-time intrusion monitoring is performed based on the knowledge graph.

2. The method according to claim 1, characterized in that The attack technology is selected based on the ATT&CK framework, and the required relevant data is collected and standardized, including: Based on the selected attack technology, determine the data components and data sources corresponding to the attack technology; Based on the data source of the determined data component, extract the corresponding data component and data source, and construct the corresponding data component set and data source set; Performing standardization processing on a data component set and a data source set based on a predetermined data format to obtain a data component set and a data source set in a standard format; Based on the data component set and data source set in the standard format, relevant data collection is carried out, and the collected data is standardized accordingly to obtain the required relevant data.

3. The method according to claim 1, characterized in that Based on the collected relevant data, each attack technique is reproduced to generate initial attack detection rules, including: Traverse all selected attack techniques, reproduce each attack technique based on pre-built scripts or attack tools, and collect process data during the reproduction process; After each reproduction is completed, collect the reproduction result information of the corresponding attack technology; Based on the process data and the corresponding reproduction result information, a detection rule corresponding to the attack technology is constructed as an initial attack detection rule corresponding to the attack technology.

4. The method according to claim 1, characterized in that: The step of comparing the attack event information with the initial attack detection rules to identify the attack behavior includes: Standardize the attack event information collected in real time to obtain standardized attack event information; Compare the standardized attack event information with the initial attack detection rules to determine whether there is a corresponding matching relationship; Identify attack behaviors based on matching relationship determination results. If there is no matching relationship, the corresponding attack behavior is determined to be a missed attack behavior; If there is a matching relationship, it is determined whether the matched attack behavior is a correct attack behavior. If so, it is determined to be a correctly identified attack behavior. If not, it is determined to be a false positive attack behavior.

5. The method according to claim 4, characterized in that The step of identifying false positives and / or false negatives of attack behaviors based on the recognition results as a target for optimizing the attack behaviors includes: If there is no matching relationship, the corresponding attack behavior is determined to be a missed attack behavior; If there is a matching relationship, it is determined whether the matched attack behavior is a correct attack behavior. If so, it is determined to be a correctly identified attack behavior. If not, it is determined to be a false positive attack behavior.

6. The method according to claim 1, characterized in that The iteratively optimizing attack detection rules for each optimized attack behavior target includes: S1) for each optimized attack behavior target, extracting features based on statistics and / or machine learning algorithms, and performing improved model training based on the extracted features; S2) based on the improved model training, executing the update of the detection rules of the attack technology corresponding to the optimized attack behavior target, and re-establishing the corresponding optimized attack behavior target detection based on the updated detection rules; Repeat step S1) to step S2) until the corresponding optimized attack behavior target is not identified as false and / or missed.

7. The method according to claim 1, characterized in that The construction of a knowledge graph based on the optimized attack behavior set and the corresponding attack event information includes: Construct an attack chain of attack behaviors based on the attack event information of each attack behavior in the optimized attack behavior set and the initial attack detection rules; Based on the supply chain, an attack knowledge graph and a network knowledge graph are constructed respectively; wherein, The attack knowledge graph is used to record the attack behavior of a single host; The network knowledge graph is used for cross-host association analysis, reflecting the connections and interactions between network entities in real time to identify lateral movement and attack relationships between different hosts in the network.

8. The method according to claim 1, characterized in that The performing real-time intrusion monitoring based on the knowledge graph includes: Collect event information of the target monitoring system in real time, analyze the event information based on the knowledge graph, and determine whether it is an attack behavior; If it is an attack behavior, the attack behavior type is identified based on the knowledge graph and the identification result is pushed to the monitoring end.

9. An industrial control intrusion detection system based on the ATT&CK framework, characterized in that: The system comprises: The collection unit is used to select attack techniques based on the ATT&CK framework, collect and standardize the required relevant data, and reproduce each attack technique based on the collected relevant data to generate initial attack detection rules; An identification unit, used to collect attack event information in real time, and compare the attack event information with the initial attack detection rules to identify the attack behavior; An optimization unit is used to identify false positive and / or false negative attack behaviors based on the recognition result as optimized attack behavior targets, and iteratively optimize the attack detection rules for each optimized attack behavior target until there are no false positive and / or false negative attack behaviors, thereby obtaining an optimized attack behavior set; The monitoring unit is used to construct a knowledge graph based on the optimized attack behavior set and the corresponding attack event information, and perform real-time intrusion monitoring based on the knowledge graph.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the industrial control intrusion detection method based on the ATT&CK framework as described in any one of claims 1-8.

Images