Control and defense graph decision-making method and system based on defined organization attack preference

Abstract

The invention discloses a control and defense graph decision-making method and system based on defined organization attack preferences, and the method comprises the steps: collecting attack information from a log server of a honey point, attributing and defining a behavior mode of an attack organization through the combined search of a threat intelligence knowledge graph and an external threat intelligence library, and determining the attack preference of the attack organization; the attack preferences of the attack organizations are sorted; from the perspective of attackers, an attack graph is generated through topological information, asset information and configuration information in a target network, mapping from defined organization attack preferences to attack graph nodes is carried out, a control and defense graph is generated, and a control and defense matrix used for quantitatively calculating the influence of attack mode preferences on the attack graph is generated; on the basis of analysis of a control and defense matrix of an attack graph on defined organization attack preferences, honey point services are generated emphatically, and decision support is provided for deployment of defense measures. According to the method, the honey point service type can be more flexibly, quickly and automatically generated, and manpower and time cost is greatly saved for analysis and deployment of deception defense.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a control and defense graph decision-making method and system based on defining an organization's attack preference. Background Art

[0002] With the continuous evolution of attack technology and the continuous changes in the cyberspace pattern, the network security environment has become highly confrontational, network attack campaigns have become sustainable, and network attack technology has become advanced and covert. Attackers are no longer the traditional ones with mischief and technology show-off, but have transformed into group-based profit-oriented and commercial attack organizations. Major advanced persistent threat (APT) attack incidents in recent years have shown that in the context of APT, traditional network security defense strategies have become increasingly powerless; traditional static security measures can no longer adapt to the flexible and highly changeable network security environment. How to respond to and adapt to these ever-changing threats in real time is a key research topic.

[0003] In order to supplement traditional security measures such as firewalls and more comprehensively monitor and analyze potential malicious activities, intrusion detection systems (IDS) monitor the traffic and behavior of networks or systems, analyze these data to identify possible intrusions, and issue alarms when potential malicious activities are detected. However, the problems of missed and false positives, efficient monitoring and analysis capabilities, and how to adapt to the constantly updated and upgraded attack technologies have always been the pain points of IDS systems. Currently, combining with threat intelligence to improve the ability to detect new and complex attacks is a major trend.

[0004] Honeypot / honeyspot-based systems use decoy technology to attract and analyze attackers' behaviors, collect information from the attacker's perspective, and influence attackers' perception by confusing the attack surface, thereby increasing the risk of being discovered and delaying the effect of the attack. However, maintaining static deployment and configuration gives attackers enough time to discover and infer its existence, especially highly interactive honeypots that interact with the real operating system environment, which may be used by attackers and become the hub of the attack system.

[0005] For adaptive security architecture, the emphasis is on a dynamic, real-time responsive security strategy that can automatically adjust defense mechanisms according to changes in threat situations. Companies that provide network security services usually implement adaptive security architectures with integrated solutions that cover multiple security products and functions, such as 360 and Green Alliance Technology. However, integrating multiple security technologies and measures may increase system complexity, thereby increasing the difficulty of management and maintenance.

[0006] In view of the above research results, the existing technology still has the following shortcomings:

[0007] (1) In order to facilitate the management of massive amounts of unstructured threat intelligence, building a knowledge graph for threat intelligence network security is currently the main way to store and manage knowledge, such as IBM X-Force Exchange, Green Alliance Threat Intelligence Center NTI, Weibu Intelligence Community, 360 Security Brain, Tianji Youmeng Threat Intelligence Center and Qi'anxin Threat Intelligence Center. These network security knowledge graphs provide a structured and queryable network security information framework. Although their application scenarios are diverse, the main function of these knowledge graphs currently focuses on using graph database technology to provide efficient query and display functions, and has not yet fully utilized the potential of graphs to conduct more in-depth data analysis and prediction to guide the security issues facing the current network environment.

[0008] (2) As an active defense technology, honeypots are designed to attract hacker attacks by imitating vulnerable systems, thereby protecting real network resources and collecting information about attackers. The fixed nature of honeypot deployment has become a major challenge for them to adapt to the rapidly evolving network environment and increasingly advanced attack methods. Since honeypot deployment usually requires manual settings and has specific configurations, it is unable to respond to changes in the network environment in a timely manner. Secondly, the fixed nature of this deployment is very easy to be identified by organized and experienced attackers, so that the ability to deceive attackers is lost, and there is a risk of being exploited by attackers.

[0009] (3) Honeypot-based generation technology solves the problems of fixed deployment and management complexity of honeypots. However, when faced with specific attack patterns or specific attackers, it is often necessary for experienced network security engineers to conduct in-depth analysis of the attack or the current network before deployment. This greatly increases labor costs and time costs. In addition, this method faces the problem of timeliness in real-world applications. Rapid changes in network environments and attack strategies mean that the effectiveness of honeypots may quickly decrease. If honeypots cannot be quickly updated and adjusted to respond to new threats, their value will be greatly reduced. Therefore, although honeypot-based technology provides more flexibility and adaptability for deception defense, there are still challenges in rapid response and cost reduction. Summary of the invention

[0010] The technical problem to be solved by the present invention is to provide a control and defense graph decision method based on defining the organization's attack preference in response to the above-mentioned deficiencies in the prior art, which can more flexibly and quickly automatically generate honey spot service types, greatly saving manpower and time costs for the analysis and deployment of deception defense.

[0011] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0012] A control and defense graph decision method based on defining an organization's attack preference comprises the following steps:

[0013] Step S1: Collect attack information from the log server of the honey spot, attribute and define the behavior pattern of the attack organization through the joint search of the threat intelligence knowledge graph and the external threat intelligence library, and sort the attack preferences of the attack organization;

[0014] Step S2: From the attacker's perspective, an attack graph is generated through the topology information, asset information, and configuration information in the target network, and a mapping of the organization's attack preferences to the attack graph nodes is defined to generate a control and defense graph, and then a control and defense matrix is ​​generated for quantitatively calculating the impact of the attack mode preference on the attack graph;

[0015] Step S3: Based on the control and defense matrix of the attack graph, the attack preference of the organization is analyzed, and honey spot services are generated with emphasis to provide decision support for the deployment of defense measures.

[0016] In the above-mentioned control and defense graph decision method based on defining the attack preference of an organization, when the behavior pattern of the attack organization is attributed and defined through the joint search of the threat intelligence knowledge graph and the external threat intelligence library in step S1, the specific process is as follows:

[0017] S101, pre-processing the unstructured original attack information data collected from the log server of the honey spot into structured attack information data;

[0018] S102, determine whether the attack information can be matched in the threat intelligence knowledge graph, and if it can be matched, extract the evaluation results of major security vendors; if it cannot be matched, transfer the IP address of the attack information and the associated file information to the VT sandbox;

[0019] S103, the VT sandbox retrieves the associated files in the VT library, makes an API call based on the hash value of the malicious sample in the extracted attack information, obtains the specific behavior information of the malicious sample and generates behavior preference data;

[0020] S104, exporting basic information of malicious samples, detailed information related to malicious samples, and attack organization IDs related to malicious samples from threat intelligence knowledge graph data;

[0021] S105, characterizing the malicious sample based on the basic information of the malicious sample and the detailed information related to the malicious sample, taking the attack organization ID related to the malicious sample as the prediction target, and constructing a training set;

[0022] S106. Characterize the malicious sample features and predict the attack organization ID as a defining organization.

[0023] In the above-mentioned control-defense graph decision method based on defining the attack preference of an organization, the specific process of sorting the attack preference of the attacking organization in step S1 is as follows:

[0024] Step S107, searching the threat intelligence knowledge graph to define the historical attack patterns of the organization;

[0025] Step S108: Form an attack preference matrix using the behavior information of the attack pattern.

[0026] In the above-mentioned control graph decision method based on defining the attack preference of an organization, when retrieving the historical attack pattern of the defined organization in the threat intelligence knowledge graph in step S107, Cypher statements are used.

[0027] In the above control and defense graph decision method based on defining the organization's attack preference, the MulVAL method is used to generate the attack graph from the attacker's perspective through the topology information, asset information, and configuration information in the target network. The specific process is as follows:

[0028] Step S201: Given the network topology and asset configuration information of the target network, obtain known vulnerability information according to the asset configuration information; and assume unknown vulnerability information;

[0029] Step S202: Determine the daily security strategy of the target system according to its task requirements;

[0030] Step S203: specify the node type of the attack graph to obtain the attack graph of the target network.

[0031] In the above-mentioned control and defense graph decision method based on defining the organization's attack preference, the specific process of mapping the defined organization's attack preference to the attack graph node, generating the control and defense graph, and then generating the control and defense matrix for quantitatively calculating the impact of the attack mode preference on the attack graph is as follows:

[0032] Step S204: Directed attack graph G on the target network a It is formally expressed as shown in formula (F1):

[0033] G a =(V a , E a , X a )=(A a , X a ) (F1)

[0034] Among them, V a = {v a1 , v a2 , ..., v an}, is the attack graph node set with n nodes; Xa ∈R n×d Represents the d-dimensional feature matrix of n nodes; E a represents a set of m edges, A a ∈{0,1} n×n is a binary adjacency matrix, as shown in formula (F2):

[0035]

[0036] Among them, the value of i is a natural number from 1 to n, the value of j is a natural number from 1 to n, and the element A in the i-th row and j-th column is ij As shown in formula (F2):

[0037]

[0038] Among them, the value of i is a natural number from 1 to n, the value of j is a natural number from 1 to n, and A ij Represents a directed attack graph G a Middle node v ai and node v aj The adjacency relationship between them;

[0039] Step S205: Use formula (F3) to quantify the impact of attack mode preference on the attack graph X c :

[0040] X c =X a wxya o T (F3)

[0041] Among them, the attack preference matrix X obtained by the attack preference ranking module for defining organizations based on threat intelligence is o ∈R l×k , l represents the attack mode preference, k represents the attack behavior; w is the behavior alignment weight matrix with m rows and k columns;

[0042] Step S206, generating a control graph;

[0043] Step S207: Generate a control-defense matrix from the attacker's perspective for quantitatively calculating the impact of the attack graph on the attack mode preference as shown in formula (F4):

[0044] G c = {V a , E a , X c} (F4).

[0045] In the above-mentioned control and defense graph decision method based on defining the attack preference of an organization, the control and defense matrix based on the attack graph in step S3 analyzes the attack preference of the defined organization, generates honey spot services with emphasis, and provides decision support for the deployment of defense measures. The specific process is as follows:

[0046] Step S301: Determine the threat impact of the organization's attack preference on the target system based on the self-defined target assessment. The specific process is as follows:

[0047] Step S3011: Given a target P, calculate p in the control graph according to formulas (F5) and (F6): ij Reachable:

[0048]

[0049] P(G c )=[p ij ] nxn =A 0 ∨A 1 ∨...∨A n-1 (F6)

[0050] Among them, A 0 is the nxn identity matrix, and ∨ is the disjunction operation used to find v ai to v aj Is there a path of length n-1?

[0051] When it is unreachable, modify the target P; when it is reachable, construct the target path according to the adjacency matrix in the control graph and add the necessary nodes on the path to form the path point set S ij ;

[0052] Step S3012, evaluate and define the threat node set of the organization's attack mode preference to the target path through the control matrix, such as formula (F7) and formula (F8):

[0053] S={N(x)|S ij} (F7)

[0054] S ij = {v k ∈V a |p ik =1∩p kj =1} (F8)

[0055] Among them, for the set of access points S ij , when p ik =1 and p kj =1, indicating that node v k Yes i to v jConnect the path points on the path; for the parent node on the path point, define a set N(v) as shown in formula (F9):

[0056] N(v)={v j |(v j ,v i )∈E} (F9)

[0057] When v j to v i When there is a directed edge, it means that v j Yes i The parent node of

[0058] Step S302: guiding the generation type of the honeyspot service according to the threat type. The specific process is as follows:

[0059] Step S3021: Given a honey spot type set C, a decision on the honey spot service generation type is made according to the fact nodes in the node types corresponding to the threat node set S;

[0060] Step S3022: According to the rule nodes in the node type corresponding to the threat node set S, suggestions for honey spot service configuration are given.

[0061] The present invention also discloses a control and defense graph decision system based on defining the organization's attack preference for implementing the above method, comprising:

[0062] Attack preference ranking module for threat intelligence-defined organizations: used to collect attack information from the log server of the honey spot, attribute and define the behavior pattern of the attack organization through the joint search of the threat intelligence knowledge graph and the external threat intelligence library, and rank the attack preferences of the attack organization;

[0063] Control and defense matrix calculation module based on attack graph: It is used to generate an attack graph from the attacker's perspective through the topology information, asset information and configuration information in the target network, and to define the mapping of the organization's attack preferences to the attack graph nodes, generate a control and defense graph, and then generate a control and defense matrix for quantitative calculation of the impact of the attack mode preference on the attack graph;

[0064] Honey spot generation decision module: It is used to analyze the attack preferences of the organization based on the control and defense matrix of the attack graph, generate honey spot services with emphasis, and provide decision support for the deployment of defense measures.

[0065] Compared with the prior art, the present invention has the following advantages:

[0066] 1. Since traditional honeypot / honeyspot-based deception defense technology requires certain professional capabilities to complete, the present invention proposes a method of jointly attributing attack organizations through threat intelligence and designs an attack preference sorting module for threat intelligence-defined organizations. The attack mode preference is calculated based on historical information to achieve targeted and focused defense.

[0067] 2. The present invention designs a controllable defense mechanism from the attacker's perspective - the control and defense graph, which evaluates the threat risk of the attack mode to the target network, predicts the potential attack trends and strategies in the target network, and can adjust the control and defense strategy in real time.

[0068] 3. The controllable defense mechanism based on the control graph designed by the present invention effectively fills the semantic gap between the attack pattern description and the attack graph description, and uses the control matrix to quantitatively evaluate the degree to which the attack graph nodes are affected by the attack pattern.

[0069] 4. The present invention proposes a honey spot generation decision module, in which users can define target tasks and automatically generate honey spot service types according to the target network environment and attack mode. The honey spot service is generated more flexibly and quickly and automatically, and is no longer limited to manual analysis and manual decision-making. This greatly saves manpower and time costs for the analysis and deployment of deception defense.

[0070] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 A flowchart of a method for a control and defense graph decision-making method based on defining an organization's attack preference according to the present invention;

[0072] Figure 2 It is a principle diagram of the control and defense graph decision method based on defining the attack preference of the organization according to the present invention;

[0073] Figure 3 A flow chart for sorting attack preferences of defined organizations of the present invention;

[0074] Figure 4 The attack graph flow chart generated by MulVAL of the present invention. DETAILED DESCRIPTION

[0075] Example 1

[0076] like Figure 1 to Figure 4 As shown, the control and defense graph decision-making method based on defining the organization's attack preference in this embodiment includes the following steps:

[0077] Step S1: Collect attack information from the log server of the honey spot, attribute and define the behavior pattern of the attack organization through the joint search of the threat intelligence knowledge graph and the external threat intelligence library, and sort the attack preferences of the attack organization;

[0078] Step S2: From the attacker's perspective, an attack graph is generated through the topology information, asset information, and configuration information in the target network, and a mapping of the organization's attack preferences to the attack graph nodes is defined to generate a control and defense graph, and then a control and defense matrix is ​​generated for quantitatively calculating the impact of the attack mode preference on the attack graph;

[0079] Step S3: Based on the control and defense matrix of the attack graph, the attack preference of the organization is analyzed, and honey spot services are generated with emphasis to provide decision support for the deployment of defense measures.

[0080] In this embodiment, when the behavior pattern of the attack organization is attributed and defined through the joint search of the threat intelligence knowledge graph and the external threat intelligence library in step S1, the specific process is as follows:

[0081] S101, pre-processing the unstructured original attack information data collected from the log server of the honey spot into structured attack information data;

[0082] S102, determine whether the attack information can be matched in the threat intelligence knowledge graph, and if it can be matched, extract the evaluation results of major security vendors; if it cannot be matched, transfer the IP address of the attack information and the associated file information to the VT sandbox;

[0083] S103, the VT sandbox retrieves the associated files in the VT library, makes an API call based on the hash value of the malicious sample in the extracted attack information, obtains the specific behavior information of the malicious sample and generates behavior preference data;

[0084] S104, exporting basic information of malicious samples, detailed information related to malicious samples, and attack organization IDs related to malicious samples from threat intelligence knowledge graph data;

[0085] S105, characterizing the malicious sample based on the basic information of the malicious sample and the detailed information related to the malicious sample, taking the attack organization ID related to the malicious sample as the prediction target, and constructing a training set;

[0086] S106. Characterize the malicious sample features and predict the attack organization ID as a defining organization.

[0087] In this embodiment, the specific process of sorting the attack preferences of the attacking organizations in step S1 is as follows:

[0088] Step S107, searching the threat intelligence knowledge graph to define the historical attack patterns of the organization;

[0089] Step S108: Form an attack preference matrix using the behavior information of the attack pattern.

[0090] During specific implementation, the sorting strategy can be dynamically adjusted according to the historical data and changes in the current network environment, and the final attack preference matrix form can be determined from different perspectives.

[0091] In this embodiment, when searching the threat intelligence knowledge graph for the historical attack patterns of the defined organization in step S107, Cypher statements are used.

[0092] In this embodiment, when generating an attack graph from the attacker's perspective through topology information, asset information, and configuration information in the target network in step S2, the MulVAL method is used. MulVAL (multi-host, multi-stage vulnerability analysis language) is an open source, publicly available, logic-based attack graph generation tool. MulVAL is based on the Datalog modeling language, a subset of the Prolog logic programming language. The specific process is:

[0093] Step S201: Given the network topology and asset configuration information of the target network, obtain known vulnerability information according to the asset configuration information; and assume unknown vulnerability information; by assuming the unknown vulnerability information, the repair capability of the target network can be tested;

[0094] Step S202: Determine the daily security strategy of the target system according to its task requirements;

[0095] Step S203: specify the node type of the attack graph to obtain the attack graph of the target network.

[0096] In this embodiment, the specific process of defining the mapping of the organization's attack preference to the attack graph node, generating the control and defense graph, and then generating the control and defense matrix for quantitatively calculating the impact of the attack mode preference on the attack graph is as follows:

[0097] Step S204: Directed attack graph G on the target network a Formal representation can help us better understand the attack graph and use it in subsequent calculations, as shown in formula (F1):

[0098] G a =(V a , E a , X a )=(A a , X a ) (F1)

[0099] Among them, V a = {v a1 , v a2 , ..., v an}, is the attack graph node set with n nodes; X a ∈R n×d Represents the d-dimensional feature matrix of n nodes; E a represents a set of m edges, A a ∈{0,1} n×n is a binary adjacency matrix, as shown in formula (F2):

[0100]

[0101] Among them, the value of i is a natural number from 1 to n, the value of j is a natural number from 1 to n, and the element A in the i-th row and j-th column is ij As shown in formula (F2):

[0102]

[0103] Among them, the value of i is a natural number from 1 to n, the value of j is a natural number from 1 to n, and A ij Represents a directed attack graph G a Middle node v ai and node v aj The adjacency relationship between them;

[0104] Step S205: In order to obtain a mapping from the defined organization attack preference to the attack graph node, the influence of the attack mode preference on the attack graph is quantitatively calculated using formula (F3). c :

[0105] X c =X a wxya o T (F3)

[0106] Among them, the attack preference matrix X obtained by the attack preference ranking module for defining organizations based on threat intelligence is o ∈R l×k , l represents the attack mode preference, k represents the attack behavior; w is the behavior alignment weight matrix with m rows and k columns; thus, X c ∈R n×l ;

[0107] Step S206, generating a control graph;

[0108] The control and defense graph is a network security strategy and analysis tool that combines attack patterns / attack preferences with attack graphs. It mainly designs a controllable defense mechanism from the attacker's perspective. By comprehensively analyzing the attacker's preferences and the potential attack paths of the target network, it depicts possible attack behaviors and strategies in the network, thereby helping the defender to effectively predict and prepare for attacks.

[0109] On this basis, the core of the control and defense diagram is to provide a method to understand network defense from the perspective of an attacker. It not only shows the relationship between various vulnerabilities in the network, but also shows the interaction between these vulnerabilities and network security configuration, as well as the potential threats caused by them. The control and defense diagram enables network security managers to more clearly see the various directed attack paths that exist in the network for specific attack modes or attack preferences. These paths represent the continuous attack behaviors that an attacker may take from the attacker node to the target node.

[0110] Through the control and defense graph, the security team can dynamically adjust and optimize the defense strategy according to the attacker's behavior patterns and preferences. This includes but is not limited to modifying the network configuration, strengthening the security protection of specific nodes, or deploying targeted countermeasures. Therefore, the control and defense graph is not only a visual representation of a defense strategy, but also a dynamic, attacker-centric network defense method;

[0111] Step S207: Generate a control-defense matrix from the attacker's perspective for quantitatively calculating the impact of the attack graph on the attack mode preference as shown in formula (F4):

[0112] G c = {V a , E a , X c} (F4).

[0113] The control matrix is ​​a matrix structure used to quantify and represent the attack paths and strategies of the target network attack graph in the control graph. In the control matrix, the rows usually represent the nodes or systems in the network, while the columns represent the possible attack types or the attacker's strategies.

[0114] In this embodiment, the control matrix based on the attack graph in step S3 defines the analysis of the organization's attack preference, generates honey spot services with emphasis, and provides decision support for the deployment of defense measures. The specific process is as follows:

[0115] Step S301: Determine the threat impact of the organization's attack preference on the target system based on the self-defined target assessment. The specific process is as follows:

[0116] Step S3011: Given a target P, calculate p in the control graph according to formulas (F5) and (F6): ij Reachable:

[0117]

[0118] P(G c )=[p ij ] nxn =A 0 ∨A 1 ∨...∨A n-1 (F6)

[0119] Among them, A 0 is the nxn identity matrix, ∨ is the disjunction operation (logical addition / union operation), which is used to find v ai to v aj Is there a path of length n-1?

[0120] When it is unreachable, modify the target P; when it is reachable, construct the target path (possibly multiple paths) according to the adjacency matrix in the control graph and add the necessary nodes on the path to form a path point set S ij ;

[0121] Step S3012, evaluate and define the threat node set of the organization's attack mode preference to the target path through the control matrix, such as formula (F7) and formula (F8):

[0122] S={N(x)|S ij} (F7)

[0123] S ij = {v k ∈V a |p ik =1∩p kj =1} (F8)

[0124] Among them, for the set of access points S ij , when p ik =1 and p kj =1, indicating that node v k Yes i to v j Connect the path points on the path; for the parent node on the path point, define a set N(v) as shown in formula (F9):

[0125] N(v)={v j |(v j ,v i )∈E} (F9)

[0126] When v j to v i When there is a directed edge, it means that v j Yes i The parent node of

[0127] Step S302: guiding the generation type of the honeyspot service according to the threat type. The specific process is as follows:

[0128] Step S3021: Given a honey spot type set C, a decision on the honey spot service generation type is made according to the fact nodes in the node types corresponding to the threat node set S;

[0129] Step S3022: According to the rule nodes in the node type corresponding to the threat node set S, suggestions for honey spot service configuration are given.

[0130] In summary, the present invention designs a control and defense graph decision system based on defining the attack preferences of an organization. The system uses the alarm information generated by the honey spot, and combines the knowledge information in the network security knowledge graph for threat intelligence to analyze the behavior pattern of the attacker to define the characteristics of the attacker's organization. By analyzing the historical attack behavior of the organization, the system can map possible attack patterns into the attack graph of the target network, thereby creating a dynamically adjustable control and defense graph, and dynamically adjust the characteristics and deployment locations of the honey spot services for defining the attack preferences of the organization in a timely manner by calculating the control and defense matrix, so as to achieve the effect of slowing down and confusing the attacker, and buy time for the defender in the network attack. It also realizes the automated decision-making of the honey spot service type, which greatly saves manpower and time costs.

[0131] Example 2

[0132] The control and defense graph decision system of this embodiment for defining the attack preference of an organization includes:

[0133] Attack preference ranking module for threat intelligence-defined organizations: used to collect attack information from the log server of the honey spot, attribute and define the behavior pattern of the attack organization through the joint search of the threat intelligence knowledge graph and the external threat intelligence library, and rank the attack preferences of the attack organization;

[0134] In specific implementation, the attack preference ranking module can also dynamically adjust the ranking strategy according to its historical data and changes in the current network environment;

[0135] Control and defense matrix calculation module based on attack graph: It is used to generate an attack graph from the attacker's perspective through the topology information, asset information and configuration information in the target network, and to define the mapping of the organization's attack preferences to the attack graph nodes, generate a control and defense graph, and then generate a control and defense matrix for quantitative calculation of the impact of the attack mode preference on the attack graph;

[0136] Honey spot generation decision module: It is used to analyze the attack preferences of the organization based on the control and defense matrix of the attack graph, generate honey spot services with emphasis, and provide decision support for the deployment of defense measures.

[0137] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any way. Any simple modification, change and equivalent structural change made to the above embodiment based on the technical essence of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A control and defense graph decision method based on defining the attack preference of an organization, characterized in that: The method comprises the following steps: Step S1: Collect attack information from the log server of the honey spot, attribute and define the behavior pattern of the attack organization through the joint search of the threat intelligence knowledge graph and the external threat intelligence library, and sort the attack preferences of the attack organization; Step S2: From the attacker's perspective, an attack graph is generated through the topology information, asset information, and configuration information in the target network, and a mapping of the organization's attack preferences to the attack graph nodes is defined to generate a control and defense graph, and then a control and defense matrix is ​​generated for quantitatively calculating the impact of the attack mode preference on the attack graph; Step S3: Based on the control and defense matrix of the attack graph, the attack preference of the organization is analyzed, and honey spot services are generated with emphasis to provide decision support for the deployment of defense measures.

2. A control-defense graph decision method based on defining an organization's attack preference according to claim 1, characterized in that: When the behavior pattern of the attack organization is attributed and defined through the joint search of the threat intelligence knowledge graph and the external threat intelligence library in step S1, the specific process is as follows: S101, pre-processing the unstructured original attack information data collected from the log server of the honey spot into structured attack information data; S102, determine whether the attack information can be matched in the threat intelligence knowledge graph, and if it can be matched, extract the evaluation results of major security vendors; if it cannot be matched, transfer the IP address of the attack information and the associated file information to the VT sandbox; S103, the VT sandbox retrieves the associated files in the VT library, makes an API call based on the hash value of the malicious sample in the extracted attack information, obtains the specific behavior information of the malicious sample and generates behavior preference data; S104, exporting basic information of malicious samples, detailed information related to malicious samples, and attack organization IDs related to malicious samples from threat intelligence knowledge graph data; S105, characterizing the malicious sample based on the basic information of the malicious sample and the detailed information related to the malicious sample, taking the attack organization ID related to the malicious sample as the prediction target, and constructing a training set; S106. Characterize the malicious sample features and predict the attack organization ID as a defining organization.

3. A control-defense graph decision method based on defining an organization's attack preference according to claim 2, characterized in that: The specific process of sorting the attack preferences of the attacking organizations in step S1 is as follows: Step S107, searching the threat intelligence knowledge graph to define the historical attack patterns of the organization; Step S108: Form an attack preference matrix using the behavior information of the attack pattern.

4. A control-defense graph decision method based on defining an organization's attack preference according to claim 3, characterized in that: When searching for historical attack patterns that define an organization in the threat intelligence knowledge graph as described in step S107, Cypher statements are used.

5. A control-defense graph decision method based on defining an organization's attack preference according to claim 1, characterized in that: In step S2, from the attacker's perspective, when generating an attack graph through topology information, asset information, and configuration information in the target network, the MulVAL method is used. The specific process is as follows: Step S201: Given the network topology and asset configuration information of the target network, obtain known vulnerability information according to the asset configuration information; and assume unknown vulnerability information; Step S202: Determine the daily security strategy of the target system according to its task requirements; Step S203: specify the node type of the attack graph to obtain the attack graph of the target network.

6. A control-defense graph decision method based on defining an organization's attack preference according to claim 5, characterized in that: When defining the mapping of the organization's attack preference to the attack graph node, generating a control and defense graph, and then generating a control and defense matrix for quantitatively calculating the impact of the attack graph on the attack mode preference in step S2, the specific process is as follows: Step S204: Directed attack graph G on the target network a It is formally expressed as shown in formula (F1): G a =(V a ,E a ,X a )=(A a ,X a ) (F1) Among them, V a = {v a1 , v a2 , ..., v an }, is the attack graph node set with n nodes; X a ∈R n×d Represents the d-dimensional feature matrix of n nodes; E a represents a set of m edges, A a ∈{0,1} n×n is a binary adjacency matrix, whose element A in the i-th row and j-th column is ij As shown in formula (F2): Among them, the value of i is a natural number from 1 to n, the value of j is a natural number from 1 to n, and A ij Represents a directed attack graph G a Middle node v ai and node v aj The adjacency relationship between them; Step S205: Use formula (F3) to quantify the impact of attack mode preference on the attack graph X c : X c =X a wX o T (F3) Among them, the attack preference matrix X obtained by the attack preference ranking module for defining organizations based on threat intelligence is o ∈R l×k , l represents the attack mode preference, k represents the attack behavior; w is the behavior alignment weight matrix with m rows and k columns; Step S206, generating a control graph; Step S207: Generate a control-defense matrix from the attacker's perspective for quantitatively calculating the impact of the attack graph on the attack mode preference as shown in formula (F4): G c ={V a ,E a ,X c } (F4).

7. A control-defense graph decision method based on defining an organization's attack preference according to claim 1, characterized in that: The control matrix based on the attack graph in step S3 defines the attack preference of the organization, generates honey spot services with emphasis, and provides decision support for the deployment of defense measures. The specific process is as follows: Step S301: Determine the threat impact of the organization's attack preference on the target system based on the self-defined target assessment. The specific process is as follows: Step S3011: Given a target P, calculate p in the control graph according to formulas (F5) and (F6): ij Reachable: P(G c )=[p ij ] nxn =A 0 ∨A 1 ∨...VA n-1 (F6) Among them, A 0 is the nxn identity matrix, and ∨ is the disjunction operation used to find v ai to v aj Is there a path of length n-1? When it is unreachable, modify the target P; when it is reachable, construct the target path according to the adjacency matrix in the control graph and add the necessary nodes on the path to form the path point set S ij ; Step S3012, evaluate and define the threat node set of the organization's attack mode preference to the target path through the control matrix, such as formula (F7) and formula (F8): S={N(x)|S ij } (F7) S ij ={v k ∈V a |p ik =1∩p kj =1} (F8) Among them, for the set of access points S ij , when p ik =1 and p kj =1, indicating that node v k Yes i to v j Connect the path points on the path; for the parent node on the path point, define a set N(v) as shown in formula (F9): N(v)={v j |(v j ,v i )∈E} (F9) When v j to v i When there is a directed edge, it means that v j Yes i The parent node of Step S302: guiding the generation type of the honeyspot service according to the threat type. The specific process is as follows: Step S3021: Given a honey spot type set C, a decision on the honey spot service generation type is made according to the fact nodes in the node types corresponding to the threat node set S; Step S3022: According to the rule nodes in the node type corresponding to the threat node set S, suggestions for honey spot service configuration are given.

8. A control and defense graph decision system based on defining the organization's attack preference for implementing the method as claimed in claim 1, characterized in that: include: Attack preference ranking module for threat intelligence-defined organizations: used to collect attack information from the log server of the honey spot, attribute and define the behavior pattern of the attack organization through the joint search of the threat intelligence knowledge graph and the external threat intelligence library, and rank the attack preferences of the attack organization; Control and defense matrix calculation module based on attack graph: It is used to generate an attack graph from the attacker's perspective through the topology information, asset information and configuration information in the target network, and to define the mapping of the organization's attack preferences to the attack graph nodes, generate a control and defense graph, and then generate a control and defense matrix for quantitative calculation of the impact of the attack mode preference on the attack graph; Honey spot generation decision module: It is used to analyze the attack preferences of the organization based on the control and defense matrix of the attack graph, generate honey spot services with emphasis, and provide decision support for the deployment of defense measures.

Images