Enterprise network weak password evaluation method based on logic attack graph and password evaluation

Abstract

The invention discloses an enterprise network weak password evaluation method based on a logic attack graph and password evaluation, which comprises the following steps: firstly, collecting a network topology structure, a security policy and system configuration of an enterprise intranet, and combining ATTamp; according to the inference rule mapped by the CK knowledge base, logical inference is carried out by using a MulVAL tool to obtain a logical attack graph; then acquiring system account password information of each host, calculating password entropy and simulating password blasting time evaluation to obtain a password risk value; then, the password risk value is associated and combined with the logic attack graph, and a new weighted attack graph containing the password risk value is generated; identifying an attack starting point and an attack target point in the attack graph with the weight at the same time; traversing all attack paths in the weighted attack graph by using a depth-first search algorithm, and calculating a weak password risk value on each attack path; and finally, taking the attack path with the highest weak password risk value as an optimal attack path, generating and visualizing, and improving the network security defense level of an enterprise.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an enterprise network weak password evaluation method based on logical attack graph and password evaluation. Background Art

[0002] In recent years, with the development of network technology, enterprise networks have become larger and more complex, and the daily operation of enterprises such as important data, employee information, and service products has become more dependent on network systems. The security of enterprise networks has become a severe challenge. In the past few years, thousands of security incidents such as data leaks against enterprises have been reported, causing significant economic losses. The threat of weak passwords is one of the problems of enterprise network security; when employees set weak passwords or use default passwords that are easy to guess, the network system of the enterprise will face the risk of being attacked by hackers, thereby gaining access to important enterprise data. In 2013, the US retail giant Target suffered a large-scale data breach; attackers used the weak passwords of suppliers to successfully invade Target's network system and steal the credit card information and personal data of millions of customers. This incident caused Target billions of dollars in losses. In 2014, Sony Pictures suffered a catastrophic cyber attack. Hackers took advantage of the habit of employees using weak passwords to easily invade Sony's network system, steal a large amount of sensitive information and publish many emails and documents involving internal company secrets. This attack not only caused Sony to suffer significant economic losses, but also had a serious negative impact on the company's reputation. In the 2023 Cybersecurity Maturity Report, weak passwords ranked first among common risk points with a share of 32%.

[0003] Compared with other attack methods, weak password attacks have a higher success rate and a wider range of applications. Weak password attacks usually do not require particularly complex technology or resources. Hackers can easily invade the system using common password cracking tools or simple dictionary attacks, which makes weak password attacks one of the common methods used by hackers. Secondly, the success rate of weak password attacks is relatively high. According to statistics, most users tend to use simple passwords that are easy to remember, such as birthdays, common words, or consecutive numbers. These passwords are easy to guess or cracked by brute force. When hackers successfully gain access to the system, they can easily steal, tamper with, or destroy important data in the system, and can use the system to penetrate laterally in the enterprise intranet environment, causing serious losses to the enterprise. The use of password entropy in the prior art [1] As an indicator to measure password security strength, use attack graph [2-3] To analyze the security threats of network systems and develop a logical attack graph combined with logical reasoning methods to more carefully analyze and evaluate the attack path. The logical attack graph uses the famous open source framework MulVAL [4-5]The MulVAL framework is built with strong extensibility and scalability; the reasoning engine of the MulVAL framework relies on interactive rules and is designed to systematically analyze security threats in a network environment across multiple hosts. [6] , the rules can be customized according to different network environment topologies to generate the expected attack graph.

[0004] Although the above work has promoted the development of threat assessment based on attack graphs and password strength assessment, there are still problems. First, weak passwords, which have been ranked first in network security threats for many years, have not received enough attention. Second, MulVAL has not been updated for a long time after it was open sourced. Later studies by other scholars were based on customized extensions of MulVAL inference rules, and the initial inference rules could not reflect the current complex network situation. Third, with the development of technology, the improvement of attacker capabilities and available resources, the use of password entropy alone to measure password strength cannot well support password assessment.

[0005] References:

[0006] [1] CEShannon, "Amathematical theory of communication," Bell SystemTechnical Journal, vol.27, 1948, pp.379-423, pp.623-656.

[0007] [2]Singha MF,Patgiri R.Acomprehensive investigation on attack graphs[M] / / Advances in Computers.Elsevier,2023,128:251-272.

[0008] [3]Zenitani K.Attack graph analysis:an explanatory guide[J].Computers&Security,2023,126:103081.

[0009] [4]Ou

[0010] [5]Ou

[0011] [6]Tayouri D, Baum N, Shabtai A, et al.Asurvey of mulval extensions and their attack scenarios coverage[J]. IEEE Access, 2023. Summary of the invention

[0012] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art, and to provide an enterprise network weak password assessment method based on logical attack graphs and password assessment, aiming to detect weak password security threats in enterprise networks, provide support for subsequent research on enterprise network threat analysis based on logical attack graphs, and provide network security analysts with an efficient and reliable automated enterprise network threat analysis solution.

[0013] In order to achieve the above object, the present invention provides, on one hand, a method for evaluating weak passwords in enterprise networks based on a logical attack graph and password evaluation, comprising the following steps:

[0014] Step 1: Logical attack graph construction:

[0015] Collect the network topology, security policies and system configuration of the enterprise intranet, combine the reasoning rules mapped by the ATT&CK knowledge base, and use the MulVAL tool to perform logical reasoning to obtain a logical attack graph;

[0016] Step 2: Password strength assessment:

[0017] Obtain system account password information of each host in the enterprise intranet, calculate password entropy and simulate password cracking time to evaluate the password risk value;

[0018] Step 3: Attack path restoration:

[0019] The password risk value is associated with the logical attack graph to generate a new weighted attack graph containing the password risk value;

[0020] Identify the attack starting point and attack target point in the weighted attack graph;

[0021] Use the depth-first search algorithm to traverse all attack paths in the weighted attack graph and calculate the risk value of weak passwords involved in each attack path;

[0022] The attack path with the highest risk value of weak passwords is taken as the optimal attack path, which is generated and visualized.

[0023] As a preferred technical solution, the steps for constructing the inference rules of the ATT&CK knowledge base mapping are:

[0024] The tactics in the ATT&CK knowledge base are screened and divided into three categories according to the preparations before the attack, the methods used during the attack, and the behaviors after the attack is successful;

[0025] Select technically valid accounts included in both tactical initial access and lateral movement as the main attack methods for attackers to launch attacks and move laterally in the network as core attack reasoning rules;

[0026] Using tactical privilege escalation as an auxiliary rule in the attack process indicates the attacker's privilege escalation behavior;

[0027] Persistence, execution, and discovery of tactics as possible behaviors after a successful attack;

[0028] Inferring tactical collection from tactical discovery and then tactical leakage indicates a series of actions by the attacker to discover, collect, and leak important information data on the victim's host;

[0029] Tactical impact is inferred from tactical execution and discovery, indicating the impact that the attack will have.

[0030] As a preferred technical solution, the password strength assessment steps are:

[0031] Obtain the system account password of each host in the enterprise intranet;

[0032] The password entropy of each host is calculated based on the password length and character type of the system account password of each host. The formula is:

[0033] E = log2(N L ),

[0034] Among them, E is the password entropy, N is the size of the password character set, and L is the password length;

[0035] The password cracking time is simulated based on the password length and character type of the system account password of each host. The formula is:

[0036]

[0037] Among them, T is the password cracking time, R is the computing power per second, n is the number of character types involved in the password character set, and Ci Indicates the size of the i-th type of characters contained in the password character set;

[0038] The password entropy and password cracking time are weighted and normalized to obtain the password risk value:

[0039]

[0040] Among them, P is the password risk value, α and β are adjustable weight coefficients, and γ is the scaling parameter.

[0041] As a preferred technical solution, the password entropy considers the constituent elements of the password, consecutive characters, repeated characters, and common character sequences reflecting keyboard input habits to award or penalize points;

[0042] The bonus score is related to the password length, character weight, and number of character types, expressed as:

[0043]

[0044] Among them, S length is the reward score calculated based on the password length, L is the password length, k is the weight corresponding to the password length, S max S is the maximum length score, case The bonus score is calculated based on the case of the password. If the password contains both uppercase and lowercase letters, a bonus score of x is given. If the password contains either uppercase or lowercase letters, a bonus score of y is given. The upper count is the number of uppercase letters in the password, and the lower count is the number of lowercase letters in the password.

[0045] The penalty score is related to the regularity of the characters in the dictionary and is expressed as:

[0046] S regular =-zif regular pattern detected,

[0047] Among them, S consecutive It is the penalty score for password regularity. Regular pattern detected means that regular characters in the dictionary are detected in the password.

[0048] As a preferred technical solution, the generation of a new weighted attack graph containing a password risk value is specifically as follows:

[0049] Read the logical attack graph file, filter the node information and store it in the node set, and store the rest of the information in the edge set; the node information of each node in the node set includes the node number, node type, node name and parameters, node weight, predecessor node and successor node; the edge information of each edge in the edge set includes the starting node, target node and edge weight; the node types include And, Leaf and Or, among which the And type node is a rule node, the Leaf type node is a fact node, and the Or type node is a derived fact node; the Leaf type node represents the set network environment and network configuration initial fact conditions; the And type node represents the logical reasoning rule, whose parent node is a Leaf type node or an Or type node as its reasoning condition, and the child node is an Or type node; the Or type node represents the new attack fact result obtained after all the conditions of the rule are met;

[0050] Filter Or type nodes. First, determine whether the node name involves login behavior. If so, match the password and password risk value of the host according to the host number in the node parameters, and replace the node weight of the node with the password risk value after evaluation of the node.

[0051] The call graph visualization software generates a new weighted attack graph that includes password risk values.

[0052] As a preferred technical solution, the depth-first search algorithm is used to traverse all attack paths in the weighted attack graph and calculate the risk value of weak passwords involved in each attack path, specifically:

[0053] Determine the positions of the starting node and the ending node of the weighted attack graph;

[0054] Starting from the starting node, recursively visit each unvisited successor node one by one, and continue to go deeper along the path until reaching the end point; during the exploration process, the traversed successor nodes are marked as visited nodes, and And type nodes are specially marked, and the weights of Or type nodes are accumulated and recorded; when the search reaches the end node or encounters a node without a successor node, the entire path and its accumulated weight are saved, and the accumulated weight is defined as the final risk value of the path, which is calculated by accumulating the weights of all Or type nodes on the path;

[0055] Then, trace back from the last node of the path to the previous And type node to check whether it has other unvisited parent nodes, and continue searching until all possible paths are fully visited and recorded to ensure full coverage analysis of all potential risk paths in the attack graph.

[0056] On the other hand, the present invention provides an enterprise network weak password assessment system based on a logical attack graph and password assessment, including a logical attack graph construction module, a password strength assessment module, an association combination module, a point recognition module, a path search module and a visualization module;

[0057] The logical attack graph construction module is used to collect the network topology, security policy and system configuration of the enterprise intranet, combine the reasoning rules mapped by the ATT&CK knowledge base, and use the MulVAL tool to perform logical reasoning to obtain the logical attack graph;

[0058] The password strength assessment module is used to obtain the system account password information of each host in the enterprise intranet, calculate the password entropy and simulate the password blasting time, and evaluate the password risk value;

[0059] The association and combination module is used to associate and combine the password risk value with the logical attack graph to generate a new weighted attack graph containing the password risk value;

[0060] The point identification module is used to identify the attack starting point and the attack target point in the weighted attack graph;

[0061] The path search module is used to traverse all attack paths in the weighted attack graph using a depth-first search algorithm, and calculate the risk value of weak passwords involved in each attack path;

[0062] The visualization module is used to take the attack path with the highest risk value of weak passwords as the best attack path, generate it and perform visualization processing.

[0063] Another aspect of the present invention provides an electronic device, comprising:

[0064] at least one processor; and a memory in communication with the at least one processor; wherein,

[0065] The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned enterprise network weak password assessment method based on logical attack graph and password assessment.

[0066] The present invention provides a computer-readable storage medium storing a program, which, when executed by a processor, implements the above-mentioned enterprise network weak password assessment method based on logical attack graph and password assessment.

[0067] The present invention further provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the above-mentioned enterprise network weak password assessment method based on logical attack graph and password assessment.

[0068] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0069] The present invention proposes an enterprise network weak password assessment method based on logical attack graph and password assessment. The method is based on logical attack graph and password assessment technology. Attack technology is introduced when constructing the attack graph, and the attack chain is restored with fine-grained attack behavior. Various potential access paths and permission loopholes in the enterprise network are systematically analyzed. This visualization method greatly improves the accuracy and efficiency of security threat identification in complex network environments, and reduces the need for manual intervention through intelligent automatic analysis. After that, combined with the password assessment algorithm, accounts with weak passwords can be quickly screened out, and according to the password security assessment value, the path with the highest weak password threat value is displayed in the attack graph, which intuitively shows which accounts have too low password security values. If a security incident occurs, the attacker is most likely to use the weak password to make what kind of lateral movement, effectively preventing security incidents caused by insufficient password strength, improving the enterprise's network security defense level, and reducing the direct economic losses caused to the enterprise by data leakage and network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0071] Figure 1 It is an overall flow chart of the enterprise network weak password assessment method based on logical attack graph and password assessment in an embodiment of the present invention.

[0072] Figure 2 A flowchart for constructing a logical attack graph in an embodiment of the present invention.

[0073] Figure 3 Schematic diagram of reasoning of the MulVAL tool in an embodiment of the present invention.

[0074] Figure 4 Schematic diagram of a logical attack graph in an embodiment of the present invention.

[0075] Figure 5 This is a partial display diagram of the logical attack graph in an embodiment of the present invention.

[0076] Figure 6 Flow chart of password strength evaluation in an embodiment of the present invention.

[0077] Figure 7 The figure is a flow chart of attack path restoration in an embodiment of the present invention.

[0078] Figure 8 It is a pseudo code diagram of the depth-first search algorithm in an embodiment of the present invention.

[0079] Fig. 9 Schematic diagram of the optimal attack path diagram in an embodiment of the present invention.

[0080] Fig.10 It is a structural diagram of an enterprise network weak password assessment system based on logical attack graph and password assessment in an embodiment of the present invention.

[0081] Fig.11 Schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0082] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0083] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0084] Weak passwords have always been one of the most prominent threats in the field of network security. The enterprise network environment is complex and large. The threat assessment based on the logical attack graph in a specific scenario does not involve specific weak password threat scenarios. In order to meet the needs of enterprise network threat assessment and analysis, Figure 1 As shown, this embodiment provides an enterprise network weak password assessment method based on a logical attack graph and password assessment, comprising the following steps:

[0085] Step 1: Logical attack graph construction:

[0086] The network topology, security policies and system configuration of the enterprise intranet are collected, combined with the inference rules mapped by the ATT&CK knowledge base, and the MulVAL tool is used for logical reasoning to obtain a logical attack graph.

[0087] Furthermore, the ATT&CK framework, as a universal language and detailed knowledge graph, sets a standard for describing intrusion behaviors. By deeply analyzing the attack events that occur in the real world, it can systematically record the strategies and technical means of attackers in the intrusion process, thereby building a rich knowledge base. In the present invention, the construction steps of the inference rules mapped by the ATT&CK knowledge base are:

[0088] First, the tactics in the ATT&CK knowledge base are screened and divided into three categories according to the pre-attack preparations, methods during the attack, and behaviors after a successful attack; since the present invention generates attack graphs for the risk of weak passwords in enterprise networks, tactics and techniques involving the Internet are not considered.

[0089] Secondly, considering that each tactic contains several technologies and technologies contain a large number of sub-techniques, the technology Valid Account, which is included in the tactics Initial Access and Lateral Movement, is selected as the main attack method for attackers to launch attacks and move laterally in the network, and is used as the core attack reasoning rule. The remaining situations are uniformly represented by tactics only, that is, the attacker may use one or more technologies under the tactic.

[0090] Finally, the tactical privilege escalation is used as an auxiliary rule in the attack process to represent the attacker's privilege escalation behavior. The tactical persistence, execution, and discovery are used as possible behaviors after the attack is successful. The tactical collection is inferred from the tactical discovery, and the tactical exfiltration is inferred, indicating a series of behaviors of the attacker discovering, collecting, and exfiltrating important information data on the victim's host. The tactical impact is inferred from the tactical execution and discovery, indicating the impact of the attack.

[0091] In this embodiment, the inference rules mapped from the 13 tactics in the ATT&CK (Enterprise-v15.1) knowledge base are shown in Table 1 below:

[0092] Table 1 Inference rules for ATT&CK mapping

[0093]

[0094] In addition, in order to more reasonably restore the access, organizational structure and other connection conditions of each host and server in the network topology, inference rules such as hostAccess, gatewayAccess, and sameNet are designed to show the connection between hosts and the communication relationship between hosts in different network segments.

[0095] Furthermore, the input of the MulVAL tool needs to include the architectural details and components of the target network to lay a solid foundation for subsequent environmental reasoning, including but not limited to the basic topological structure of the target network, which is used to depict the logical connection relationship between network resources; at the same time, for each host server within the network system, its basic information should be collected, such as operating system type, running services, installed software and its version number, security configuration, etc. This information is particularly critical for simulating security scenarios in the real world. In order to efficiently generate attack graphs and ensure that they accurately reflect complex network environments and potential threats, it is necessary to design a set of predicates and their parameters corresponding to the inference rules to standardize and normalize all necessary input information, including host information, connection information, vulnerability information, gateway information, attacker information, etc. Predicates representing more information can be added as subsequent needs are updated. In this embodiment, the specific predicate template is shown in Table 2 below:

[0096] Table 2 Predicate template

[0097]

[0098] like Figure 2 , 3 As shown in the figure, the collected basic information such as network topology, security policy and system configuration is constructed by referring to the predicate template as the input file of the MulVAL tool. The inference rules mapped by the ATT&CK knowledge base are used. The MulVAL tool refers to the inference rules to infer the input predicate information. The inference rules will set the conditions for which predicates are required, and match the conditions required by the inference rules according to the input predicate information. If the conditions are met, the corresponding inference facts are inferred, so that the attack path is obtained by logical reasoning, and then the logical attack graph is generated by drawing according to the node path information, as shown in the figure. Figure 4 , 5 shown.

[0099] Step 2: Password strength assessment:

[0100] Obtain the system account password information of each host in the enterprise intranet, calculate the password entropy and simulate the password cracking time, and evaluate the password risk value.

[0101] Furthermore, the present invention evaluates the strength of user passwords from two perspectives: password entropy and brute force password cracking time. The entropy value and cracking time are calculated according to the length, complexity, and character type of the password, respectively. Figure 6 As shown, the specific steps are:

[0102] 2.1. First, obtain the system account password of each host in the enterprise intranet;

[0103] 2.2. Next, the password entropy of each host is calculated based on the password length and character type of the system account password of each host. The formula is:

[0104] E = log2(N L ),

[0105] Among them, E is the password entropy, N is the size of the password character set, and L is the password length.

[0106] In the field of cryptography, entropy is a key indicator to measure the uncertainty and unpredictability of passwords or keys; high entropy means that the password exhibits extremely high randomness and complexity, which significantly improves the ability to resist guessing or brute force attacks. In order to further enhance the accuracy and comprehensiveness of the assessment, based on the idea of ​​password entropy, the evaluation dimension of password strength is expanded to multiple levels on the basis of the original character set and password length, including the length of the password, whether it uses a mixture of uppercase and lowercase letters, whether it contains numbers and special symbols, and the combination of these elements; the password strength evaluation system not only considers the constituent elements of the password, but also deducts points for continuous characters, repeated characters, and common sequences that reflect keyboard input habits, in order to simulate the potential threats faced by passwords in the real world. The following are the key considerations in the assessment:

[0107] a. Length and character set: The longer the password is and the richer the character set used (including uppercase and lowercase letters, numbers and symbols), the higher its evaluation value. Let the password length be L, k be the weight corresponding to the password length, to change the impact of the password length on the final result (k = 7 in this example), S max is the maximum length score (in this embodiment, S max =1000), reduce the value and reduce the weight; set the bonus points x and y, and give bonus points when the number of meaningful character sets in the password meets the conditions:

[0108]

[0109] Among them, S length is the bonus score calculated based on the password length, S case The bonus score is calculated based on the case of the password. If the password contains both uppercase and lowercase letters, a bonus score of x is given. If the password contains either uppercase or lowercase letters, a bonus score of y is given. The upper count is the number of uppercase letters in the password, and the lower count is the number of lowercase letters in the password.

[0110] b. Avoid regularity: Continuous characters (such as "123"), repeated characters (such as "aaa"), and common keyboard patterns (such as "qwerty") will reduce the entropy value of the password, so they will be deducted in the evaluation. Set the penalty point z, set a dictionary to store common keyboard habits, call the dictionary for matching during detection, and deduct points when the detected password contains regular characters in the dictionary (such as continuous and repeated characters):

[0111] S regular =-zif regular pattern detected,

[0112] Among them, S regular is the penalty score for password regularity; the condition after if, i.e. regular pattern detected, means that regular characters in the dictionary are detected in the password.

[0113] 2.3. Simulate the password cracking time according to the password length and character types of the system account password of each host; simulate the computing power per second of a personal computer (about 40,000,000), set the password length as L, the computing power per second as R (that is, the number of attempts per second during password cracking), then the calculation formula for the password cracking time T can be expressed as:

[0114]

[0115] Where n is the number of character types involved in the password character set, C i Indicates the size of the i-th type of characters contained in the password character set, such as lowercase letters, uppercase letters, numbers, symbols, etc.

[0116] 2.4. Finally, the password cracking time T reflects the password's resistance to attack, and the password entropy E of each host represents the complexity of the password. The two values ​​are weighted summed and normalized to obtain the password risk value P:

[0117]

[0118] Among them, α and β are adjustable weight coefficients, and γ is a scaling parameter.

[0119] Step 3: Attack path restoration:

[0120] like Figure 7 As shown, the present invention provides an efficient attack path analysis method based on a directed graph, which generates attack paths and path risks by parsing the attack graph and visually displays the results. The specific steps are:

[0121] 3.1. Associate the password risk value with the logical attack graph to generate a new weighted attack graph containing the password risk value, specifically:

[0122] Read the logical attack graph file, filter the node information and store it in the node set, and store the rest of the information in the edge set; the node information of each node in the node set includes node number, node type, node name, node parameters, node weight, predecessor node and successor node, etc.; the edge information of each edge in the edge set includes the starting node, target node and edge weight, etc.; there are three types of nodes: And, Leaf and Or. The And type node is a rule node, the Leaf type node is a fact node, and the Or type node is a derived fact node; the Leaf type node represents the set initial fact conditions such as the network environment and network configuration; the And type node represents the logical reasoning rule, whose parent node is a Leaf type node or an Or type node as its reasoning condition, and the child node is an Or type node; the Or type node represents the new attack fact result obtained after all the conditions of the rule are met;

[0123] Filter Or type nodes, determine whether they involve login behavior based on the node name, and if so, match the password and password risk value of the host based on the host number in the node parameters, and replace the node weight of the node with the password risk value of the host;

[0124] The call graph visualization software generates a new weighted attack graph that includes password risk values.

[0125] In this embodiment, the logical attack graph file is stored in a dot text file, and the node information is filtered according to the "label" in the dot text and stored in the node set, and the node number (id), node type (type), node name and parameters (fact), node parameters, node weight (metric), predecessor node (prior) and successor node (next) and other information are set in the node set. The remaining information is stored in the edge set, and the starting node (src), target node (dst), edge weight (rate) and other information are set. Then, the Or type nodes are filtered, and the nodes involving login behavior (i.e., initialLogin and lateralLogin) are judged according to the fact, and the matching host and password are found according to the information in the fact parameter, and the metric value of the node is replaced with the risk value after the corresponding password assessment, and Graphviz is called to regenerate the graph.

[0126] 3.2. Identify the attack starting point and attack target point in the weighted attack graph.

[0127] 3.3. Use the depth-first search algorithm to traverse all attack paths in the weighted attack graph (pseudo code as follows Figure 8 As shown in the figure), calculate the risk value of weak passwords involved in each attack path, specifically:

[0128] According to the attack graph file information of the weighted attack graph, the positions of the starting node and the ending node of the weighted attack graph are determined;

[0129] Starting from the starting node, recursively visit each unvisited successor node one by one, and continue to go deeper along the path until reaching the end point; during the exploration process, the traversed successor nodes are marked as visited nodes, and And type nodes are specially marked, and the weights of Or type nodes are accumulated and recorded; when the search reaches the end node or encounters a node without a successor node, the entire path and its accumulated weight are saved, and the accumulated weight is defined as the final risk value of the path, which is calculated by accumulating the weights of all Or type nodes on the path;

[0130] Then, trace back from the last node of the path to the previous And type node to check whether it has other unvisited parent nodes, and continue searching until all possible paths are fully visited and recorded to ensure full coverage analysis of all potential risk paths in the attack graph.

[0131] 3.4. The attack path with the highest risk value of weak passwords is taken as the best attack path, generated and visualized.

[0132] This application visualizes the best attack path, generates and outputs the best attack path graph. The bottom of the graph is the sum of the password risk values ​​of the entire path, indicating that in the entire attack graph, the weak password involved in this path has the highest risk value and is most likely to be cracked by attackers. Fig. 9 As shown in the figure, blue nodes are used to represent nodes that are derived from the T1021Valid Account rule to represent valid account logins. The nodes contain the risk value of the corresponding host password assessment, indicating that attackers use this technology to log in with an account with a weak password risk value of 36; orange nodes are used to represent nodes derived from various tactical rules, indicating that attackers perform privilege escalation, lateral movement, command execution, and will affect the host; the remaining nodes representing host configuration, network configuration, network connection, etc. are represented in default gray.

[0133] In summary, on the one hand, the present invention constructs a logical attack graph from a new perspective, combines text information related to ATT&CK strategy, tactics, and technical analysis, integrates the inference rules mapped to attack behaviors with weak password threats as the core, represents network attacks as single-step behavioral tactical techniques, and uses the MulVAL tool to generate a logical attack graph according to the created inference rules; on the other hand, the present invention evaluates the password strength based on password entropy and password cracking time; on the other hand, the attack path is restored by screening the highest risk path of the attack graph based on the DFS algorithm, and an attack graph with the highest risk value of weak passwords is generated, thereby improving the company's network security defense level and reducing the direct economic losses caused by data leakage and network attacks.

[0134] It should be noted that, for the sake of convenience, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited to the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously.

[0135] Example 2

[0136] Based on the same idea as the enterprise network weak password assessment method based on logical attack graph and password assessment in the above embodiment, the present invention also provides an enterprise network weak password assessment system based on logical attack graph and password assessment, which can be used to execute the above enterprise network weak password assessment method based on logical attack graph and password assessment. For ease of explanation, the structural diagram of the embodiment of the enterprise network weak password assessment system based on logical attack graph and password assessment only shows the parts related to the embodiment of the present invention. Those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than the illustrated one, or combine certain components, or arrange the components differently.

[0137] like Fig.10 As shown, another embodiment of the present invention provides an enterprise network weak password assessment system based on a logical attack graph and password assessment, including a logical attack graph construction module, a password strength assessment module, an association combination module, a point identification module, a path search module and a visualization module;

[0138] The logical attack graph construction module is used to collect the network topology, security policies and system configuration of the enterprise intranet, and use the MulVAL tool to perform logical reasoning to obtain the logical attack graph in combination with the reasoning rules mapped by the ATT&CK knowledge base.

[0139] The password strength assessment module is used to obtain the system account password information of each host in the enterprise intranet, calculate the password entropy and simulate the password cracking time, and evaluate the password risk value;

[0140] The association and combination module is used to associate and combine the password risk value with the logical attack graph to generate a new weighted attack graph containing the password risk value;

[0141] The point recognition module is used to identify the attack starting point and attack target point in the weighted attack graph;

[0142] The path search module is used to traverse all attack paths in the weighted attack graph using a depth-first search algorithm and calculate the risk value of weak passwords involved in each attack path;

[0143] The visualization module is used to generate and visualize the attack path with the highest risk value of weak passwords as the optimal attack path.

[0144] It should be noted that the enterprise network weak password assessment system based on logical attack graph and password assessment of the present invention corresponds one to one with the enterprise network weak password assessment method based on logical attack graph and password assessment of the present invention. The technical features and beneficial effects described in the embodiment of the above-mentioned enterprise network weak password assessment method based on logical attack graph and password assessment are applicable to the embodiment of the enterprise network weak password assessment system based on logical attack graph and password assessment. For specific contents, please refer to the description in the embodiment of the method of the present invention, which will not be repeated here. This is hereby declared.

[0145] In addition, in the implementation of the enterprise network weak password assessment system based on logical attack graph and password assessment in the above-mentioned embodiment, the logical division of each program module is only an example. In actual applications, the above-mentioned functions can be assigned to different program modules as needed, for example, for the configuration requirements of the corresponding hardware or the convenience of software implementation. That is, the internal structure of the enterprise network weak password assessment system based on logical attack graph and password assessment is divided into different program modules to complete all or part of the functions described above.

[0146] Example 3

[0147] See also Fig.11 In one embodiment, an electronic device that implements a method for evaluating weak passwords in an enterprise network based on a logical attack graph and password evaluation is provided. The electronic device may include a first processor, a first memory, and a bus. It may also include a computer program stored in the first memory and executable on the first processor, such as an enterprise network weak password evaluation program based on a logical attack graph and password evaluation.

[0148] Among them, the first memory includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the first memory can be an internal storage unit of an electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the first memory can also be an external storage device of an electronic device, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the first memory can also include both an internal storage unit of the electronic device and an external storage device. The first memory can not only be used to store application software and various types of data installed in the electronic device, such as the code of the enterprise network weak password assessment program based on the logical attack graph and password assessment, but also can be used to temporarily store data that has been output or is to be output.

[0149] In some embodiments, the first processor may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips, etc. The first processor is the control core (ControlUnit) of the electronic device, and uses various interfaces and lines to connect various components of the entire electronic device, and executes or executes programs or modules stored in the first memory (such as enterprise network weak password assessment programs based on logical attack graphs and password assessments, etc.), and calls data stored in the first memory to execute various functions of the electronic device and process data.

[0150] Fig.11 Only an electronic device with components is shown, and those skilled in the art will understand that Fig.11 The structure shown does not constitute a limitation on the electronic device, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0151] The enterprise network weak password assessment program based on logical attack graph and password assessment stored in the first memory of the electronic device is a combination of multiple instructions, and when running in the first processor, can achieve:

[0152] Step 1: Logical attack graph construction:

[0153] Collect the network topology, security policies and system configuration of the enterprise intranet, combine the reasoning rules mapped by the ATT&CK knowledge base, and use the MulVAL tool to perform logical reasoning to obtain a logical attack graph;

[0154] Step 2: Password strength assessment:

[0155] Obtain system account password information of each host in the enterprise intranet, calculate password entropy and simulate password cracking time to evaluate the password risk value;

[0156] Step 3: Attack path restoration:

[0157] The password risk value is associated with the logical attack graph to generate a new weighted attack graph containing the password risk value;

[0158] Identify the attack starting point and attack target point in the weighted attack graph;

[0159] Use the depth-first search algorithm to traverse all attack paths in the weighted attack graph and calculate the risk value of weak passwords involved in each attack path;

[0160] The attack path with the highest risk value of weak passwords is taken as the optimal attack path, which is generated and visualized.

[0161] Furthermore, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0162] Example 4

[0163] In one embodiment, a computer-readable storage medium is provided, which stores a program in a memory. When the program is executed by a processor, the enterprise network weak password assessment method based on logical attack graph and password assessment is implemented, specifically:

[0164] Step 1: Logical attack graph construction:

[0165] Collect the network topology, security policies and system configuration of the enterprise intranet, combine the reasoning rules mapped by the ATT&CK knowledge base, and use the MulVAL tool to perform logical reasoning to obtain a logical attack graph;

[0166] Step 2: Password strength assessment:

[0167] Obtain system account password information of each host in the enterprise intranet, calculate password entropy and simulate password cracking time to evaluate the password risk value;

[0168] Step 3: Attack path restoration:

[0169] The password risk value is associated with the logical attack graph to generate a new weighted attack graph containing the password risk value;

[0170] Identify the attack starting point and attack target point in the weighted attack graph;

[0171] Use the depth-first search algorithm to traverse all attack paths in the weighted attack graph and calculate the risk value of weak passwords involved in each attack path;

[0172] The attack path with the highest risk value of weak passwords is used as the optimal attack path, generated and visualized. A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it may include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0173] Example 5

[0174] In yet another embodiment, a computer program product is provided, including a computer program / instruction, which, when executed by a processor, implements the enterprise network weak password assessment method based on logical attack graph and password assessment in the above embodiment.

[0175] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0176] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. An enterprise network weak password assessment method based on logical attack graph and password assessment, characterized in that: The steps include: Step 1: Logical attack graph construction: Collect the network topology, security policies and system configuration of the enterprise intranet, combine the reasoning rules mapped by the ATT&CK knowledge base, and use the MulVAL tool to perform logical reasoning to obtain a logical attack graph; Step 2: Password strength assessment: Obtain system account password information of each host in the enterprise intranet, calculate password entropy and simulate password cracking time to evaluate the password risk value; Step 3: Attack path restoration: The password risk value is associated with the logical attack graph to generate a new weighted attack graph containing the password risk value; Identify the attack starting point and attack target point in the weighted attack graph; Use the depth-first search algorithm to traverse all attack paths in the weighted attack graph and calculate the risk value of weak passwords involved in each attack path; The attack path with the highest risk value of weak passwords is taken as the optimal attack path, which is generated and visualized.

2. The enterprise network weak password assessment method based on logical attack graph and password assessment according to claim 1 is characterized in that: The steps for constructing the inference rules for the ATT&CK knowledge base mapping are as follows: The tactics in the ATT&CK knowledge base are screened and divided into three categories according to the preparations before the attack, the methods used during the attack, and the behaviors after the attack is successful; Select technically valid accounts included in both tactical initial access and lateral movement as the main attack methods for attackers to launch attacks and move laterally in the network as core attack reasoning rules; Using tactical privilege escalation as an auxiliary rule in the attack process indicates the attacker's privilege escalation behavior; Persistence, execution, and discovery of tactics as possible behaviors after a successful attack; Inferring tactical collection from tactical discovery and then tactical leakage indicates a series of actions by the attacker to discover, collect, and leak important information data on the victim's host; Tactical impact is inferred from tactical execution and discovery, indicating the impact that the attack will have.

3. The enterprise network weak password assessment method based on logical attack graph and password assessment according to claim 1 is characterized in that: The password strength assessment steps are: Obtain the system account password of each host in the enterprise intranet; The password entropy of each host is calculated based on the password length and character type of the system account password of each host. The formula is: E = log 2( N L )， in, E is the password entropy, N is the size of the password character set, L is the password length; The password cracking time is simulated based on the password length and character type of the system account password of each host. The formula is: in, T is the password cracking time, R is the computing power per second, n is the number of character types involved in the password character set, C i Indicates the first character in the password character set. i The size of the class character; The password entropy and password cracking time are weighted and normalized to obtain the password risk value: in, P is the password risk value, α , β is an adjustable weight coefficient, γ is the scaling parameter.

4. The enterprise network weak password assessment method based on logical attack graph and password assessment according to claim 3 is characterized in that: The password entropy considers the password's constituent elements, consecutive characters, repeated characters, and common character sequences that reflect keyboard input habits to award or penalize points; The bonus score is related to the password length, character weight, and number of character types, expressed as: in, S length is the bonus score calculated based on the password length, L is the password length, k is the weight corresponding to the password length, S max Score the maximum length, S case Bonus points are calculated based on the case of the password. If the password contains both uppercase and lowercase letters, bonus points will be given. x , if the password contains uppercase or lowercase letters, give bonus points y ; upper count The number of uppercase letters in the password. lower count The number of lowercase letters in the password; The penalty score is related to the regularity of the characters in the dictionary and is expressed as: in, S consecutive is the penalty score for password regularity, regular pattern detected Indicates that regular characters from the dictionary are detected in the password.

5. The enterprise network weak password assessment method based on logical attack graph and password assessment according to claim 1 is characterized in that: The generating of a new weighted attack graph including a password risk value is specifically as follows: Read the logical attack graph file, filter the node information and store it in the node set, and store the rest of the information in the edge set; the node information of each node in the node set includes the node number, node type, node name and parameters, node weight, predecessor node and successor node; the edge information of each edge in the edge set includes the starting node, target node and edge weight; the node types include And, Leaf and Or, among which the And type node is a rule node, the Leaf type node is a fact node, and the Or type node is a derived fact node; the Leaf type node represents the set network environment and network configuration initial fact conditions; the And type node represents the logical reasoning rule, whose parent node is a Leaf type node or an Or type node as its reasoning condition, and the child node is an Or type node; the Or type node represents the new attack fact result obtained after all the conditions of the rule are met; Filter Or type nodes. First, determine whether the node name involves login behavior. If so, match the password and password risk value of the host according to the host number in the node parameters, and replace the node weight of the node with the password risk value after evaluation of the node. The call graph visualization software generates a new weighted attack graph that includes password risk values.

6. The enterprise network weak password assessment method based on logical attack graph and password assessment according to claim 1 is characterized in that: The depth-first search algorithm is used to traverse all attack paths in the weighted attack graph, and the risk value of weak passwords involved in each attack path is calculated, specifically: Determine the positions of the starting node and the ending node of the weighted attack graph; Starting from the starting node, recursively visit each unvisited successor node one by one, and continue to go deeper along the path until reaching the end; during the exploration process, the traversed successor nodes are marked as visited nodes, and And type nodes are specially marked, and the weights of Or type nodes are accumulated and recorded; When the search reaches the termination node or encounters a node without a successor node, the entire path and its accumulated weight are saved, and the accumulated weight is defined as the final risk value of the path, which is calculated by accumulating the weights of all Or type nodes on the path; Then, trace back from the last node of the path to the previous And type node to check whether it has other unvisited parent nodes, and continue searching until all possible paths are fully visited and recorded to ensure full coverage analysis of all potential risk paths in the attack graph.

7. Enterprise network weak password assessment system based on logical attack graph and password assessment, characterized by: It includes a logic attack graph construction module, a password strength assessment module, an association combination module, a point recognition module, a path search module and a visualization module; The logical attack graph construction module is used to collect the network topology, security policy and system configuration of the enterprise intranet, combine the reasoning rules mapped by the ATT&CK knowledge base, and use the MulVAL tool to perform logical reasoning to obtain the logical attack graph; The password strength assessment module is used to obtain the system account password information of each host in the enterprise intranet, calculate the password entropy and simulate the password blasting time, and evaluate the password risk value; The association and combination module is used to associate and combine the password risk value with the logical attack graph to generate a new weighted attack graph containing the password risk value; The point identification module is used to identify the attack starting point and the attack target point in the weighted attack graph; The path search module is used to traverse all attack paths in the weighted attack graph using a depth-first search algorithm, and calculate the risk value of weak passwords involved in each attack path; The visualization module is used to take the attack path with the highest risk value of weak passwords as the best attack path, generate it and perform visualization processing.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory in communication with the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the enterprise network weak password assessment method based on logical attack graph and password assessment as described in any one of claims 1-6.

9. A computer-readable storage medium storing a program, characterized in that: When the program is executed by the processor, the enterprise network weak password assessment method based on logical attack graph and password assessment described in any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the enterprise network weak password assessment method based on logical attack graph and password assessment described in any one of claims 1-6 is implemented.

Images