Enterprise network weak password assessment method based on logical attack graph and password assessment

Abstract

The application discloses a kind of enterprise network weak password evaluation methods based on logic attack graph and password evaluation, first, the network topology structure of enterprise intranet, security policy and system configuration are collected, in combination with the reasoning rule mapped of ATT&CK knowledge base, logic reasoning is carried out using MulVAL tool to obtain logic attack graph;Then the system account password information of each host is obtained, the password entropy is calculated and the password cracking time is simulated to obtain the password risk value;Afterwards, the password risk value is associated with the logic attack graph, a new weighted attack graph containing the password risk value is generated;Attack starting point and attack target point in the weighted attack graph are identified simultaneously;Then, all attack paths in the weighted attack graph are traversed using the depth-first search algorithm, and the weak password risk value on each attack path is calculated;Finally, the attack path with the highest weak password risk value is taken as the best attack path, and a visual process is generated to improve the network security defense level of enterprises.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to an enterprise network weak password evaluation method based on a logical attack graph and password evaluation. BACKGROUND

[0002] In recent years, with the development of network technology, enterprise networks have become increasingly large and complex, and the daily operation of important data, employee information, service products and the like of enterprises also increasingly relies on network systems. The security of enterprise networks has become a serious challenge. In the past few years, thousands of security incidents such as data leakage against enterprises have been reported, causing significant economic losses. Weak password threats are one of the problems of enterprise network security; when employees set weak passwords or use default passwords that are easy to guess, the network system of the enterprise will be at risk of being attacked by hackers, thereby gaining access to important data of the enterprise. In 2013, the American retail giant Target suffered a large-scale data leakage event; attackers used the weak password of a supplier to successfully invade the network system of Target and steal the credit card information and personal data of millions of customers, causing billions of dollars in losses to Target. In 2014, Sony Pictures suffered a catastrophic cyber attack; hackers easily invaded the network system of Sony by taking advantage of the habit of employees using weak passwords, stealing a large amount of sensitive information and releasing many emails and files related to the company's internal secrets. This attack not only caused significant economic losses to Sony, but also had a serious negative impact on the company's reputation. In the 2023 Network Security Maturity Report, weak passwords accounted for 32% of common risk points, ranking first.

[0003] Weak password attacks have a higher success rate and a wider range of applications compared to other attack methods. Weak password attacks usually do not require particularly complex technology or resources; hackers can easily invade the system using common password cracking tools or simple dictionary attacks, making weak password attacks one of the most commonly used methods by hackers. Secondly, the success rate of weak password attacks is relatively high. According to statistics, most users tend to use simple passwords that are easy to remember, such as birthdays, common words or consecutive numbers, which are easy to guess or crack through brute force attacks. When hackers successfully gain access to the system, they can easily steal, tamper with or destroy important data in the system and conduct horizontal penetration in the enterprise intranet environment through the system, causing serious losses to the enterprise. In the prior art, password entropy [1] is used as an indicator to measure password security strength, and attack graphs [2-3] are used to analyze network system security threats and expand logical attack graphs to analyze and evaluate attack paths in more detail using logical reasoning methods. The logical attack graph uses the famous open source framework MulVAL [4-5]The construction has strong scalability and scalability; the reasoning engine of the MulVAL framework relies on interaction rules, aiming to analyze security threats in a network environment across multiple hosts. Based on the scalability of MulVAL [6] Customized rules can be generated according to different network environment topologies to generate expected attack graphs.

[0004] Although the above work has promoted the development of attack graph-based threat assessment and password strength assessment, there are still problems. First, weak passwords, as the perennial top network security threat, have not received enough attention. Second, MulVAL has not been updated for a long time after being open-sourced, and subsequent research by other scholars is based on the customization and extension of MulVAL reasoning rules, and the initial reasoning rules cannot reflect the current complex network situation. Third, with the development of technology, the improvement of attacker's ability and available resources, the use of password entropy alone to measure password strength cannot well support password assessment.

[0005] References:

[0006] [1] C.E. Shannon, "Amathematical theory of communication," BellSystem Technical Journal, vol. 27, 1948, pp. 379-423, pp.623-656.

[0007] [2] Singha M F, Patgiri R. Acomprehensive investigation on attackgraphs[M] / / Advances in Computers.Elsevier, 2023, 128: 251-272.

[0008] [3] Zenitani K. Attack graphanalysis: an explanatory guide[J].Computers&Security, 2023, 126: 103081.

[0009] [4] Ou X, Govindavajhala S, AppelA W. MulVAL: A logic-based networksecurity analyzer[C] / / USENIX securitysymposium. 2005, 8: 113-128.

[0010] [5] Ou X, Boyer W F, McQueen M A.A scalable approach to attack graph generation[C] / / Proceedings of the 13th ACMconference on Computer andcommunications security. 2006: 336-345.

[0011] [6]Tayouri D, Baum N, Shabtai A, et al. A survey of mulval extensionsand their attack scenarios coverage[J]. IEEE Access, 2023.。 SUMMARY

[0012] The main purpose of the present application is to overcome the shortcomings and deficiencies of the prior art, provide an enterprise network weak password evaluation method based on logical attack graph and password evaluation, aiming to detect weak password security threats in enterprise network, provide support for subsequent research on enterprise network threat analysis based on logical attack graph, and provide a high-efficiency, reliable and automated enterprise network threat analysis scheme for network security analysts.

[0013] In order to achieve the above purpose, the present application provides an enterprise network weak password evaluation method based on logical attack graph and password evaluation, comprising the following steps:

[0014] Step one, logical attack graph construction:

[0015] Collect the network topology structure, security policy and system configuration of the enterprise intranet, combine the reasoning rules of ATT&CK knowledge base mapping, and use the MulVAL tool to perform logical reasoning to obtain a logical attack graph;

[0016] Step two, password strength evaluation:

[0017] Obtain the system account password information of each host in the enterprise intranet, calculate the password entropy and simulate the password cracking time, and evaluate the password risk value;

[0018] Step three, attack path restoration:

[0019] Combine the password risk value with the logical attack graph to generate a new weighted attack graph containing the password risk value;

[0020] Identify the attack starting point and attack target point in the weighted attack graph;

[0021] Using the depth-first search algorithm to traverse all attack paths in the weighted attack graph, calculate the risk value of weak password involved in each attack path;

[0022] The attack path with the highest weak password risk value is the best attack path, and the generation and visualization processing are performed.

[0023] As a preferred technical solution, the construction step of the inference rule of the ATT&CK knowledge base mapping is:

[0024] The tactics in the ATT&CK knowledge base are filtered, and are divided into three categories according to the attack preparation, attack method during the attack, and behavior after the attack is successful;

[0025] Select the technical effective account contained in the initial access and lateral movement of the tactics as the main attack method of the attacker launching the attack and moving laterally in the network, as the core attack inference rule;

[0026] The tactic privilege escalation is used as an auxiliary rule during the attack, indicating the attacker's privilege escalation behavior;

[0027] The tactics persistence, execution, and discovery are used as possible behaviors after the attack is successful;

[0028] The tactics discovery infers the tactics collection and infers the tactics exfiltration, indicating a series of behaviors of the attacker discovering, collecting, and exfiltrating important information data on the victim host;

[0029] The tactics execution and discovery infer the tactics impact, indicating the impact of the attack.

[0030] As a preferred technical solution, the password strength evaluation step is:

[0031] Obtain the system account password of each host in the enterprise intranet;

[0032] Calculate the password entropy of each host according to the password length and character set of the system account password of each host, the formula is:

[0033] E = log 2( N L ),

[0034] Wherein, E is the password entropy, N is the size of the password character set, L is the password length;

[0035] Simulate the password cracking time according to the password length and character set of the system account password of each host, the formula is:

[0036] ,

[0037] wherein, T is the password cracking time, R is the computing power per second, n is the number of character types involved in the password character set, C i represents the size of the i class character contained in the password character set;

[0038] The password risk value is obtained by weighted sum and normalization of the password entropy and the password cracking time:

[0039] ,

[0040] wherein, P is the password risk value, α , β is an adjustable weight coefficient, γ is a scaling parameter.

[0041] As a preferred technical solution, the password entropy considers the composition elements of the password, consecutive characters, repeated characters, and common character sequences reflecting the keyboard input habits for reward scores or penalty scores;

[0042] For the reward score, it is related to the password length, character weight, and character type number, and is expressed as:

[0043] ,

[0044] ,

[0045] wherein, S length is the reward score calculated according to the password length, L is the password length, k is the weight corresponding to the password length, S max is the maximum length score, S case is the reward score calculated according to the case of the password, if the password contains both uppercase and lowercase letters, a reward score of 1 is given, x if the password contains uppercase or lowercase letters, a reward score of 0.5 is given, y ; upper count is the number of uppercase letters in the password, lower count is the number of lowercase letters in the password;

[0046] For the penalty score, it is related to the regular characters in the dictionary, and is expressed as:

[0047] S regular = -z if regularpatterndetected ,

[0048] wherein, S regular is a penalty score of password regularity, regular pattern detected represents that the password occurrence is detected to have regularity in the dictionary.

[0049] As a preferred technical solution, the new weighted attack graph containing password risk values is generated, specifically:

[0050] Read the logical attack graph file, filter node information into a node set, and store the remaining information into an edge set; the node information of each node in the node set includes node number, node type, node name and parameter, node weight, predecessor node and successor node; the edge information of each edge in the edge set includes starting node, target node and edge weight; the node type includes And, Leaf and Or three types, wherein the And type node is a rule node, the Leaf type node is a fact node, and the Or type node is a derived fact node; the Leaf type node represents the set network environment, network configuration initial fact condition; the And type node represents the logical inference rule, and the parent node is the Leaf type node or the Or type node as the inference condition, and the child node is the Or type node; the Or type node represents the new attack fact result obtained after satisfying all conditions of the rule;

[0051] Filter the Or type node, first determine whether the login behavior is involved according to the node name, if involved, match the password and password risk value of the host according to the host number in the parameter of the node, replace the node weight of the node with the password risk value evaluated by the node;

[0052] Call the graph visualization software to generate a new weighted attack graph containing password risk values.

[0053] As a preferred technical solution, the depth-first search algorithm is used to traverse all attack paths in the weighted attack graph, and the weak password risk value involved in each attack path is calculated, specifically:

[0054] Determine the positions of the starting node and the terminal node of the weighted attack graph;

[0055] Starting from the starting node, each unvisited successor node is accessed one by one in a recursive manner, and the path is constantly deepened until the end point is reached; in the exploration process, the traversed successor nodes are marked as visited nodes, and the And type nodes are specially identified, and the weight values of the Or type nodes are accumulated and recorded; when the search reaches the termination node or encounters a node without a successor node, the entire path and the accumulated weight value are saved, and the accumulated weight value is defined as the final risk value of the path, and the calculation method is to accumulate the weight values of all Or type nodes on the path;

[0056] Subsequently, the last node of the path is traced back to the previous And type node, it is checked whether there is another unvisited parent node, and the search is continued until all possible paths are completely accessed and recorded, so as to ensure full coverage analysis of all potential risk paths in the attack graph.

[0057] Another aspect of the present application provides an enterprise network weak password evaluation system based on a logical attack graph and a password evaluation, comprising a logical attack graph construction module, a password strength evaluation module, an association combination module, a point identification module, a path search module and a visualization module.

[0058] The logical attack graph construction module is used to collect the network topology structure, the security policy and the system configuration of the enterprise intranet, combine the reasoning rules of the ATT&CK knowledge base mapping, and use the MulVAL tool to perform logical reasoning to obtain a logical attack graph.

[0059] The password strength evaluation module is used to obtain the system account password information of each host in the enterprise intranet, calculate the password entropy and simulate the password cracking time, and evaluate the password risk value.

[0060] The association combination module is used to associate and combine the password risk value with the logical attack graph to generate a new weighted attack graph containing the password risk value.

[0061] The point identification module is used to identify the attack starting point and the attack target point in the weighted attack graph.

[0062] The path search module is used to traverse all attack paths in the weighted attack graph using a depth-first search algorithm, and calculate the weak password risk value involved in each attack path.

[0063] The visualization module is used to generate and visualize the attack path with the highest weak password risk value as the best attack path.

[0064] Another aspect of the present application also provides an electronic device, comprising:

[0065] at least one processor; and a memory connected in communication with the at least one processor; wherein

[0066] The memory stores computer program instructions executable by the at least one processor, and the computer program instructions are executed by the at least one processor to enable the at least one processor to perform the enterprise network weak password evaluation method based on the logical attack graph and the password evaluation.

[0067] The application provides a computer readable storage medium storing a program, and the program is executed by a processor to implement the enterprise network weak password evaluation method based on the logical attack graph and the password evaluation.

[0068] The application further provides a computer program product comprising computer programs / instructions, and the computer programs / instructions are executed by a processor to implement the enterprise network weak password evaluation method based on the logical attack graph and the password evaluation.

[0069] Compared with the prior art, the application has the following advantages and beneficial effects:

[0070] The application provides an enterprise network weak password evaluation method based on a logical attack graph and a password evaluation, which is based on a logical attack graph and a password evaluation technology. BRIEF DESCRIPTION OF DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0072] Figure 1 The application provides an enterprise network weak password evaluation method based on a logical attack graph and a password evaluation, which is based on a logical attack graph and a password evaluation technology.

[0073] Figure 2 The application provides an enterprise network weak password evaluation method based on a logical attack graph and a password evaluation, which is based on a logical attack graph and a password evaluation technology.

[0074] Figure 3 Fig. 1 is a diagram of reasoning of MulVAL tool in an embodiment of the present application.

[0075] Figure 4 Fig. 2 is a flow chart of password strength assessment in an embodiment of the present application.

[0076] Figure 5 Fig. 3 is a flow chart of attack path restoration in an embodiment of the present application.

[0077] Figure 6 Fig. 4 is a pseudo code chart of depth-first search algorithm in an embodiment of the present application.

[0078] Figure 7 Fig. 5 is a structure chart of enterprise network weak password assessment system based on logical attack graph and password assessment in an embodiment of the present application.

[0079] Figure 8 Fig. 6 is a structure chart of electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0080] In order to make the personnel in the art better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all the other embodiments obtained by the personnel in the art without creative labor are within the protection scope of the present application.

[0081] In the present application, the phrase "embodiment" means that the specific features, structures or characteristics described in connection with the embodiment can be contained in at least one embodiment of the present application. The phrase appears in various places in the specification does not necessarily mean the same embodiment, nor is it an independent or alternative embodiment to other embodiments. The personnel in the art explicitly and implicitly understand that the embodiments described in the present application can be combined with other embodiments.

[0082] Weak password has been one of the most prominent threats in the field of network security. Enterprise network environment is complex and huge, and the threat assessment based on logical attack graph in specific scene does not involve specific weak password threat scene. In order to meet the demand of enterprise network threat assessment and analysis, such as Figure 1 As shown in the figure, the embodiment provides a weak password assessment method for enterprise network based on logical attack graph and password assessment, which comprises the following steps:

[0083] Step one, logical attack graph construction:

[0084] The network topology structure, security policy and system configuration of the enterprise intranet are collected, logical reasoning is performed using a MulVAL tool in combination with reasoning rules of an ATT&CK knowledge base, and a logical attack graph is obtained.

[0085] Further, the ATT&CK framework serves as a universal language and detailed knowledge graph, sets a standard for describing intrusion behaviors, and can systematically record the strategies and technical means of attackers in the intrusion process by virtue of in-depth analysis of attack events occurring in the real world, thereby constructing a rich knowledge base. In the present application, the construction steps of the reasoning rules of the ATT&CK knowledge base mapping are as follows:

[0086] Firstly, the tactics in the ATT&CK knowledge base are screened and divided into three categories according to pre-attack preparation, attack process and post-attack behavior; since the present application is directed to generating an attack graph for the risk of weak passwords in an enterprise network, the tactics and technologies related to the Internet are not considered.

[0087] Secondly, considering that each tactic contains several technologies and the technologies contain a large number of subdivided sub-technologies, the technology of valid account commonly contained in the tactics of initial access and lateral movement is selected as the main attack mode for the attacker to launch an attack and move laterally in the network, and as the core attack reasoning rule. The rest is only represented by the tactic, that is, the attacker may use one or more technologies under the tactic.

[0088] Finally, the tactic of privilege escalation is taken as an auxiliary rule in the attack process, representing the behavior of the attacker to escalate privileges. The tactics of persistence, execution and discovery are taken as possible behaviors after the attack is successful. The tactic of discovery is inferred to the tactic of collection and the tactic of exfiltration, representing a series of behaviors of the attacker to discover, collect and exfiltrate important information data on the victim host. The tactics of execution and discovery are inferred to the tactic of impact, representing the impact of the attack.

[0089] The reasoning rules mapped from 13 tactics of the ATT&CK (Enterprise-v15.1) knowledge base in the present embodiment are shown in Table 1 as follows:

[0090] Table 1 Reasoning rules of ATT&CK mapping

[0091]

[0092] In addition, in order to more reasonably restore the access, organization structure and connection of each host and server in the network topology, reasoning rules such as hostAccess, gatewayAccess and sameNet are designed to show the connection between hosts and the communication relationship between hosts in different network segments.

[0093] Further, the input of the MulVAL tool needs to include the architecture details and constituent elements of the target network, which lays a solid foundation for subsequent environment reasoning, including but not limited to the basic topology of the target network, which is used to depict the logical connection relationship between network resources; at the same time, the basic information of each host server in the network system should be collected, such as the type of operating system, running services, installed software and version number, security configuration, etc., which is particularly critical for simulating security scenarios in the real world. In order to efficiently generate attack graphs and ensure that they accurately reflect complex network environments and potential threats, a set of predicates corresponding to reasoning rules and their parameters need to be designed to standardize and normalize all necessary input information, including host information, connection information, vulnerability information, gateway information, attacker information, etc. More information can be added to the predicate as the demand updates. In this embodiment, the specific predicate templates are shown in Table 2:

[0094] Table 2 Predicate Template

[0095]

[0096] As shown in Figure 2 , 3 , the collected network topology structure, security policy and system configuration and other basic information are used as the input file of the MulVAL tool by referring to the predicate template construction file. The predicate information input by the MulVAL tool is inferred by referring to the reasoning rules mapped by the ATT&CK knowledge base. The reasoning rules set the conditions that need which predicates to constitute, and according to the input predicate information, the conditions required by the reasoning rules are matched. If the conditions are met, the corresponding reasoning facts are inferred, and the attack path is obtained by logical reasoning. According to the node path information, a logical attack graph is generated.

[0097] Step two, password strength assessment:

[0098] The system account password information of each host in the enterprise intranet is obtained, the password entropy is calculated, and the password cracking time is simulated to evaluate the password risk value.

[0099] Further, the present application evaluates the strength of user passwords from two angles of password entropy and brute force password cracking time, respectively calculates the entropy value and cracking time according to the password composition length, complexity, and character type, and evaluates the strength of user passwords, such as Figure 4 As shown, the specific steps are as follows:

[0100] 2.1, first, obtain the system account password of each host in the enterprise intranet;

[0101] 2.2, then, calculate the password entropy of each host according to the password length and character type of the system account password of each host, and the formula is:

[0102] E = log 2( N L ),

[0103] Among them, E is the password entropy, N is the size of the password character set, L is the password length.

[0104] In the field of cryptography, entropy is a key indicator of the uncertainty and unpredictability of a password or key; high entropy means that the password exhibits extremely high randomness and complexity characteristics, thereby significantly improving the ability to resist guessing or brute force attacks. In order to further enhance the accuracy and comprehensiveness of the evaluation, based on the idea of password entropy, the evaluation dimension of password strength is expanded to multiple levels on the basis of the original character set and password length, including the length of the password, whether to mix uppercase and lowercase letters, whether to contain numbers and special symbols, and the combination of these elements; the evaluation system of password strength not only considers the composition elements of the password, but also carries out deduction processing for continuous characters, repeated characters and common sequences reflecting keyboard input habits, in order to simulate the potential threats faced by passwords in the real world, the following are the key considerations in the evaluation:

[0105] a. Length and character set: the longer the password and the richer the character set used (including uppercase and lowercase letters, numbers and symbols), the higher the evaluation value. Let the password length be L , k is the weight corresponding to the password length, to change the influence of the password length on the final result (in this embodiment k =7), S max is the maximum length score (in this embodiment S max =1000), the number is reduced to reduce the weight; set the reward points x 、 y , when the number of character sets contained in the password meets the condition, give the reward points:

[0106] ,

[0107] ,

[0108] wherein, S length is the reward score calculated according to the length of the password, S case is the reward score calculated according to the case of the password, if the password contains both uppercase and lowercase letters, the reward score is x , if the password contains either uppercase or lowercase letters, the reward score is y ; upper count is the number of uppercase letters in the password, lower count is the number of lowercase letters in the password.

[0109] b. Avoid regularity: consecutive characters (such as "123"), repeated characters (such as "aaa") and common keyboard patterns (such as "qwerty") will reduce the entropy of the password, so they will be penalized in the evaluation. Set the penalty score z , set the dictionary to store common keyboard habits, call the dictionary for matching when detecting, and penalize when detecting that the password contains regular characters in the dictionary (such as consecutive, repeated characters):

[0110] S regular = - z if regularpatterndetected ,

[0111] wherein, S regular is the penalty score of the password regularity; if the condition after, that is, regular pattern detected , indicates that the password contains regular characters in the dictionary.

[0112] 2.3, according to the password length and character type of the system account password of each host, simulate the password cracking time; simulate the computing power of personal computer per second (about 40000000), set the password length as L , the computing power per second is R (i.e. the number of attempts per second when cracking the password), then the cracking time of the password is T The calculation formula can be expressed as:

[0113] ,

[0114] wherein, n is the number of character types involved in the password character set, C iindicates the number of the character included in the password character set i The size of the character, such as lowercase letters, uppercase letters, numbers, symbols, etc.

[0115] 2.4, Finally, the password cracking time T Reflect the attack resistance of the password, the password entropy of each host E Represent the complexity of the password, the risk value of the password is obtained by weighted sum of two values and normalization processing P :

[0116] ,

[0117] Among them, α , β is an adjustable weight coefficient, γ is a scaling parameter.

[0118] Step three, attack path restoration:

[0119] As shown in Figure 5 , the present application provides an efficient attack path analysis method based on directed graph, which generates attack path and path risk by analyzing attack graph, and visualizes the results, the specific steps are:

[0120] 3.1, the password risk value is associated with the logical attack graph to generate a new weighted attack graph containing the password risk value, specifically:

[0121] Read the logical attack graph file, filter the node information into the node set, and store the rest of the information into the edge set; wherein the node information of each node in the node set includes node number, node type, node name, node parameter, node weight, predecessor node and successor node, etc.; the edge information of each edge in the edge set includes starting node, target node and edge weight, etc.; wherein the node type has three types of And, Leaf and Or, the node of And type is a rule node, the node of Leaf type is a fact node, and the node of Or type is a derived fact node; the node of Leaf type represents the initial fact condition of the set network environment, network configuration, etc.; the node of And type represents the logical reasoning rule, and the parent node is the Leaf type node or Or type node as the reasoning condition, and the child node is the Or type node; the node of Or type represents the new attack fact result obtained after meeting all the conditions of the rule;

[0122] Filter the Or type node, judge whether it involves login behavior according to the node name, if it involves, match the password and password risk value of the host according to the host number in the node parameter, and replace the node weight of the node with the password risk value of the host;

[0123] The call graph visualization software generates a new weighted attack graph containing the password risk values.

[0124] In this embodiment, the logical attack graph file is stored in a dot text file. The node information in the dot text is filtered and stored in a node set according to the "label". The node set is configured with node number (id), node type (type), node name and parameter (fact), node parameter, node weight (metric), predecessor node (prior), and successor node (next), and the like. The remaining information is stored in an edge set, which is configured with start node (src), target node (dst), edge weight (rate), and the like. Then, Or-type nodes are filtered. According to the fact, nodes related to login behavior (i.e., two types of initialLogin and lateralLogin) are determined. According to the information in the fact parameter, a matching host and password are found. The metric value of the node is replaced with the risk value after the password is evaluated. Graphviz is called to regenerate the graph.

[0125] 3.2, identify the attack starting point and attack target point in the weighted attack graph.

[0126] 3.3, use a depth-first search algorithm to traverse all attack paths in the weighted attack graph (pseudo code is shown in Figure 6 The risk value of each attack path involving weak passwords is calculated, which is:

[0127] According to the attack graph file information of the weighted attack graph, the positions of the starting node and the terminating node of the weighted attack graph are determined;

[0128] Starting from the starting node, each unvisited successor node is accessed one by one in a recursive manner, and the path is continuously deepened until the end point is reached. In the exploration process, the traversed successor nodes are marked as visited nodes, and the And-type nodes are specially identified. At the same time, the weights of the Or-type nodes are accumulated and recorded. When the search reaches the terminating node or encounters a node without a successor node, the entire path and its cumulative weight are saved, and the cumulative weight is defined as the final risk value of the path. The calculation method is to accumulate the weights of all Or-type nodes on the path.

[0129] Subsequently, the last node of the path is traced back to the previous And-type node, and it is checked whether there are other unvisited parent nodes. The search continues until all possible paths are completely accessed and recorded, to ensure full coverage analysis of all potential risk paths in the attack graph.

[0130] 3.4, the attack path with the highest weak password risk value is taken as the best attack path, and is generated and visualized.

[0131] This application visualizes the best attack path, generates and outputs the best attack path diagram. The bottom of the diagram shows the sum of the password risk values ​​for the entire path, indicating that the path involves the highest weak password risk value and is the easiest to be broken by attackers.

[0132] In summary, on the one hand, this invention constructs a logical attack graph from a new perspective, combining textual information related to ATT&CK's strategy, tactics, and technical analysis. It integrates inference rules mapping weak password threats as the core, representing network attacks as single-step behavioral tactics and techniques. The MulVAL tool is used to generate a logical attack graph based on the created inference rules. On the other hand, this invention evaluates password strength based on password entropy and password brute-force time. Furthermore, it reconstructs attack paths through a DFS-based attack graph highest-risk path filtering method, generating an attack graph with the highest weak password risk value. This enhances the enterprise's network security defense level and reduces direct economic losses caused by data breaches and network attacks.

[0133] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.

[0134] Example 2

[0135] Based on the same idea as the enterprise network weak password assessment method based on logic attack graphs and cryptographic evaluation in the above embodiments, the present invention also provides an enterprise network weak password assessment system based on logic attack graphs and cryptographic evaluation. This system can be used to execute the above-described enterprise network weak password assessment method based on logic attack graphs and cryptographic evaluation. For ease of explanation, the structural diagram of the embodiment of the enterprise network weak password assessment system based on logic attack graphs and cryptographic evaluation only shows the parts related to the embodiments of the present invention. Those skilled in the art will understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0136] like Figure 7 As shown, another embodiment of the present invention provides an enterprise network weak password assessment system based on logic attack graphs and password evaluation, including a logic attack graph construction module, a password strength evaluation module, an association and combination module, a point identification module, a path search module, and a visualization module;

[0137] The logic attack graph construction module is used to collect the network topology, security policies and system configuration of the enterprise intranet, and combine the reasoning rules mapped by the ATT&CK knowledge base to use the MulVAL tool to perform logical reasoning to obtain the logic attack graph.

[0138] The password strength evaluation module is configured to obtain system account password information of each host in the enterprise intranet, calculate password entropy and simulate password cracking time, and evaluate a password risk value;

[0139] The association combining module is configured to associate and combine the password risk value with the logical attack graph to generate a new weighted attack graph containing the password risk value;

[0140] The point identification module is configured to identify an attack starting point and an attack target point in the weighted attack graph;

[0141] The path search module is configured to use a depth-first search algorithm to traverse all attack paths in the weighted attack graph and calculate a weak password risk value on each attack path;

[0142] The visualization module is configured to generate and visualize a best attack path with the highest weak password risk value.

[0143] It should be noted that the enterprise network weak password evaluation system based on the logical attack graph and the password evaluation of the present application corresponds to the enterprise network weak password evaluation method based on the logical attack graph and the password evaluation of the present application. The technical features and advantages described in the above embodiment of the enterprise network weak password evaluation method based on the logical attack graph and the password evaluation are applicable to the embodiment of the enterprise network weak password evaluation system based on the logical attack graph and the password evaluation. For specific content, please refer to the description in the method embodiment. Here, no further description is given, and this is hereby declared.

[0144] In addition, in the implementation of the enterprise network weak password evaluation system based on the logical attack graph and the password evaluation of the above embodiment, the logical division of each program module is only an example. In actual application, the above functions can be completed by different program modules according to the needs, for example, according to the configuration requirements of the corresponding hardware or the convenience of software implementation. That is, the internal structure of the enterprise network weak password evaluation system based on the logical attack graph and the password evaluation is divided into different program modules to complete all or part of the functions described above.

[0145] Embodiment 3

[0146] Please refer to Figure 8 In one embodiment, an electronic device implementing the enterprise network weak password evaluation method based on the logical attack graph and the password evaluation is provided. The electronic device can include a first processor, a first memory, and a bus. It can also include a computer program stored in the first memory and executable on the first processor, such as an enterprise network weak password evaluation program based on the logical attack graph and the password evaluation.

[0147] The first memory includes at least one type of readable storage medium, such as flash memory, a mobile hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the first memory can be an internal storage unit of the electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the first memory can also be an external storage device of the electronic device, such as a plug-in mobile hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the first memory can include both an internal storage unit and an external storage device of the electronic device. The first memory can be used to store application software and various data installed in the electronic device, such as the code of the enterprise network weak password evaluation program based on a logic attack graph and password evaluation, and can also be used to temporarily store data that has been output or will be output.

[0148] The first processor can be composed of an integrated circuit in some embodiments, such as a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same function or different functions, including one or more combinations of a central processing unit (CPU), a microprocessor, a digital processing chip, a graphics processor, and various control chips, etc. The first processor is the control unit of the electronic device, and is connected to various components of the electronic device through various interfaces and lines, and executes various functions and processes data of the electronic device by running or executing programs or modules stored in the first memory (such as the enterprise network weak password evaluation program based on a logic attack graph and password evaluation), and calling data stored in the first memory.

[0149] Figure 8 Only the electronic device with components is shown, and those skilled in the art can understand that, Figure 8 The structure shown does not constitute a limitation on the electronic device, and can include fewer or more components than shown, or combine certain components, or different component arrangements.

[0150] The enterprise network weak password evaluation program based on a logic attack graph and password evaluation stored in the first memory of the electronic device is a combination of a plurality of instructions, which, when running in the first processor, can achieve:

[0151] Step 1, logic attack graph construction:

[0152] Collect the network topology structure, security policy and system configuration of the enterprise intranet, combine the reasoning rules of the ATT&CK knowledge base mapping, and use the MulVAL tool to perform logical reasoning to obtain a logical attack graph;

[0153] Step two, password strength evaluation:

[0154] Obtain the system account password information of each host in the enterprise intranet, calculate the password entropy and simulate the password cracking time, and evaluate to obtain the password risk value;

[0155] Step three, attack path restoration:

[0156] Combine the password risk value with the logical attack graph to generate a new weighted attack graph containing the password risk value;

[0157] Identify the attack starting point and attack target point in the weighted attack graph;

[0158] Use a depth-first search algorithm to traverse all attack paths in the weighted attack graph, and calculate the weak password risk value involved in each attack path;

[0159] The attack path with the highest weak password risk value is the best attack path, and a new attack path is generated and visualized.

[0160] Further, the modules / units of the electronic device, if implemented in the form of software function units and sold or used as independent products, can be stored in a non-volatile computer readable storage medium. The computer readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory).

[0161] Embodiment 4

[0162] In one embodiment, a computer readable storage medium is provided, which stores a program in the memory, and the program is executed by the processor to implement the enterprise network weak password evaluation method based on the logical attack graph and password evaluation, specifically:

[0163] Step one, logical attack graph construction:

[0164] Collect the network topology structure, security policy and system configuration of the enterprise intranet, combine the reasoning rules of the ATT&CK knowledge base mapping, and use the MulVAL tool to perform logical reasoning to obtain a logical attack graph;

[0165] Step two, password strength evaluation:

[0166] Obtaining system account password information of each host in the enterprise intranet, calculating password entropy and simulating password cracking time, and evaluating a password risk value;

[0167] Step three, attack path restoration:

[0168] The password risk value is associated with the logical attack graph to generate a new weighted attack graph containing the password risk value;

[0169] Identifying the attack starting point and the attack target point in the weighted attack graph;

[0170] Using a depth-first search algorithm to traverse all attack paths in the weighted attack graph and calculating the weak password risk value involved in each attack path;

[0171] The attack path with the highest weak password risk value is taken as the best attack path, and a new attack path is generated and visualized. Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware. The program can be stored in a non-volatile computer readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments. Any reference to memory, storage, database or other medium used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM) and memory bus dynamic RAM (RDRAM).

[0172] Embodiment 5

[0173] In still another embodiment, a computer program product is provided, including computer programs / instructions, which, when executed by a processor, implement the enterprise network weak password evaluation method based on the logical attack graph and password evaluation in the above-mentioned embodiments.

[0174] Any technical features in the above embodiments can be combined, and for the sake of brevity, not all possible combinations are described above, however, any combination of the technical features is deemed to be within the scope of the present disclosure.

[0175] The above embodiments are preferred embodiments of the present application, but the embodiments of the present application are not limited to the above embodiments, and any changes, modifications, substitutions, combinations, simplifications, etc. made without departing from the spirit and principles of the present application are deemed to be equivalent replacement manners and are included in the protection scope of the present application.

Claims

1. A method for weak password assessment of enterprise network based on logical attack graph and password assessment, characterized in that, Comprising the following steps: Step one, logical attack graph construction: Collect the network topology structure, security policy and system configuration of the enterprise intranet, combine the reasoning rules of ATT&CK knowledge base mapping, use MulVAL tool for logical reasoning to obtain a logical attack graph; Step two, password strength assessment: Obtain the system account password information of each host in the enterprise intranet, calculate the password entropy and simulate the password cracking time to obtain the password risk value; The password strength assessment step is: Obtain the system account password of each host in the enterprise intranet; According to the password length and character type of the system account password of each host, the password entropy of each host is calculated, and the formula is: E = log 2( N L )， wherein, E is the password entropy, N is the size of the password character set, L is the password length; According to the password length and character type of the system account password of each host, the password cracking time is simulated, and the formula is: ， in, T For the time required to brute-force the password, R In terms of computing power per second, n The number of character types involved in the cryptographic character set. C i Indicates the first character contained in the password character set. i Size of class characters; The weighted sum of the password entropy and the password cracking time is normalized to obtain the password risk value: ， wherein P is a password risk value, α , β is an adjustable weight coefficient, Step three, attack path restoration: is a scaling parameter; Combine the password risk value with the logical attack graph to generate a new weighted attack graph containing the password risk value; Identify the attack starting point and attack target point in the weighted attack graph; Use the depth-first search algorithm to traverse all attack paths in the weighted attack graph, calculate the weak password risk value involved in each attack path; The attack path with the highest weak password risk value is the best attack path, and the visualization processing is generated. The construction steps of the reasoning rules of the ATT&CK knowledge base mapping are:

2. The enterprise network weak password evaluation method based on logic attack graph and password evaluation of claim 1, wherein, Filter the tactics in the ATT&CK knowledge base, and divide them into three categories according to the attack preparation, attack method during the attack, and behavior after the attack is successful; Select the technical effective account contained in the tactics initial access and lateral movement as the main attack method of the attacker launching the attack and moving laterally in the network, as the core attack reasoning rule; Take the tactics privilege escalation as the auxiliary rule during the attack process, which represents the attacker's privilege escalation behavior; Take the tactics persistence, execution, and discovery as possible behaviors after the attack is successful; Reason from the tactics discovery to the tactics collection and the tactics exfiltration, which represents a series of behaviors of the attacker discovering, collecting, and exfiltrating important information data on the victim host; Reason from the tactics execution and discovery to the tactics impact, which represents the impact of the attack. The password entropy considers the composition elements of the password, consecutive characters, repeated characters, and common character sequences reflecting the keyboard input habits to give bonus points or penalty points; 3. The enterprise network weak password evaluation method based on logic attack graph and password evaluation of claim 1, wherein, For bonus points, it is related to password length, character weight, and character type number, and is represented as: For penalty points, it is related to regular characters in the dictionary, and is represented as: ， ， wherein, S length is a reward score calculated according to the password length, L is the password length, k is a weight corresponding to the password length, S max is a maximum length score, S case is a reward score calculated according to the case of the password, if the password contains both uppercase and lowercase letters, a reward score is given x , if the password contains uppercase or lowercase letters, a reward score is given y ; The new weighted attack graph containing the password risk value is generated, which is: is the number of uppercase letters contained in the password, ​ is the number of lowercase letters contained in the password; ​ S regular = - ​ ， wherein, S regular is a penalty score for password regularity, z is a set penalty score, ​ indicates that the detected password exhibits characters in the dictionary that are regular.

4. The enterprise network weak password evaluation method based on logic attack graph and password evaluation of claim 1, wherein, ​ The reading logic attacks graph file, filters node information into a node set, and stores the rest of the information into an edge set; the node information of each node in the node set includes node number, node type, node name and parameter, node weight, predecessor node and successor node; the edge information of each edge in the edge set includes starting node, target node and edge weight; the node type includes And, Leaf and Or three types, wherein the And type node is a rule node, the Leaf type node is a fact node, and the Or type node is a derived fact node; the Leaf type node represents the set network environment, network configuration initial fact condition; the And type node represents the logical reasoning rule, and the parent node of the And type node is the Leaf type node or the Or type node as the reasoning condition, and the child node of the And type node is the Or type node; the Or type node represents the new attack fact result obtained after meeting all the conditions of the rule; The Or type node is filtered, and whether the login behavior is involved is first judged according to the node name. If the login behavior is involved, the password and the password risk value of the host are matched according to the host number in the parameter of the node, the node weight of the node is replaced by the password risk value after the node is evaluated, and the password risk value of the host is matched according to the host number in the parameter of the node. The graph visualization software is called to generate a new weighted attack graph containing the password risk value.

5. The enterprise network weak password evaluation method based on logic attack graph and password evaluation of claim 1, wherein, The depth-first search algorithm is used to traverse all attack paths in the weighted attack graph, and the weak password risk value involved in each attack path is calculated, specifically as follows: The positions of the starting node and the terminal node of the weighted attack graph are determined. Starting from the starting node, each unvisited successor node is visited one by one in a recursive manner, and the path is continuously deepened until the terminal point is reached. In the exploration process, the traversed successor node is marked as a visited node, and the And type node is specially identified, while the weight of the Or type node is accumulated and recorded. When the search reaches the terminal node or encounters a node without a successor node, the entire path and its cumulative weight value are saved, and the cumulative weight value is defined as the final risk value of the path, and the calculation method is to accumulate the weights of all Or type nodes on the path. Subsequently, the last node of the path is traced back to the previous And type node, it is checked whether there is another unvisited parent node, and the search is continued until all possible paths are completely visited and recorded, so as to ensure full coverage analysis of all potential risk paths in the attack graph.

6. A system for weak password assessment of enterprise networks based on logical attack graphs and password assessment, characterized in that, The system comprises a logical attack graph construction module, a password strength evaluation module, an association combination module, a point identification module, a path search module and a visualization module. The logical attack graph construction module is used to collect the network topology structure, security policy and system configuration of the enterprise intranet, combine the reasoning rules mapped by the ATT&CK knowledge base, and use the MulVAL tool to perform logical reasoning to obtain a logical attack graph; The password strength evaluation module is used to obtain the system account password information of each host in the enterprise intranet, calculate the password entropy and simulate the password cracking time, and evaluate the password risk value; the password strength module specifically comprises: Obtaining the system account password of each host in the enterprise intranet; According to the password length and character types of the system account password of each host, the password entropy of each host is calculated, and the formula is: E = log 2( N L )， wherein, E is the password entropy, N is the size of the password character set, L is the password length; According to the password length and character types of the system account password of each host, the password cracking time is simulated, and the formula is: ， in, T For the time required to brute-force the password, R In terms of computing power per second, n The number of character types involved in the cryptographic character set. C i Indicates the first character contained in the password character set. i Size of class characters; The password risk value is obtained by weighted summation and normalization processing of the password entropy and the password cracking time: ， wherein P is a password risk value, α , β is an adjustable weight coefficient, The association combining module is used for associating and combining the password risk value with the logical attack graph to generate a new weighted attack graph containing the password risk value; is a scaling parameter The point identification module is used for identifying the attack starting point and the attack target point in the weighted attack graph; The path search module is used for using a depth-first search algorithm to traverse all attack paths in the weighted attack graph and calculating the weak password risk value involved in each attack path. The visualization module is used for taking the attack path with the highest weak password risk value as the best attack path and generating and visualizing the processing. The electronic device comprises:

7. An electronic device, comprising: at least one processor; and a memory connected in communication with the at least one processor; wherein The memory stores computer program instructions executable by the at least one processor, and the computer program instructions are executed by the at least one processor to enable the at least one processor to execute the enterprise network weak password evaluation method based on the logical attack graph and the password evaluation according to any one of claims 1-5. The program is executed by the processor to implement the enterprise network weak password evaluation method based on the logical attack graph and the password evaluation according to any one of claims 1-5.

8. A computer-readable storage medium storing a program, characterized in that, The computer program / instructions are executed by the processor to implement the enterprise network weak password evaluation method based on the logical attack graph and the password evaluation according to any one of claims 1-5.

9. A computer program product comprising computer programs / instructions, characterized in that, ​

Images