Method and device for detecting multi-step attack, storage medium and program product

Abstract

The application relates to a method for detecting a multi-step attack, an apparatus for detecting a multi-step attack, a non-transitory computer readable storage medium, and a computer program product. According to one aspect of the invention, the method for detecting the multi-step attack comprises the following steps of: determining a plurality of potential attacks corresponding to target equipment and target vulnerabilities based on an association relationship among the types of the equipment, the types of the vulnerabilities and the types of the attacks in a network system; in response to the detected alarm information of the plurality of potential attacks, time features and space features of the plurality of potential attacks are acquired, a real-time attack graph is generated based on the acquired time features and space features, and the time features are used for indicating occurrence moments of the potential attacks; the spatial feature is used for indicating the occurrence position of the potential attack; and determining a multi-step attack of the plurality of potential attacks based on a comparison of the real-time attack graph and a multi-step attack detection graph.

Description

Technical Field

[0001] The present application relates to the field of network communications, and more particularly to a method for detecting a multi-step attack, an apparatus for detecting a multi-step attack, a non-transitory computer-readable storage medium, and a computer program product. Background Art

[0002] With the continuous development of the Internet and information technology, network attacks are becoming increasingly complex and hidden. Current security detection methods generally use attack detection rules to detect single-step attacks. For example, many network security detection systems (such as intrusion detection systems, firewalls, etc.) can detect single-step attacks based on attack detection rules and generate security alarms when single-step attacks are detected. With the complexity of network systems and the enhancement of defense capabilities, multi-step attacks have become the main form of network attacks. Unlike traditional single-step attacks, multi-step attacks can include multiple different attack steps in a specific logical sequence, with a longer time span and higher concealment, so they are more harmful. In order to evade security detection, attackers usually choose to split the attack steps to use multi-step attacks to invade network systems.

[0003] However, because many attack detection rules are outdated, or attackers choose to split the attack steps to evade security detection, the current security detection methods can no longer fully and accurately detect various attacks in network systems. In addition, since security alarms are generated for each single-step attack detected, a large number of redundant and erroneous security alarms will be generated, causing alarm fatigue and consuming security detection resources. Summary of the invention

[0004] In order to solve or at least alleviate one or more of the above problems, the following technical solutions are provided.

[0005] According to a first aspect of the present application, a method for detecting multi-step attacks is provided, the method comprising the following steps: determining multiple potential attacks corresponding to target devices and target vulnerabilities based on the association between the types of devices, types of vulnerabilities and types of attacks in a network system; acquiring time characteristics and spatial characteristics of the multiple potential attacks in response to alarm information of detecting the multiple potential attacks and generating a real-time attack graph based on the acquired time characteristics and spatial characteristics, wherein the time characteristics are used to indicate the time when the potential attack occurs, and the spatial characteristics are used to indicate the location where the potential attack occurs; and determining a multi-step attack among the multiple potential attacks based on a comparison between the real-time attack graph and a multi-step attack detection graph.

[0006] According to the method for detecting a multi-step attack according to an embodiment of the present application, the type of the device includes the type of the hardware device and the type of the software device set on the hardware device.

[0007] According to the method for detecting multi-step attacks described in one embodiment of the present application or any of the above embodiments, determining multiple potential attacks corresponding to a target device and a target vulnerability based on the association between the type of device, the type of vulnerability, and the type of attack in a network system includes: determining the target vulnerability corresponding to the target device based on the association between the type of the device and the type of vulnerability; determining multiple potential attacks corresponding to the target vulnerability based on the association between the type of the vulnerability and the type of attack.

[0008] According to the method for detecting multi-step attacks described in one embodiment of the present application or any of the above embodiments, the types of attacks include one or more of the following: SQL injection attacks, memory overflow attacks, denial of service attacks, active scanning attacks, password cracking attacks, remote control attacks, and file transfer attacks.

[0009] According to the method for detecting multi-step attacks described in one embodiment of the present application or any of the above embodiments, the time characteristics and spatial characteristics of the multiple potential attacks are obtained in response to detecting alarm information of the multiple potential attacks, including: obtaining the time characteristics of the multiple potential attacks based on the attack timestamp in the alarm information; obtaining the spatial characteristics of the multiple potential attacks based on the source port information, source IP address, target port information and target IP address in the alarm information.

[0010] According to the method for detecting multi-step attacks described in one embodiment of the present application or any of the above embodiments, generating a real-time attack graph based on the acquired time features and spatial features includes: taking each potential attack as a target attack node, taking the time when each potential attack occurs as a target time node, and taking the location where each potential attack occurs as a target location node; establishing a time connection edge between the target attack node and the target time node based on the time features of the multiple potential attacks; establishing a spatial connection edge between the target attack node and the target location node based on the spatial features of the multiple potential attacks; and generating the real-time attack graph based on the target attack node, the target time node, the target location node, the time connection edge, and the spatial connection edge.

[0011] According to the method for detecting multi-step attacks described in one embodiment of the present application or any one of the above embodiments, the target time nodes are sorted according to the time sequence of the occurrence moments of the potential attacks indicated by the time features, and the target location nodes are sorted according to the location sequence of the occurrence locations of the potential attacks indicated by the spatial features.

[0012] According to the method for detecting multi-step attacks described in one embodiment or any of the above embodiments of the present application, the multi-step attack detection graph is constructed in the following manner: based on the multi-step attack strategy, the execution order of multiple attack steps and the occurrence position of each attack step are obtained; each attack step is used as an attack detection node, the detection time node of each attack step is determined based on the execution order, and the detection position node is determined based on the occurrence position of each attack step; based on the execution order, a time connection edge is established between the attack detection node and the detection time node; based on the occurrence position of each attack step, a space connection edge is established between the attack detection node and the detection position node; and the multi-step attack detection graph is constructed based on the attack detection node, the detection time node, the detection position node, the time connection edge and the space connection edge.

[0013] According to the method for detecting multi-step attacks described in one embodiment of the present application or any of the above embodiments, determining the multi-step attack among the multiple potential attacks based on the comparison between the real-time attack graph and the multi-step attack detection graph includes: inputting the real-time attack graph into a pre-trained graph neural network to obtain attack node features of multiple target attack nodes; inputting the multi-step attack detection graph into a pre-trained graph neural network to obtain detection node features of multiple detection attack nodes; and determining the multi-step attack among the multiple potential attacks based on the comparison between the attack node features and the detection node features.

[0014] According to the method for detecting multi-step attacks described in one embodiment of the present application or any of the above embodiments, determining the multi-step attack among the multiple potential attacks based on the comparison of the attack node feature with the detection node feature includes: determining the similarity between the attack node feature and the detection node feature; determining part or all of the attack node features among the attack node features based on the comparison of the similarity with a similarity threshold; and determining the multi-step attack among the multiple potential attacks based on the target attack node corresponding to the part or all of the attack node features.

[0015] According to a second aspect of the present application, a device for detecting a multi-step attack is provided, the device comprising: a memory; a processor coupled to the memory; and a computer program stored on the memory, wherein when the computer program runs on the processor, the steps of the method for detecting a multi-step attack according to the first aspect of the present application are executed.

[0016] According to a third aspect of the present application, a non-transitory computer-readable storage medium is provided, characterized in that the non-transitory computer-readable storage medium includes instructions, and the instructions, when run, execute the steps of the method for detecting multi-step attacks according to the first aspect of the present application.

[0017] According to a fourth aspect of the present application, a computer program product is provided, the computer program product comprising instructions, which, when executed by a processor, implement the steps of the method for detecting a multi-step attack according to the first aspect of the present application.

[0018] The scheme for detecting multi-step attacks according to one or more embodiments of the present application can determine multiple potential attacks corresponding to target devices and target vulnerabilities and determine multi-step attacks among multiple potential attacks with the help of a real-time attack graph generated based on the temporal characteristics and spatial characteristics of the multiple potential attacks, thereby being able to accurately detect multi-step attacks in various complex attack scenarios, reducing redundant and erroneous security alarms, and improving the security of the network system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and / or other aspects and advantages of the present application will become clearer and easier to understand through the following description of various aspects in conjunction with the accompanying drawings, in which the same or similar units are represented by the same reference numerals. In the accompanying drawings: Figure 1 A flow chart of a method for detecting a multi-step attack according to one or more embodiments of the present application is shown.

[0020] Figure 2 A schematic diagram showing the association between the types of devices, the types of vulnerabilities, and the types of attacks in a network system according to an embodiment of the present application.

[0021] Figure 3 A schematic diagram showing a typical multi-step attack strategy.

[0022] Figure 4 A schematic multi-step attack detection diagram according to an embodiment of the present application is shown.

[0023] Figure 5 A schematic block diagram of an apparatus for detecting a multi-step attack according to one or more embodiments of the present application is shown. DETAILED DESCRIPTION

[0024] The following describes in detail example embodiments of the present application, and examples of these embodiments are illustrated in the accompanying drawings. It should be noted that the following description is for explanation and illustration and is therefore not to be construed as limiting the present application. Without departing from the principles of the present application, those skilled in the art may make electrical, mechanical, logical and structural changes to these embodiments as needed without departing from the scope of the present application. In addition, those skilled in the art may appreciate that, for any specific application scenario or actual need, one or more features of the different embodiments described below may be combined.

[0025] Terms such as "comprising" and "including" indicate that in addition to the units and steps directly and clearly stated in the specification, the technical solution of the present application does not exclude the situation of having other units and steps that are not directly or clearly stated. Terms such as "first" and "second" do not indicate the order of units in terms of time, space, size, etc., but are only used to distinguish between units.

[0026] In the context of this application, the term "network system" refers to a system including hardware devices and software devices for implementing information processing, transmission and exchange. In the context of this application, the term "target device" refers to the hardware devices and software devices that need to be detected during the network security detection process, and the term "target vulnerability" refers to software defects, configuration errors, design defects, etc. in the target device, which may be exploited by attackers to gain unauthorized access to or damage the network system, resulting in security risks.

[0027] Hereinafter, various exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings.

[0028] Figure 1 A flow chart of a method for detecting a multi-step attack according to one or more embodiments of the present application is shown.

[0029] like Figure 1 As shown in FIG. 1 , in step S101 , a plurality of potential attacks corresponding to a target device and a target vulnerability are determined based on an association relationship among a type of device, a type of vulnerability, and a type of attack in a network system.

[0030] Optionally, the type of device may include the type of hardware device and the type of software device set on the hardware device. Exemplarily, the hardware device may include a server, a personal computer, a mobile device, a network device (such as a router, a switch, a gateway device, etc.), a database server, etc., and the software device may include an operating system, an application, a database, etc. Optionally, the type of vulnerability may include a data leakage vulnerability, a configuration error vulnerability, an input verification vulnerability, a service protocol vulnerability, an access control vulnerability, an encryption vulnerability, a remote execution vulnerability, etc. Optionally, the type of attack may include an SQL injection attack, a memory overflow attack, a denial of service attack, an active scanning attack, a password cracking attack, a remote control attack, and a file transfer attack, etc.

[0031] In a network system, there is a correlation between the type of device, the type of vulnerability, and the type of attack. By obtaining the above correlation in advance, for example Figure 2The schematic diagram of the association between the type of device, the type of vulnerability and the type of attack in the network system shown in the figure can determine multiple potential attacks that may be suffered when the target device and the target vulnerability are known. Exemplarily, when the type of attack implemented by the attacker is a memory overflow attack, the attacker can use the buffer overflow vulnerability (e.g., CVE-2008-2992) in the Adobe Reader software of the computer to achieve malicious behavior. For example, the attacker can call the util.printf JavaScript function by constructing a PDF file and use the format string parameter to remotely execute arbitrary code. Exemplarily, when the type of attack implemented by the attacker is an SQL injection attack, the attacker can use the input point of the SQL injection vulnerability in the Web application of the computer to inject malicious SQL code to obtain sensitive data in the database, modify the table structure, delete data, etc. For example, the attacker can use the SQL injection vulnerability in the e-commerce website to obtain user payment information. Exemplarily, when the type of attack implemented by the attacker is a denial of service attack, the attacker can use the vulnerability of the network service protocol to send a large number of request data packets to the server to achieve the purpose of blocking the network or exhausting resources.

[0032] Optionally, in step S101, a target vulnerability corresponding to a target device may be determined based on an association relationship between the type of device and the type of vulnerability, and a plurality of potential attacks corresponding to the target vulnerability may be determined based on an association relationship between the type of vulnerability and the type of attack. Exemplarily, when the target device includes Adobe Reader software and a Web application in a computer, the target vulnerability may be determined to include a buffer overflow vulnerability and a SQL injection vulnerability based on an association relationship between the type of device and the type of vulnerability, and the potential attacks may be determined to include a memory overflow attack and a SQL injection attack based on an association relationship between the type of vulnerability and the type of attack. By determining a plurality of potential attacks corresponding to a target device and a target vulnerability based on an association relationship between the type of device, the type of vulnerability, and the type of attack in a network system, it is possible to avoid processing alarm information that is not related to the target device and the target vulnerability, reduce the complexity of subsequent detection of multi-step attacks, and improve the detection accuracy of multi-step attacks.

[0033] In step S103, in response to detecting alarm information of multiple potential attacks, time characteristics and spatial characteristics of multiple potential attacks are obtained and a real-time attack graph is generated based on the obtained time characteristics and spatial characteristics, wherein the time characteristics are used to indicate the time when the potential attack occurs, and the spatial characteristics are used to indicate the location where the potential attack occurs.

[0034] Optionally, in step S103, an intrusion detection system may be deployed for multiple potential attacks to detect alarm information of multiple potential attacks. Optionally, in step S103, time characteristics of multiple potential attacks may be obtained based on the attack timestamp in the alarm information, and spatial characteristics of multiple potential attacks may be obtained based on the source port information, source IP address, destination port information, and destination IP address in the alarm information. Exemplarily, the attack timestamp, source port information, source IP address, destination port information, and destination IP address may be obtained based on fields in the alarm information, such as the attack timestamp corresponding to the Timestamp field, the source port information corresponding to the Source Port field, the source IP address corresponding to the Source IP Address field, the destination port information corresponding to the Destination Port field, and the destination IP address corresponding to the Destination IP Address field.

[0035] Optionally, in step S103, each potential attack can be used as a target attack node, the occurrence time of each potential attack can be used as a target time node, and the occurrence location of each potential attack can be used as a target location node. A time connection edge can be established between the target attack node and the target time node based on the time characteristics of multiple potential attacks, a space connection edge can be established between the target attack node and the target location node based on the spatial characteristics of multiple potential attacks, and a real-time attack graph can be generated based on the target attack node, the target time node, the target location node, the time connection edge, and the space connection edge. In one embodiment, a time connection edge can be established between the target attack node corresponding to the potential attack and the target time node corresponding to the occurrence time of the potential attack, and a space connection edge can be established between the target attack node corresponding to the potential attack and the target location node corresponding to the occurrence location of the potential attack. In one embodiment, the target location node corresponding to the occurrence location of the potential attack can include a source port node corresponding to the source IP address and a target port node corresponding to the target IP address. In one embodiment, in the real-time attack graph, the target time node can be sorted in the time order of the occurrence time of the potential attack indicated by the time feature, and the target location node can be sorted in the position order of the occurrence location of the potential attack indicated by the spatial feature.

[0036] In step S105, a multi-step attack among a plurality of potential attacks is determined based on a comparison between the real-time attack graph and the multi-step attack detection graph.

[0037] Optionally, the execution order of multiple attack steps and the occurrence location of each attack step can be obtained based on the multi-step attack strategy, each attack step is used as a detection attack node, the detection time node of each attack step is determined based on the execution order, and the detection location node is determined based on the occurrence location of each attack step, a time connection edge is established between the detection attack node and the detection time node based on the execution order, a space connection edge is established between the detection attack node and the detection location node based on the occurrence location of each attack step, and a multi-step attack detection graph is constructed based on the detection attack node, the detection time node, the detection location node, the time connection edge and the space connection edge. In one embodiment, a time connection edge can be established between the detection attack node corresponding to the attack step and the detection time node corresponding to the attack step, and a space connection edge can be established between the detection attack node corresponding to the attack step and the detection location node corresponding to the occurrence location of the attack step. In one embodiment, the detection location node corresponding to the occurrence location of the attack step can include a source port node corresponding to the source IP address and a target port node corresponding to the target IP address. The following will be combined with Figure 3 and Figure 4 A schematic multi-step attack strategy and a schematic multi-step attack detection diagram constructed based on the multi-step attack strategy are described respectively.

[0038] Optionally, in step S105, the real-time attack graph may be input into a pre-trained graph neural network to obtain attack node features of multiple target attack nodes, the multi-step attack detection graph may be input into a pre-trained graph neural network to obtain detection node features of multiple detection attack nodes, and the multi-step attacks among multiple potential attacks may be determined based on the comparison between the attack node features and the detection node features. Optionally, the attack node features of the target attack node may include a feature vector of the target attack node and a feature vector of a temporal connection edge and a spatial connection edge connected to the target attack node, and the detection node features of the detection attack node may include a feature vector of the detection attack node and a feature vector of a temporal connection edge and a spatial connection edge connected to the detection attack node. Through the pre-trained graph neural network, the structural information of the target attack node and its neighborhood and the structural information of the detection attack node and its neighborhood can be captured, which is conducive to improving the detection efficiency and accuracy of multi-step attacks among multiple potential attacks.

[0039] In one embodiment, the similarity (e.g., cosine similarity) between the attack node feature and the detection node feature can be determined, part or all of the attack node features in the attack node features can be determined based on the comparison between the similarity and the similarity threshold, and multiple-step attacks in multiple potential attacks can be determined based on the target attack nodes corresponding to the part or all of the attack node features. In one embodiment, part or all of the attack node features in the attack node features with a similarity less than the similarity threshold can be selected, and multiple potential attacks corresponding to the target attack nodes of the part or all of the attack node features can be determined as multi-step attacks. In one embodiment, part or all of the attack node features in the attack node features with a similarity less than the similarity threshold can be selected, the target attack node, target time node, and target position node corresponding to the part or all of the attack node features can be determined, multiple potential attacks corresponding to the target attack node can be determined as multi-step attacks, and the occurrence time and occurrence position of each attack in the multi-step attack can be determined based on the target time node and the target position node. In one or more embodiments of the present application, the real-time attack graph includes a target attack node, a target time node, and a target location node, and the multi-step attack detection graph includes a detection attack node, a detection time node, and a detection location node. By comparing the real-time attack graph with the multi-step attack detection graph to detect multi-step attacks in multiple potential attacks, not only can each attack in the multi-step attack be detected, but also the time and location of occurrence of each attack can be detected, which is beneficial to improving the security of the network system.

[0040] According to one or more embodiments of the present application, the method for detecting multi-step attacks can determine multiple potential attacks corresponding to target devices and target vulnerabilities and determine the multi-step attacks among the multiple potential attacks with the help of a real-time attack graph generated based on the temporal characteristics and spatial characteristics of the multiple potential attacks, thereby being able to accurately detect multi-step attacks in various complex attack scenarios, reducing redundant and erroneous security alarms, and improving the security of the network system.

[0041] The following will be combined Figure 2-5 A specific implementation for detecting a multi-step attack according to one or more embodiments of the present application is further described.

[0042] Figure 2 A schematic diagram showing the association between the types of devices, the types of vulnerabilities, and the types of attacks in a network system according to an embodiment of the present application.

[0043] like Figure 2 As shown in FIG. 2 , a schematic diagram 200 shows the association between the type of device, the type of vulnerability, and the type of attack.

[0044] Optionally, the type of device may include the type of hardware device and the type of software device set on the hardware device. Exemplarily, the hardware device may include a server, a personal computer, a mobile device, a network device (such as a router, a switch, a gateway device, etc.), a database server, etc., and the software device may include an operating system, an application, a database, etc. Optionally, the type of vulnerability may include a data leakage vulnerability, a configuration error vulnerability, an input verification vulnerability, a service protocol vulnerability, an access control vulnerability, an encryption vulnerability, a remote execution vulnerability, etc. Optionally, the type of attack may include an SQL injection attack, a memory overflow attack, a denial of service attack, an active scanning attack, a password cracking attack, a remote control attack, and a file transfer attack, etc. The association between the type of device, the type of vulnerability, and the type of attack can be understood as an attack of type A implemented by an attacker can exploit a vulnerability of type C in a device of type B, and the above association can be obtained, for example, by using a common vulnerability and an exposure database.

[0045] refer to Figure 2 As shown in , when the attacker implements a memory overflow attack, he can use the buffer overflow vulnerability in the computer's Adobe Reader software to achieve malicious behavior. For example, the attacker can call the util.printf JavaScript function by constructing a PDF file and use the format string parameter to remotely execute arbitrary code. It should be noted that Figure 2 The association between memory overflow attacks, buffer overflow vulnerabilities and the computer's Adobe Reader software is described only as an example. Without departing from the spirit and scope of the present application, the present application may also include other forms of associations between device types, vulnerability types and attack types, such as the association between SQL injection attacks, SQL injection vulnerabilities and the computer's Web applications.

[0046] Figure 3 A schematic diagram showing a typical multi-step attack strategy.

[0047] like Figure 3As shown in , the multi-step attack strategy 300 may include an SQL injection step S1, an active scanning step S2, a password cracking step S3, a remote control tool installation step S4, and a file transfer step S5. In the SQL injection step S1, an attacker (e.g., an IP address of IP1=10.XX.XX) can invade a Web server (e.g., an IP address of IP2=11.1X.XX.XX) through SQL injection. For example, an attacker can insert malicious SQL code in a Web form input and use the security vulnerability of the database server to deceive the database server into executing illegal SQL commands, so that the attacker obtains unauthorized access to the database. In the active scanning step S2, the attacker can use active scanning technology to identify the security vulnerability of the server to be attacked (e.g., the IP address is IP3=11.2X.XX.XX). In the password cracking step S3, the attacker can crack the password through the security vulnerability to obtain access rights to the server to be attacked. In the remote control tool installation step S4, the attacker can install a remote control tool on the server to be attacked, so that the attacker can remotely control the server to be attacked to perform file operations, monitor activities, capture keyboard input, etc. In the file transfer step S5, the attacker can use the remote control tool to transfer sensitive files back to his own system.

[0048] Figure 4 A schematic multi-step attack detection diagram according to an embodiment of the present application is shown.

[0049] like Figure 4 As shown in FIG. 4 , the multi-step attack detection diagram 400 is based on Figure 3 The multi-step attack strategy 300 shown in is constructed, wherein the detection attack nodes include SQL injection, active scanning, password cracking, remote control tool installation, file transfer, the detection time nodes include T1, T2, T3, T4, T5, and the detection location nodes include IP1, IP2 and IP3.

[0050] For example, refer to Figure 3 and Figure 4 As shown in Figure 3 The multi-step attack strategy 300 shown in FIG. 3 includes a SQL injection step S1, an active scanning step S2, a password cracking step S3, a remote control tool installation step S4, and a file transfer step S5. Figure 4 The detection attack nodes shown are SQL injection, active scanning, password cracking, remote control tool installation, file transfer, based on Figure 3 The execution order of the SQL injection step S1, the active scanning step S2, the password cracking step S3, the remote control tool installation step S4 and the file transfer step S5 is determined as shown in FIG. Figure 4 The detection time nodes T1, T2, T3, T4, T5 are shown, and based on Figure 3 The location of each step shown is determined by Figure 4 The detection location nodes IP1, IP2 and IP3 are shown.

[0051] For example, refer to Figure 3 and Figure 4 As shown in , a time connection edge can be established between the detection attack node and the detection time node based on the execution order of each step, for example, a time connection edge is established between the detection attack node SQL injection corresponding to the SQL injection step S1 executed first and the detection time node T1, and a time connection edge is established between the detection attack node active scanning corresponding to the active scanning step S2 executed next and the detection time node T2, and so on. A spatial connection edge can be established between the detection attack node and the detection position node based on the occurrence location of each attack step, for example, the occurrence location of the SQL injection step S1 includes the IP address IP1 of the attacker and the IP address IP2 of the Web server, and a spatial connection edge can be established between the detection attack node SQL injection corresponding to the SQL injection step S1 and the detection position nodes IP1 and IP2, for example, the occurrence location of the active scanning step S2 includes the IP address IP2 of the Web server and the IP address IP3 of the server to be attacked, and a spatial connection edge can be established between the detection attack node active scanning corresponding to the active scanning step S2 and the detection position nodes IP2 and IP3, and so on.

[0052] Figure 5 A schematic block diagram of an apparatus for detecting a multi-step attack according to one or more embodiments of the present application is shown.

[0053] like Figure 5 As shown in FIG. 5 , an apparatus 500 for detecting a multi-step attack includes a memory 510, a processor 520, and a computer program 530 stored in the memory 510 and executable on the processor 520. The processor 520 executes the computer program 530 to implement a method for detecting a multi-step attack according to one aspect of the present application.

[0054] In addition, the present application may also be implemented as a non-transitory computer-readable storage medium, in which a program for causing a computer to execute the method for detecting a multi-step attack according to one aspect of the present application is stored.

[0055] Here, as non-temporary computer-readable storage media, various forms of non-temporary computer-readable storage media can be used, such as disks (e.g., magnetic disks, optical disks, etc.), cards (e.g., memory cards, optical cards, etc.), semiconductor memories (e.g., ROMs, non-volatile memories, etc.), and tapes (e.g., magnetic tapes, cassettes, etc.).

[0056] In the applicable situation, hardware, software or a combination of hardware and software can be used to realize the various embodiments provided by the application. Moreover, in the applicable situation, without departing from the scope of the application, the various hardware components and / or software components set forth herein can be combined into a composite component comprising software, hardware and / or both. In the applicable situation, without departing from the scope of the application, the various hardware components and / or software components set forth herein can be divided into subcomponents comprising software, hardware or both. In addition, in the applicable situation, it is contemplated that the software component can be implemented as a hardware component, and vice versa.

[0057] Software according to the present application (such as program code and / or data) may be stored on one or more non-transitory computer-readable storage media. It is also contemplated that the software identified herein may be implemented using one or more general or special-purpose computers and / or computer systems, networked and / or otherwise. Where applicable, the order of the various steps described herein may be changed, combined into composite steps, and / or divided into sub-steps to provide the features described herein.

[0058] The embodiments and examples set forth herein are provided to best illustrate embodiments according to the present application and its specific applications, and thereby enable those skilled in the art to implement and use the present application. However, those skilled in the art will appreciate that the above description and examples are provided only for ease of illustration and example. The description set forth is not intended to cover all aspects of the present application or to limit the present application to the precise form disclosed.

Claims

1. A method for detecting a multi-step attack, characterized in that: The method comprises the following steps: Determine a plurality of potential attacks corresponding to a target device and a target vulnerability based on an association relationship between a type of device in the network system, a type of vulnerability, and a type of attack; In response to detecting the alarm information of the multiple potential attacks, acquiring the time characteristics and space characteristics of the multiple potential attacks and generating a real-time attack graph based on the acquired time characteristics and space characteristics, wherein the time characteristics are used to indicate the occurrence time of the potential attacks, and the space characteristics are used to indicate the occurrence location of the potential attacks; as well as A multi-step attack from among the plurality of potential attacks is determined based on a comparison of the real-time attack graph with a multi-step attack detection graph.

2. The method according to claim 1, wherein the type of the device comprises a type of a hardware device and a type of a software device set on the hardware device.

3. The method according to claim 1, wherein determining a plurality of potential attacks corresponding to a target device and a target vulnerability based on an association relationship among a type of device, a type of vulnerability, and a type of attack in the network system comprises: Determine the target vulnerability corresponding to the target device based on the association relationship between the type of the device and the type of the vulnerability; A plurality of potential attacks corresponding to the target vulnerability are determined based on the association between the type of the vulnerability and the type of the attack.

4. The method according to claim 1, wherein the types of attacks include one or more of the following: SQL injection attack, memory overflow attack, denial of service attack, active scanning attack, password cracking attack, remote control attack and file transfer attack.

5. The method according to claim 1, wherein acquiring the temporal characteristics and spatial characteristics of the multiple potential attacks in response to detecting the alarm information of the multiple potential attacks comprises: Acquire the time characteristics of the multiple potential attacks based on the attack timestamp in the alarm information; The spatial features of the multiple potential attacks are obtained based on the source port information, source IP address, target port information and target IP address in the alarm information.

6. The method according to claim 1, wherein generating a real-time attack graph based on the acquired temporal features and spatial features comprises: Taking each potential attack as a target attack node, taking the occurrence time of each potential attack as a target time node, and taking the occurrence location of each potential attack as a target location node; Establishing a time connection edge between the target attack node and the target time node based on the time characteristics of the multiple potential attacks; Establishing a spatial connection edge between the target attack node and the target location node based on the spatial features of the multiple potential attacks; as well as The real-time attack graph is generated based on the target attack node, the target time node, the target location node, the time connection edge and the space connection edge.

7. The method according to claim 6, wherein the target time nodes are sorted according to the time sequence of the occurrence moments of the potential attacks indicated by the time features, and the target location nodes are sorted according to the location sequence of the occurrence locations of the potential attacks indicated by the spatial features.

8. The method according to claim 1, wherein the multi-step attack detection graph is constructed by: Based on the multi-step attack strategy, the execution order of multiple attack steps and the occurrence location of each attack step are obtained; Taking each attack step as a detection attack node, determining a detection time node of each attack step based on the execution order, and determining a detection location node based on an occurrence location of each attack step; Establishing a time connection edge between the detection attack node and the detection time node based on the execution order; Establishing a spatial connection edge between the attack detection node and the detection location node based on the occurrence location of each attack step; as well as The multi-step attack detection graph is constructed based on the detection attack nodes, the detection time nodes, the detection position nodes, the time connection edges and the space connection edges.

9. The method according to claim 6 or 8, wherein determining a multi-step attack among the plurality of potential attacks based on the comparison between the real-time attack graph and the multi-step attack detection graph comprises: Inputting the real-time attack graph into a pre-trained graph neural network to obtain attack node features of multiple target attack nodes; Inputting the multi-step attack detection graph into a pre-trained graph neural network to obtain detection node features of multiple detection attack nodes; as well as A multi-step attack among the plurality of potential attacks is determined based on a comparison of the attack node feature with the detection node feature.

10. The method according to claim 9, wherein determining a multi-step attack among the plurality of potential attacks based on the comparison between the attack node feature and the detection node feature comprises: Determining the similarity between the attack node feature and the detection node feature; Determining part or all of the attack node features in the attack node features based on a comparison between the similarity and a similarity threshold; as well as A multi-step attack among the plurality of potential attacks is determined based on the target attack node corresponding to the partial or complete attack node features.

11. A device for detecting a multi-step attack, characterized in that: The device comprises: Memory; a processor coupled to the memory; and A computer program stored on the memory and running on the processor, the execution of the computer program results in the execution of the method for detecting a multi-step attack according to any one of claims 1 to 10.

12. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium includes instructions that, when executed, perform the method for detecting a multi-step attack according to any one of claims 1-10.

13. A computer program product, characterized in that The computer program product comprises instructions, which, when executed by a processor, implement the method for detecting a multi-step attack according to any one of claims 1-10.

Images