Network attack path analysis method and system, terminal and storage medium

Abstract

The invention relates to a network attack path analysis method and system, a terminal and a storage medium, and the method comprises the steps: obtaining preset target asset information which comprises the position information and asset value information of a target asset; determining system protection layer information according to the position information of the target assets; selecting a base point of the attack path from a pre-stored database, and calling vulnerability information and attack means information corresponding to the system protection layer information; a base point set of the attack path is stored in the pre-stored database; generating all attack paths according to the attack means information based on an attack path generation rule; and obtaining and outputting risk information of the attack path according to the asset value information and the attack path. The method and the device have the effect of analyzing the attack path of the network attack possibly suffered by the system or the equipment.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a network attack path analysis method, system, terminal and storage medium. Background Art

[0002] Cyber ​​attacks refer to any type of offensive action against computer information systems, infrastructure, computer networks or personal computer devices. The attack path refers to the path from the starting point of the cyber attack to the target file; the security of the system or device is generally reflected by the attack path. Therefore, it is necessary for the system or device to analyze the attack path of the cyber attack it may suffer. Summary of the invention

[0003] The present application provides a network attack path analysis method, system, terminal and storage medium, which achieve the purpose of analyzing the attack path of a network attack that a system or device may suffer.

[0004] In the first aspect, the present application provides a network attack path analysis method, which adopts the following technical solution: A network attack path analysis method includes: obtaining preset target asset information, wherein the target asset information includes location information and asset value information of the target asset; Determine the system protection layer information based on the location information of the target asset; Select the base point of the attack path from the pre-stored database, and retrieve the vulnerability information and attack means information corresponding to the system protection layer information; The pre-stored database stores system protection layer information, vulnerability information and the corresponding relationship between the two, and also stores attack means information and the corresponding relationship between vulnerability information and attack means information; the pre-stored database stores a base point set of the attack path; Based on the attack path generation rules, all attack paths are generated according to the attack means information; The risk information of the attack path is obtained and output based on the asset value information and the attack path.

[0005] By adopting the above technical solution, since the starting point of the network attack is not fixed, it is randomly selected from the base points of multiple attack paths, and then the system protection layer that needs to be attacked is determined by the base points of the attack path and the location information of the target assets; the vulnerability information on the system protection layer and the attack means information corresponding to the vulnerability information are obtained, all attack paths are generated based on the attack path generation rules, and then the risk information of the attack path is obtained and output based on the asset value information and the attack path analysis; the system administrator can make targeted security protection measures based on the results of the attack path risk analysis, thereby improving the security of the system.

[0006] Preferably, before obtaining the asset value information of the target asset, it is necessary to conduct a value assessment on the target asset, and the specific steps include: Obtaining the confidentiality type of the target asset, wherein the confidentiality type includes confidentiality, internal disclosure, and external disclosure; Analyze the content of the target assets and determine the timeliness of the target assets; The target assets are valued based on their confidentiality type and timeliness.

[0007] Preferably, before launching a network attack, it is also necessary to determine the base point for launching the network attack. The specific method is: traverse the attack path base point set pre-stored in the database, and select the base point of each attack path in turn as the starting point of the attack path.

[0008] Preferably, before using the pre-stored database, it is necessary to first construct the database, and the specific steps include: Obtain device information within the system, obtain all known attack methods, and obtain the base points of all known attack paths based on big data; Generate system protection layer information based on device information; Through the vulnerability retrieval tool, the vulnerability information of each layer of the system protection layer is retrieved, and the relationship information between the vulnerability information and the system protection layer is stored; Based on the vulnerability information, all attack means information is matched, and the relationship information between the attack means information and the vulnerability information is stored.

[0009] Preferably, the attack path generation rules include: Based on the vulnerability information, the attack means information and the correspondence between the vulnerability information and the attack means information, a vulnerability on the current system protection layer is randomly selected, and an attack means corresponding to the vulnerability is randomly selected as the attack means to break through the current system protection layer; The attack means of breaking through each system protection layer are respectively combined into an attack means set corresponding to each system protection layer; Attack methods are selected from each attack method set in the order of breaking through the system protection layer, and combined to generate all attack paths.

[0010] Preferably, after obtaining the asset value information and generating the attack path, it is necessary to evaluate the risk of the attack path. The specific steps are: Mark the attack methods based on the attack method information in the database; Based on all attack paths, count the number of attack methods with the same label in each attack path and output them in order; According to the statistical results, the risk of the attack path is evaluated based on the rule that the frequency of occurrence of the same label is proportional to the risk.

[0011] Preferably, after evaluating the risk of the attack path, it is also necessary to prioritize the repair of the vulnerability. The specific steps are: Calculate the system resources consumed by fixing the vulnerability and obtain the resource consumption value; and simulate and calculate the relative value of the change in the number of attack paths after fixing the vulnerability; Calculate based on resource consumption value and relative value, get the repair priority of each vulnerability and output it in order.

[0012] In a second aspect, the present application provides a system for network attack path analysis, which adopts the following technical solution: A system for analyzing network attack paths, comprising: A storage module, wherein the storage module has a database pre-stored therein; A first acquisition module is used to read the target asset information, system protection layer information, vulnerability information and attack means information pre-stored in the database; A second acquisition module is used to read the attack path base point set pre-stored in the database; A generation module, used to receive the target asset information, system protection layer information, attack path base point set, vulnerability information and attack means information, and generate an attack path; A first analysis module, configured to receive the target asset information, analyze the value of the target asset according to the target asset information, and output the value; A second analysis module is used to receive the attack path, analyze the risk of the attack path and output the risk analysis result; The third analysis module is used to receive the vulnerability information and the attack path, analyze the priority order of vulnerability repair based on the vulnerability information and the attack path, and output it.

[0013] In a third aspect, an embodiment of the present application discloses an electronic device, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method disclosed in the first aspect of the embodiment of the present application is implemented.

[0014] In a fourth aspect, an embodiment of the present application discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method disclosed in the first aspect of the embodiment of the present application.

[0015] It should be understood that the contents described in the Summary of the Invention are not intended to limit the key or important features of the embodiments of the present application, nor are they intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1It is a flowchart of a network attack path analysis method according to one embodiment of the present application.

[0017] Figure 2 It is a system schematic diagram of a network attack path analysis system according to one embodiment of the present application.

[0018] Figure 3 It is a structural schematic diagram of an electronic device according to one embodiment of the present application.

[0019] Explanation of the accompanying drawings: 1. storage module; 2. first acquisition module; 3. second acquisition module; 4. generation module; 5. first analysis module; 6. second analysis module; 7. third analysis module; 301. CPU; 302. ROM; 303. RAM; 304. bus; 305. I / O interface; 306. input part; 307. output part; 308. storage part; 309. communication part; 310. drive; 311. removable medium. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0021] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0022] The following is combined with Figures 1 to 3 This application is described in further detail.

[0023] A cyber attack refers to any type of offensive action against a computer information system, infrastructure, computer network or personal computer device. An attack path refers to the path from the starting point of a cyber attack to the target file; the security of a system or device is generally reflected by the attack path. Therefore, for a system or device, analyzing the attack path of a possible cyber attack can help system administrators take targeted security measures, thereby improving the security of network assets.

[0024] In order to achieve the purpose of analyzing the attack path of a network attack that a system or device may suffer, the present application provides a network attack path analysis method, system, terminal and storage medium.

[0025] Reference Figure 1 , a network attack path analysis method, comprising the following steps: S100. Obtain preset target asset information, where the target asset information includes location information and asset value information of the target asset.

[0026] The location information of the target asset information is obtained through the file location information; and before obtaining the asset value information of the target asset, the value of the target asset needs to be assessed.

[0027] The specific steps for assessing the value of the target assets include: Get the confidentiality type of the target asset.

[0028] The confidentiality types of the target assets include confidentiality, internal disclosure and external disclosure. The confidentiality types are scored. The higher the confidentiality level, the higher the value of the target assets.

[0029] Analyze the content of the target asset and determine the timeliness of the target asset.

[0030] The timeliness of the target assets includes invalid, short-term effective and long-term effective. The timeliness is scored. The longer the timeliness, the higher the value of the target assets.

[0031] The target assets are valued based on their confidentiality type and timeliness.

[0032] Among them, based on the confidentiality type and timeliness of the target assets, the total value of the target assets is evaluated, sorted and output according to the preset weight ratio.

[0033] S200. Build a database.

[0034] Before building a database, you need to collect data. The specific steps for building a database are: Obtain the device information in the system, obtain all known attack means information, obtain the base points of all known attack paths based on big data, and form an attack path base point set.

[0035] The device information within the system includes the system's network topology, the system's hardware information, and the software information installed on the devices within the system.

[0036] Generate system protection layer information based on device information.

[0037] Among them, the system's protection layer information includes security protection measures such as gateways, firewalls, security protection software and access rights.

[0038] Through the vulnerability retrieval tool, the vulnerability information of each layer of the system protection layer is retrieved, and the relationship information between the vulnerability information and the system protection layer is stored.

[0039] Based on the vulnerability information, all attack means information is matched, and the relationship information between the attack means information and the vulnerability information is stored.

[0040] Among them, one vulnerability corresponds to multiple attack methods, and all attack methods and the corresponding relationship between the vulnerability and the attack method are stored during storage.

[0041] After building the database, you can start generating attack paths. First, select the end point of the attack path, that is, the target asset. The steps are: S300. Determine system protection layer information according to the location information of the target asset.

[0042] After selecting the end point of the attack path, you also need to select the base point of the attack path, that is, the starting point of the attack path, to determine the information of the system protection layer that the attack path needs to break through, and retrieve the vulnerability information and attack method information corresponding to the system protection layer information. The steps are: S400. Select the base point of the attack path from the pre-stored database, and retrieve the vulnerability information and attack means information corresponding to the system protection layer information.

[0043] Among them, the method of selecting the attack path base point is: The attack path base point set pre-stored in the database is traversed, and the base point of each attack path is selected in turn as the starting point of the attack path.

[0044] After traversing all the base points of the attack path, it is necessary to generate the attack path based on the acquired information. The steps are as follows: S500. Based on the attack path generation rule, all attack paths are generated according to the attack means information.

[0045] The attack path starts from the base point of the attack path and ends at the target asset information, and the attack means are selected and combined based on the generation rules of the attack path.

[0046] The attack path generation rules include: Based on the vulnerability information, the attack means information and the correspondence between the vulnerability information and the attack means information, a vulnerability on the current system protection layer is randomly selected, and an attack means corresponding to the vulnerability is randomly selected as the attack means to break through the current system protection layer.

[0047] Among them, when all vulnerabilities and the attack methods corresponding to all vulnerabilities are selected, all attack methods that break through the current system protection layer are obtained.

[0048] The attack means that break through each system's protection layer are respectively combined into an attack means set corresponding to each system's protection layer.

[0049] Attack methods are selected from each attack method set in the order of breaking through the system protection layer, and combined to generate all attack paths.

[0050] Once all attack paths are obtained, the risk of the attack paths can be assessed based on the value information of the target assets. The steps are as follows: S600. Obtain and output risk information of the attack path based on the asset value information and the attack path.

[0051] The steps for evaluating the attack path are: Based on the attack means information in the database, the attack means are marked.

[0052] The purpose of marking is to facilitate the distinction of attack methods. In this application, the attack method is marked as M(Y,Z); where Y represents the vulnerability and Z represents the number of the attack method; Y can also be expressed as (N,X), where N is the number of the protection layer and X is the number of the vulnerability.

[0053] Based on all attack paths, the number of attack methods with the same label in each attack path is counted and sorted for output.

[0054] Among them, each attack path can be expressed as (M1, M2....MN), and then the attack methods with the same label are counted.

[0055] According to the statistical results, the risk of the attack path is evaluated based on the rule that the frequency of occurrence of the same label is proportional to the risk.

[0056] The attack path is evaluated according to the frequency of occurrence of the same vulnerability label X or the same attack method label Z. The higher the frequency of the same label, the fewer attack methods are required to break through the path, that is, the higher the risk.

[0057] After analyzing the risk of the attack path, it is also necessary to sort the priority of vulnerability repairs and provide a solution for the repair sequence. The specific steps are: S700. Based on the risk information and vulnerability information of the attack path, output a recommended vulnerability repair sequence.

[0058] Calculate the system resources consumed by fixing the vulnerability and obtain the resource consumption value; and simulate and calculate the relative value of the change in the number of attack paths after fixing the vulnerability.

[0059] Calculate based on resource consumption value and relative value, get the repair priority of each vulnerability and output it in order.

[0060] Among them, the lower the resource consumption value, the lower the cost of fixing the vulnerability. The change in the attack path reflects the change in system security caused by fixing the vulnerability. The fewer resources consumed to fix the vulnerability and the more attack paths are reduced, the higher the priority of fixing the vulnerability.

[0061] The present application provides a network attack path analysis method, which simulates the paths of all network attacks and gives reasonable repair suggestions based on the evaluation of the harmfulness of the network attack paths, thereby achieving the purpose of analyzing the attack paths of network attacks that a system or device may suffer.

[0062] Reference Figure 3 , including a storage module 1, a first acquisition module 2, a second acquisition module 3, a generation module 4, a first analysis module 5, a second analysis module 6 and a third analysis module 7, wherein: Storage module 1, the storage module 1 pre-stores a database; The first acquisition module 2 is used to read the target asset information, system protection layer information, vulnerability information and attack means information pre-stored in the database; The second acquisition module 3 is used to read the attack path base point set pre-stored in the database; A generation module 4 is used to receive target asset information, system protection layer information, attack path base point set, vulnerability information and attack means information, and generate an attack path according to an attack path generation rule; The first analysis module 5 is used to receive target asset information, analyze and evaluate the value of the target asset and output it; The second analysis module 6 is used to analyze the risk of the attack path and output the risk analysis result; The third analysis module 7 is used to analyze and output the priority order of vulnerability repair based on vulnerability information and attack paths.

[0063] Figure 3 A schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present application is shown.

[0064] like Figure 3As shown, the electronic device includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage part into a random access memory (RAM) 303. In RAM 303, various programs and data required for system operation are also stored. CPU 301, ROM 302 and RAM 303 are connected to each other via a bus 304. An input / output I / O interface 305 is also connected to bus 304.

[0065] The following components are connected to the I / O interface 305: an input section 306 including a keyboard, a mouse, etc.; an output section 307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed, so that a computer program read therefrom is installed into the storage section 308 as needed.

[0066] In particular, according to an embodiment of the present application, the above reference flow chart Figure 1 The described process can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a machine-readable medium, and the computer program contains program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 309, and / or installed from the removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, the above-mentioned functions defined in the system of the present application are executed.

[0067] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0068] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the aforementioned module, a program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0069] The units or modules involved in the embodiments described in the present application may be implemented by software or hardware. The units or modules described may also be set in a processor, for example, it may be described as: a processor includes a first acquisition module 2, a second acquisition module 3, a generation module 4, a first analysis module 5, a second analysis module 6 and a third analysis module 7. Among them, the names of these units or modules do not constitute a limitation on the units or modules themselves under certain circumstances. For example, the generation module may also be described as "for generating all attack paths according to preset attack path generation rules".

[0070] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable storage medium stores one or more programs, and when the above programs are used by one or more processors to execute the data encryption transmission method described in the present application.

[0071] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. A network attack path analysis method, characterized in that: include: Acquire preset target asset information, wherein the target asset information includes location information and asset value information of the target asset; Determine the system protection layer information based on the location information of the target asset; Select the base point of the attack path from the pre-stored database, and retrieve the vulnerability information and attack means information corresponding to the system protection layer information; The pre-stored database stores system protection layer information, vulnerability information and the corresponding relationship between the two, and also stores attack means information and the corresponding relationship between the vulnerability information and the attack means information; The pre-stored database stores a base point set of the attack path; Based on the attack path generation rules, all attack paths are generated according to the attack means information; The risk information of the attack path is obtained and output based on the asset value information and the attack path.

2. The network attack path analysis method according to claim 1, characterized in that: Before obtaining the asset value information of the target asset, it is necessary to assess the value of the target asset. The specific steps include: Obtaining the confidentiality type of the target asset, wherein the confidentiality type includes confidentiality, internal disclosure, and external disclosure; Analyze the content of the target assets and determine the timeliness of the target assets; The target assets are valued based on their confidentiality type and timeliness.

3. The network attack path analysis method according to claim 1, characterized in that: Before launching a network attack, it is also necessary to determine the base point for launching the network attack. The specific method is: traverse the attack path base point set pre-stored in the database, and select the base point of each attack path in turn as the starting point of the attack path.

4. The network attack path analysis method according to claim 3 is characterized in that: Before using a pre-existing database, you need to build the database first. The specific steps include: Obtain device information within the system, obtain all known attack methods, and obtain the base points of all known attack paths based on big data; Generate system protection layer information based on device information; Through the vulnerability retrieval tool, the vulnerability information of each layer of the system protection layer is retrieved, and the relationship information between the vulnerability information and the system protection layer is stored; Based on the vulnerability information, all attack means information is matched, and the relationship information between the attack means information and the vulnerability information is stored.

5. The network attack path analysis method according to claim 1, characterized in that: The attack path generation rules include: Based on the vulnerability information, the attack means information and the correspondence between the vulnerability information and the attack means information, a vulnerability on the current system protection layer is randomly selected, and an attack means corresponding to the vulnerability is randomly selected as the attack means to break through the current system protection layer; The attack means of breaking through each system protection layer are respectively combined into an attack means set corresponding to each system protection layer; Attack methods are selected from each attack method set in the order of breaking through the system protection layer, and combined to generate all attack paths.

6. The network attack path analysis method according to claim 1, characterized in that: After obtaining asset value information and generating attack paths, it is necessary to evaluate the risk of the attack paths. The specific steps are as follows: Mark the attack methods based on the attack method information in the database; Based on all attack paths, count the number of attack methods with the same label in each attack path and output them in order; According to the statistical results, the risk of the attack path is evaluated based on the rule that the frequency of occurrence of the same label is proportional to the risk.

7. The network attack path analysis method according to claim 6, characterized in that: After assessing the risk of the attack path, you also need to prioritize the fixes for the vulnerabilities. The specific steps are: Calculate the system resources consumed by fixing the vulnerability and obtain the resource consumption value; and simulate and calculate the relative value of the change in the number of attack paths after fixing the vulnerability; Calculate based on resource consumption value and relative value, get the repair priority of each vulnerability and output it in order.

8. A network attack path analysis system, comprising: A storage module (1), wherein the storage module (1) has a database pre-stored therein; A first acquisition module (2) is used to read the target asset information, system protection layer information, vulnerability information and attack means information pre-stored in the database; A second acquisition module (3) is used to read the attack path base point set pre-stored in the database; A generation module (4) is used to receive the target asset information, system protection layer information, attack path base point set, vulnerability information and attack means information, generate an attack path and output it; A first analysis module (5), configured to receive the target asset information, analyze the value of the target asset according to the target asset information, and output the value; A second analysis module (6), configured to receive the attack path, analyze the risk of the attack path and output a risk analysis result; The third analysis module (7) is used to receive the vulnerability information and the attack path, analyze the priority order of vulnerability repair based on the vulnerability information and the attack path, and output it.

9. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images