Network attack adaptive analysis response method and system based on attacker perspective

Abstract

The invention discloses a network attack self-adaptive analysis response method and system based on an attacker view angle. The method comprises the following steps of: based on MITRE ATTamp; the CK model is used for analyzing all knowledge contained in the attacker behavior knowledge framework and the mutual logic relationship among the knowledge, and constructing a network attack behavior model for the electric power industrial control system; constructing a risk blocking knowledge base for the power industrial control system network environment based on attack dimension, asset dimension, vulnerability dimension and strategy dimension data; based on the risk blocking knowledge base, modularizing a security facility interface, and converting a network security alarm into an event, so as to realize fine-grained emergency response blocking of a security event based on scenario; and based on the service operation state, the network flow characteristics and the security and protection facility strategy configuration in the system operation process after the processing, the network security index, the attack restraint state and the service state are evaluated and fed back, and the processing response strategy is adjusted based on the evaluation feedback result. According to the scheme of the invention, the capability of responding to the network attack event is improved.

Description

Technical Field

[0001] The present invention belongs to the field of network attack defense, and in particular relates to a network attack adaptive analysis and response method and system based on the attacker's perspective. Background Art

[0002] In today's digital age, the complexity and diversity of cyber attacks are growing exponentially, bringing unprecedented challenges to network security protection. Traditional network security protection methods mostly rely on fixed rules and pre-set feature patterns. Their ability to cope with the endless and ever-changing attack methods is stretched, making it difficult to effectively identify and resist complex and ever-changing network attacks.

[0003] As a comprehensive and in-depth knowledge framework that describes attacker behavior, the ATT&CK model provides a valuable perspective for understanding the strategies, techniques, and processes of cyber attacks. Figure 1 As shown in the figure, tactics represent the goals of attackers when they perform ATT&CK techniques or sub-techniques, and explain why attackers perform this operation. Tactics are contextual classifications of individual techniques and standardized definitions of what attackers do during an attack, such as persistence, discovery, lateral movement, execution, and data theft. Tactics can also be regarded as labels in ATT&CK. Depending on the use of certain techniques or sub-techniques to achieve different goals, these techniques or sub-techniques can be labeled with one or more tactical labels. Techniques / sub-techniques represent the way attackers achieve tactical goals by performing actions, or they can represent what attackers gain by performing an action. Sub-techniques further subdivide the behaviors described by the techniques and explain more specifically how attackers use these behaviors to achieve their goals. There may be many ways or techniques to achieve tactical goals, so there are multiple techniques in each tactic category. Similarly, there may be multiple ways to perform a technique, so there may be multiple different sub-techniques under a technique. Attacker organizations usually represent well-known intrusion teams, threat organizations, actor organizations, or activities that carry out targeted and persistent threat activities. Software represents an application instance of a technique or sub-technique. During the intrusion process, attackers usually use different types of software. Mitigations are security concepts and technology categories that prevent a technology or sub-technology from being successfully executed, including mitigations such as application isolation and sandboxing, data backup, execution protection, and network segmentation. A data source object contains the data source name, key technical information, and metadata, including the ID, definition, data collection layer, and data components that make up the associated values / attributes of the data source.

[0004] However, the existing technologies still have many deficiencies in applying the ATT&CK model to actual network attack detection and response. For example, in terms of adaptive response, it is often impossible to quickly adjust and optimize the response strategy according to the real-time attack situation and dynamic changes in the network environment; in terms of precise disposal, the analysis and positioning of attack behaviors are not accurate enough, which greatly reduces the pertinence and effectiveness of the response measures.

[0005] In addition, the existing ATT&CK model is generally difficult to adapt to the unique network environment of the power monitoring system, and cannot fully and accurately describe and detect the unique attack behaviors in these environments. For the power system, the software application instances used by the attacker are usually not the focus of the attack event analysis. The attack analysis focuses more on the detection of the attacker's access to the network, the attack path and the attack method. The technology and sub-technology only target the characteristics of a single behavior, and the technology / sub-technology lacks the behavior time sequence relationship between multiple behaviors. There is a lack of association rules for event analysis, and it is difficult to form an attack behavior chain. There are complex correlations and dependencies between the various attack technologies in the ATT&CK model, but in actual applications, they generally only target the characteristics of a single behavior, and the technology / sub-technology lacks the behavior time sequence relationship between multiple behaviors. There is a lack of association rules for event analysis, which makes it difficult to correctly identify the attack path and attack intention during the detection and response process, affecting the detection and response effect. After the attack behavior is detected, it is necessary to formulate a corresponding response strategy based on factors such as the attack type, threat level, attack target, importance, and impact range. However, the ATT&CK model mainly focuses on the description and analysis of attack behaviors, and lacks detailed guidance and support for how to automatically formulate and execute response strategies. This reduces the efficiency and timeliness of response in actual applications. After suffering a cyber attack, it is difficult to accurately understand the severity and scope of the attack, and it is impossible to take effective response measures in time. The ATT&CK model mainly analyzes and detects the attack behavior of external attackers, but the model's detection ability is relatively weak for internal threats such as malicious behavior or misoperation of internal personnel. In actual applications, it is more necessary to perform correlation analysis and pattern matching on the upstream and downstream behaviors of personnel, rather than single behavior detection. Summary of the invention

[0006] In order to address the deficiencies in the prior art, the present invention provides a method and system for adaptive analysis and response to network attacks based on the attacker's perspective, so as to solve the technical problem of adaptive analysis and response to network attack behaviors in the industrial control network environment of a power system.

[0007] In order to solve the above technical problems, the present invention adopts the following technical solutions.

[0008] The present invention first discloses a network attack adaptive analysis and response method based on the attacker's perspective, the method comprising the following steps:

[0009] Step 1: Based on the MITRE ATT&CK model, analyze all the knowledge and the logical relationships between knowledge in the attacker behavior knowledge framework, and build a network attack behavior model for power industrial control systems;

[0010] Step 2: Construct a risk blocking knowledge base for the network environment of the power industrial control system based on the attack dimension, asset dimension, vulnerability dimension and strategy dimension data;

[0011] Step 3: Based on the risk blocking knowledge base, the security facility interface is componentized, and the network security alarm is evented to achieve fine-grained emergency response blocking of scenario-based security events;

[0012] Step 4: Based on the business operation status, network traffic characteristics and security facility policy configuration during the system operation after the disposal, the network security indicators, attack containment status and business status will be evaluated and feedback will be provided, and the disposal response strategy will be adjusted based on the evaluation feedback results.

[0013] The present invention further includes the following preferred embodiments:

[0014] The above-mentioned analysis of all knowledge and the mutual logical relationship between knowledge in the attacker behavior knowledge framework based on the MITRE ATT&CK model further includes:

[0015] With reference to various current security standards and specifications, the advanced persistent threat (APT) organization reports disclosed by the structured threat information expression (STIX) are analyzed, and the logical relationship between each piece of knowledge and knowledge in the tactics, technology, sub-technology, and mitigation measures contained in the attacker behavior knowledge framework is described using structured language. The entity types in the attack behaviors applicable to the power industrial control system are redefined, including attackers, attack methods, attack targets, attack paths, and protection measures.

[0016] The attack dimension data provides common tactical intentions and technical patterns, as well as attack organization and software information; the asset dimension data comes from the platform asset ledger, and identifies the asset information dimension through detection and discovery, providing a structured naming specification description and identification for the system and hardware and software equipment; the vulnerable dimension data comes from the security vulnerabilities and non-compliance items in the security verification function of the network security management platform; the policy dimension data mainly comes from the policy configuration information of power-specific security equipment, the policy configuration information of general security equipment, and the operating status information of network equipment.

[0017] The componentization of the security facility interface and the eventization of the network security alarm to achieve fine-grained emergency response blocking of scenario-based security events further includes:

[0018] From the bottom up, security incidents are orchestrated through the componentization of security facility interfaces and the eventization of network security alarms. From the top down, network security emergency response plans and on-site disposal plans are formalized and implemented to achieve the scenario-based alarm incident handling process. With the help of security event orchestration and scenario-based alarm incident handling process, the integration and orchestration of emergency response capabilities are achieved.

[0019] The security facilities mentioned above are various technologies, mechanisms, and tools in the cyberspace of the power industrial control system, including network security protection equipment.

[0020] The present invention also discloses a network attack adaptive analysis and response system based on the attacker's perspective using the aforementioned network attack adaptive analysis and response method based on the attacker's perspective, comprising:

[0021] The network attack behavior modeling module is used to analyze all the knowledge and mutual logical relationships between knowledge contained in the attacker behavior knowledge framework based on the MITRE ATT&CK model, and to build a network attack behavior model for the power industrial control system;

[0022] A risk blocking knowledge base construction module is used to construct a risk blocking knowledge base for the network environment of the power industrial control system based on attack dimension, asset dimension, vulnerability dimension and strategy dimension data;

[0023] An emergency response and disposal module is used to componentize the security facility interface and eventize the network security alarm based on the risk blocking knowledge base, so as to realize fine-grained emergency response blocking of security events based on scenarios;

[0024] The evaluation and feedback module is used to evaluate and provide feedback on network security indicators, attack containment status and business status based on the business operation status, network traffic characteristics and security facility policy configuration during the system operation process after disposal, and adjust the disposal response strategy based on the evaluation feedback results.

[0025] Accordingly, the present application also discloses a terminal, including a processor and a storage medium;

[0026] The storage medium is used to store instructions;

[0027] The processor is used to operate according to the instructions to execute the steps of the aforementioned network attack adaptive analysis and response method based on the attacker's perspective.

[0028] Correspondingly, the present application also discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the aforementioned network attack adaptive analysis and response method based on the attacker's perspective are implemented.

[0029] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a method and system for adaptive analysis and response of network attacks based on the attacker's perspective, realizes adaptive analysis and response of network attacks on the power industrial control system from the attacker's perspective, and constructs adaptive analysis and response of network attack behaviors dedicated to the power industrial control field in view of the relatively closed network environment and the relatively typical structure of the power industrial control system, realizes the scenario-based and intelligent handling of network attack events, and comprehensively improves the response capability to network attack events. Specifically:

[0030] (1) Based on the MITRE ATT&CK knowledge base, the power industrial control system's own asset information, vulnerability information, policy information, emergency plans and other network security related information are further analyzed, integrated, deduplicated and simplified to build a dedicated network security risk blocking knowledge base for the power industrial control system, providing security personnel with intuitive and reliable security knowledge and response means query, and also providing support for subsequent security scenario applications;

[0031] (2) With reference to various current security standards and specifications, an object-oriented modeling approach is adopted to redefine the definitions of various entities and the logical relationships between entities in the attacker behavior model, supplement the security information related to assets involved in the attack behavior, and solve the problem that network attack incidents are difficult to detect and the impact cannot be assessed;

[0032] (3) Taking the attack event as the core, taking into account the attack area, the importance of the assets involved, the possible spread of the attack, and the risks of the assets in the system, we follow the principle of minimizing risk management, analyze and match the required security facilities and configuration strategies, and ensure that the response strategy does not over-consume security resources or introduce new security risks;

[0033] (4) In line with network security goals and business needs, implement monitoring and linkage disposal of various data during the system operation process, including asset operation information, attack event information within the impact range, response strategy execution data, network environment performance data, and business operation data, update the network space model within the system, optimize and adjust the disposal response strategy, and establish a continuous dynamic cycle evaluation feedback mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a schematic diagram of the ATT&CK object relationship model in the present invention.

[0035] Figure 2 It is a schematic diagram of the structure of the network attack adaptive analysis and response solution based on the attacker's perspective in the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0037] The embodiments described in this application are only some embodiments of the present invention, not all embodiments. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the protection scope of the present invention.

[0038] In view of the shortcomings of the prior art, the present invention proposes a network attack adaptive analysis and response method and system based on the attacker's perspective. On the basis of the MITRE ATT&CK model, an adaptive analysis and response method for network attack behaviors suitable for the industrial control network environment of the power system is adopted, including modeling of network attack behaviors for the power system, building a dedicated risk blocking knowledge base based on the knowledge graph, and applying intelligent and scenario-based linkage disposal methods to achieve adaptive analysis and response to major network security alarm events in the power system.

[0039] See also Figure 2 As shown, the network attack adaptive analysis and response method based on the attacker's perspective disclosed by the present invention includes the following steps:

[0040] Step 1: Based on the MITRE ATT&CK model, analyze all the knowledge and logical relationships between knowledge in the attacker behavior knowledge framework, and build a network attack behavior model for power industrial control systems.

[0041] With reference to various current security standards and specifications, the Advanced Persistent Threat (APT) organization reports disclosed by Structured Threat Information eXpression (STIX) are analyzed, and the knowledge and logical relationships between tactics, techniques, sub-techniques, mitigation measures and other knowledge contained in the attacker behavior knowledge framework are described using structured language. The entity types in the attack behaviors applicable to power industrial control systems are redefined, including attackers (attack sources), attack methods (attack means, attack techniques, attack characteristics, etc.), attack targets (attack assets), attack paths (access assets, path assets, etc.), and protection measures (protection means).

[0042] The attacker is uniquely identified by the IP address. The IP address can be associated with the region, network location and other information. The attack method includes specific attack tactics, attack techniques and attack sub-techniques. Referring to the MITRE ATT&CK model, the attack tactics are TA ID , the attack technique is T ID , the attack sub-technology is TID.00X . (For example, the unique number of the attack tactical authority upgrade is TA 0004 , the attack technology account control under this attack tactic is T 1098 The account control attack technology also includes the SSH authorization key attack sub-technology, numbered T 1098.004 ). Each attack tactic, attack technique and attack sub-technique has a unique identification number to distinguish different attack tactics and techniques. The attack target is uniquely identified by the asset ID, covering the type of asset (such as server, workstation, network switch, router, database, firewall, etc.). Associated with the system, importance level, etc. The attack path includes the sequence of asset identifications involved in the attack event. The protection measures vary according to the type of asset equipment, including network session blocking, firewall policy start and stop, network switch port shutdown and other means.

[0043] For relationships between entities, these include:

[0044] The relationship between attackers and attack methods: attackers can use a variety of attack methods to carry out attacks, which is a many-to-many relationship.

[0045] The relationship between attackers and targets: an attacker may attack multiple different targets, and a target may be targeted by multiple different attackers. It is a many-to-many relationship.

[0046] The relationship between the attacker and the attack path: The attacker uses a specific attack path to approach and attack the target, which is a one-to-one relationship.

[0047] The relationship between protection measures and attack methods: Protection measures are designed to defend against specific attack methods. In view of the power industrial control environment and business characteristics, the attack methods generally include multiple protection measures, which is a one-to-many relationship.

[0048] Through the above formal description of entities and relationships between entities, the elements related to attack behaviors applicable to power industrial control systems can be modeled and analyzed more clearly and accurately.

[0049] Step 2: Construct a risk blocking knowledge base for the power industrial control system network environment based on attack dimension, asset dimension, vulnerability dimension and strategy dimension data.

[0050] To realize the adaptive analysis and response of network attacks on power industrial control systems, it is necessary to have a risk blocking knowledge base that is adapted to the network environment of power industrial control systems. The network security risk blocking knowledge graph involves data in four dimensions: attack dimension, asset dimension, vulnerability dimension, and strategy dimension, which are stored in a semi-structured format. The MITRE ATT&CK knowledge base provides the basis for attack dimension data. ATT&CK provides common tactical intentions and technical patterns, as well as attack organization and software information through observable data of APT attack organizations. Asset dimension data mainly comes from platform asset ledgers, asset information identified through detection and discovery, and other dimensions, providing descriptions and identifications of structured naming specifications for systems and hardware and software equipment. Vulnerability dimension data mainly comes from security vulnerabilities and non-compliance items in the security verification function of the network security management platform. Strategy dimension data mainly comes from power-specific security equipment policy configuration information, such as vertical encryption authentication devices, general security equipment policy configuration information, such as firewall ACL information, and network equipment operation status information, such as network switch port status. These knowledge bases often rely on expert experience to collect, verify and condense threat intelligence, providing authoritative and reliable guarantees for the construction of network security risk blocking knowledge graphs.

[0051] The following are specific examples of attack dimension, asset dimension, vulnerability dimension, and strategy dimension data:

[0052] 1. Attack dimension data structure:

[0053] Tactic ID: TA0005 (Privilege Escalation)

[0054] Technical ID: T1078 (valid account)

[0055] Sub-Technology ID: T1078.002 (Local Account)

[0056] Attacker group name: APT32

[0057] Software Information: Malware.Agent

[0058] Attack time series: [“2024-12-01 10:05:00 - Login attempt failed”, “2024-12-01

[0059] 10:10:00-Exploiting vulnerabilities to obtain local account permissions", "2024-12-01 10:15:00-Starting to explore system resources"]

[0060] 2. Asset dimension data structure:

[0061] Asset ID: 000000005

[0062] Asset Name: Server_B

[0063] Asset Type: 3 (Server)

[0064] Online status: true

[0065] Hardware: ["Intel Xeon CPU E5-2620 v4@2.10GHz","32GB DDR4

[0066] Memory", "500GB SSD"]

[0067] Software: ["Windows Server 2019", "IIS10.0"]

[0068] Network: [“IP Address:192.168.2.5”, “Subnet Mask:255.255.255.0”,

[0069] "Gateway:192.168.2.1"]

[0070] 3. Fragile Dimensional Data Structure

[0071] Name: CVE-2024-2345

[0072] ID: CVE-2024-2345

[0073] Type: Improper permissions management

[0074] Hazard level: 2 (medium)

[0075] Non-compliance item: "Failure to update system patches in a timely manner"

[0076] Category: 4 (Operating System Vulnerabilities)

[0077] 4. Strategy dimension data structure

[0078] Asset ID: 000000005

[0079] Asset Type: 3

[0080] Source IP address: 192.168.3.10

[0081] Source end IP address: 192.168.3.20

[0082] Source starting port address: 22

[0083] Source end port address: 22

[0084] Destination starting IP address: 192.168.2.5

[0085] Destination end IP address: 192.168.2.5

[0086] Destination start port address: 22

[0087] Destination end port address: 22

[0088] Direction: 1 (Inbound)

[0089] Protocol: 22 (SSH)

[0090] Network port: eth1:22

[0091] Interface name: eth1

[0092] Connection status: 0 (not connected)

[0093] The knowledge in the risk blocking knowledge base covers attack behaviors and technical characteristics in attack incidents, the temporal relationship of attack behaviors, etc., integrates relevant information such as regions, businesses, assets, etc. in the system, and has standardized disposal methods.

[0094] Step 3: Based on the risk blocking knowledge base, the security facility interface is componentized through functional encapsulation, interface standardization, permission management, etc., to provide basic component calls for fine-grained emergency response blocking of scenario-based security incidents.

[0095] The function encapsulation includes independently encapsulating specific functions of each device response interface according to different device types to form fine-grained response components.

[0096] For example, the host device's peripheral interface blocking function is encapsulated as a "ServerPortBlock" component, the network port blocking function is encapsulated as a "PeripheralPortBlock" component, and the session blocking function is encapsulated as a "SessionPortBlock" component. The network port interface blocking function of the network device is encapsulated as an "InterfacePortBlock" component. The firewall's port blocking function is encapsulated as a "FirewallPortBlock" component, and the policy blocking function is encapsulated as an "AccessControlBlock" component.

[0097] The interface standardization includes formulating unified JSON data structure interface call specifications and data interaction standards. The input parameter format adopts a unified data structure, and the output result is returned, including the success or failure mark, detailed execution result information, etc.

[0098] The permission management includes that different permissions can be called according to the identity of the operator for different permission levels of the interface, and before each interface call, the identity and permission scope of the caller are verified according to the predefined permission policy. Only the call request that passes the permission verification will be allowed to continue to execute, ensuring the security and compliance of the interface.

[0099] The security facilities mentioned above refer to various technologies, mechanisms, and tools in the cyberspace of the power industrial control system, including network security protection equipment such as host probes, network switches, and firewalls, and provide a variety of blocking methods such as host control, network equipment control, and fire protection equipment control in a service-oriented manner.

[0100] At present, the way of handling network incidents in power industrial control systems is basically to handle and respond in accordance with manual experience. Most of them are to cut off the network to which the attack source or attack target belongs, etc., which will inevitably expand the impact of the handling and affect the operation of power production business. As a result, on-duty operation and maintenance personnel cannot handle the problems in time even if they find them in time. When a network attack occurs, it is easy to cause the scope of the attack to expand and the risk of further escalation of the attack.

[0101] Therefore, with attack events as the core, attack behaviors, assets, asset relationships, and security facility strategies are integrated and arranged in a scenario-based manner to form a linked security facility blocking module and a fine-grained disposal strategy to achieve rapid response and precise strikes on security incidents, and enhance the emergency response capabilities of the power monitoring system for network security incidents.

[0102] (1) Attack scenario-based alarm data integration:

[0103] The alarm event related information will be collected from multiple data sources such as network security devices (such as firewalls, intrusion detection systems, etc.), host system logs, application logs, etc. This information includes alarm time, alarm type, attack source IP address, attack source asset ID (optional), attack target IP address, attack target asset ID, port number, protocol type, etc. The collected multi-source data will be integrated with IP address and asset ID as the core dimensions, and similar alarms generated by the same attack behavior on different devices will be deduplicated, and related information will be associated and integrated.

[0104] (2) Attack scenario feature extraction and analysis:

[0105] Further analyze the characteristic relationship between the alarm events after correlation and integration, as well as the degree of matching with known attack patterns. Use Apriori machine learning algorithm to classify and correlate alarm events to identify possible attack scenarios.

[0106] (3) Attack scenario construction and identification:

[0107] Based on the feature analysis results, a specific attack scenario is constructed. Scenario construction includes determining the attack starting point, attack path, and the scope of affected assets.

[0108] Step 4: Based on the business operation status, network traffic characteristics and security facility policy configuration during the system operation after the disposal, the network security indicators, attack containment status and business status will be evaluated and feedback will be provided, and the disposal response strategy will be adjusted based on the evaluation feedback results.

[0109] By utilizing the real-time update of the cyberspace model, we monitor the business operation status, network traffic characteristics, security facility strategy configuration and other information during the system operation after the coordinated disposal, so as to dynamically optimize and adjust the disposal response strategy and establish a continuous dynamic cycle evaluation and feedback mechanism.

[0110] Evaluation feedback is a comprehensive and objective evaluation and feedback of the execution effect of the linkage disposal. Based on the unified cyberspace model, the optimization of spatial model attributes can be implemented to monitor asset status, operation behavior, and network connection relationships, so as to conduct in-depth analysis and quantitative evaluation of network security indicators after linkage disposal, and provide scientific basis and strong support for subsequent strategy adjustment and optimization. Through continuous evaluation and feedback, the system can achieve self-learning and continuous improvement, so that it can better adapt to the ever-changing cyber attack situation and environment.

[0111] Specifically, in the quantitative evaluation of network security indicators, a comprehensive quantitative evaluation of network security is carried out through the recognition accuracy, recall rate and F1-score of network threats.

[0112] Precision measures the proportion of samples predicted to be positive that are actually positive:

[0113]

[0114] Recall measures the proportion of samples that are actually positive that are correctly identified as positive:

[0115]

[0116] F1-score is used to measure the performance of classification models:

[0117]

[0118] True positives (TP) represent the number of samples that the model correctly identifies as positive examples.

[0119] False positives (FP) represent the number of samples where the model incorrectly identifies negative examples as positive.

[0120] True negatives (TN) represent the number of samples that the model correctly identifies as negative examples.

[0121] False negatives (FN) represent the number of samples where the model incorrectly identifies positive examples as negative examples.

[0122] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a method and system for adaptive analysis and response of network attacks based on the attacker's perspective, realizes adaptive analysis and response of network attacks on the power industrial control system from the attacker's perspective, and constructs adaptive analysis and response of network attack behaviors dedicated to the power industrial control field in view of the relatively closed network environment and the relatively typical structure of the power industrial control system, realizes the scenario-based and intelligent handling of network attack events, and comprehensively improves the response capability to network attack events. Specifically:

[0123] (1) Based on the MITRE ATT&CK knowledge base, the power industrial control system's own asset information, vulnerability information, policy information, emergency plans and other network security related information are further analyzed, integrated, deduplicated and simplified to build a dedicated network security risk blocking knowledge base for the power industrial control system, providing security personnel with intuitive and reliable security knowledge and response means query, and also providing support for subsequent security scenario applications;

[0124] (2) With reference to various current security standards and specifications, an object-oriented modeling approach is adopted to redefine the definitions of various entities and the logical relationships between entities in the attacker behavior model, supplement the security information related to assets involved in the attack behavior, and solve the problem that network attack incidents are difficult to detect and the impact cannot be assessed;

[0125] (3) Taking the attack event as the core, taking into account the attack area, the importance of the assets involved, the possible spread of the attack, and the risks of the assets in the system, we follow the principle of minimizing risk management, analyze and match the required security facilities and configuration strategies, and ensure that the response strategy does not over-consume security resources or introduce new security risks;

[0126] (4) In line with network security goals and business needs, implement monitoring and linkage disposal of various data during the system operation process, including asset operation information, attack event information within the impact range, response strategy execution data, network environment performance data, and business operation data, update the network space model within the system, optimize and adjust the disposal response strategy, and establish a continuous dynamic cycle evaluation feedback mechanism.

[0127] The present invention may be a system, a method and / or a computer program product. The present invention also discloses a network attack adaptive analysis and response system based on the attacker's perspective based on the aforementioned network attack adaptive analysis and response method based on the attacker's perspective, comprising:

[0128] The network attack behavior modeling module is used to analyze all the knowledge and mutual logical relationships between knowledge contained in the attacker behavior knowledge framework based on the MITRE ATT&CK model, and to build a network attack behavior model for the power industrial control system;

[0129] A risk blocking knowledge base construction module is used to construct a risk blocking knowledge base for the network environment of the power industrial control system based on attack dimension, asset dimension, vulnerability dimension and strategy dimension data;

[0130] An emergency response and disposal module is used to componentize the security facility interface and eventize the network security alarm based on the risk blocking knowledge base, so as to realize fine-grained emergency response blocking of security events based on scenarios;

[0131] The evaluation and feedback module is used to evaluate and provide feedback on network security indicators, attack containment status, and business status based on the business operation status, network traffic characteristics, and security facility policy configuration during the operation of the system after the disposal, and adjust the disposal response strategy based on the evaluation feedback results.

[0132] Based on the spirit of the present invention, those skilled in the art can easily think that a computer program product can be obtained based on the aforementioned network attack adaptive analysis and response method based on the attacker's perspective. The computer program product may include a computer-readable storage medium, which carries computer-readable program instructions for enabling a processor to implement various aspects of the present disclosure. That is, the present application also includes a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the aforementioned network attack adaptive analysis and response method based on the attacker's perspective.

[0133] Computer readable storage medium can be a tangible device that can keep and store the instructions used by the instruction execution device. Computer readable storage medium can be, for example, - but not limited to - electrical storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or any suitable combination of the above. More specific examples (non-exhaustive list) of computer readable storage medium include: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, for example, punch card or groove protrusion structure with instructions stored thereon and any suitable combination of the above. Computer readable storage medium used here is not interpreted as instantaneous signal itself, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave propagated by waveguide or other transmission medium (for example, light pulse by optical fiber cable) or electrical signal transmitted by wire.

[0134] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0135] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages-such as Smalltalk, C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network-including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may be personalized by utilizing the state information of a computer-readable program instruction, and the electronic circuit may execute a computer-readable program instruction, thereby realizing various aspects of the present disclosure.

[0136] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A network attack adaptive analysis and response method based on the attacker's perspective, characterized in that: The following steps are involved: Step 1: Based on the MITRE ATT&CK model, analyze all the knowledge and the logical relationships between knowledge in the attacker behavior knowledge framework, and build a network attack behavior model for power industrial control systems; Step 2: Construct a risk blocking knowledge base for the network environment of the power industrial control system based on the attack dimension, asset dimension, vulnerability dimension and strategy dimension data; Step 3: Based on the risk blocking knowledge base, the security facility interface is componentized, and the network security alarm is evented to achieve fine-grained emergency response blocking of scenario-based security events; Step 4: Based on the business operation status, network traffic characteristics and security facility policy configuration during the system operation after the disposal, the network security indicators, attack containment status and business status will be evaluated and feedback will be provided, and the disposal response strategy will be adjusted based on the evaluation feedback results.

2. The method for adaptively analyzing and responding to network attacks based on the attacker's perspective according to claim 1 is characterized in that: The above-mentioned analysis of all knowledge and the mutual logical relationship between knowledge in the attacker behavior knowledge framework based on the MITRE ATT&CK model further includes: With reference to various current security standards and specifications, the advanced persistent threat (APT) organization reports disclosed by the structured threat information expression (STIX) are analyzed, and the logical relationship between each piece of knowledge and knowledge in the tactics, technology, sub-technology, and mitigation measures contained in the attacker behavior knowledge framework is described using structured language. The entity types in the attack behaviors applicable to the power industrial control system are redefined, including attackers, attack methods, attack targets, attack paths, and protection measures.

3. The method for adaptively analyzing and responding to network attacks based on the attacker's perspective according to claim 2 is characterized in that: The attack dimension data provides common tactical intentions and technical patterns, as well as attack organization and software information; the asset dimension data comes from the platform asset ledger, and identifies the asset information dimension through detection and discovery, providing a structured naming specification description and identification for the system and hardware and software equipment; the vulnerable dimension data comes from the security vulnerabilities and non-compliance items in the security verification function of the network security management platform; the policy dimension data mainly comes from the policy configuration information of power-specific security equipment, the policy configuration information of general security equipment, and the operating status information of network equipment.

4. The method for adaptively analyzing and responding to network attacks based on the attacker's perspective according to claim 3 is characterized in that: The componentization of the security facility interface and the eventization of the network security alarm to achieve fine-grained emergency response blocking of scenario-based security events further includes: From the bottom up, security incidents are orchestrated through the componentization of security facility interfaces and the eventization of network security alarms. From the top down, network security emergency response plans and on-site disposal plans are formalized and implemented to achieve the scenario-based alarm incident handling process. With the help of security event orchestration and scenario-based alarm incident handling process, the integration and orchestration of emergency response capabilities are achieved.

5. The method for adaptively analyzing and responding to network attacks based on the attacker's perspective according to claim 4 is characterized in that: The security facilities mentioned above are various technologies, mechanisms, and tools in the cyberspace of the power industrial control system, including network security protection equipment.

6. A network attack adaptive analysis and response system based on the attacker's perspective, characterized in that: include: The network attack behavior modeling module is used to analyze all the knowledge and mutual logical relationships between knowledge contained in the attacker behavior knowledge framework based on the MITRE ATT&CK model, and to build a network attack behavior model for the power industrial control system; A risk blocking knowledge base construction module is used to construct a risk blocking knowledge base for the network environment of the power industrial control system based on attack dimension, asset dimension, vulnerability dimension and strategy dimension data; An emergency response and disposal module is used to componentize the security facility interface and eventize the network security alarm based on the risk blocking knowledge base, so as to realize fine-grained emergency response blocking of security events based on scenarios; The evaluation and feedback module is used to evaluate and provide feedback on network security indicators, attack containment status and business status based on the business operation status, network traffic characteristics and security facility policy configuration during the system operation process after disposal, and adjust the disposal response strategy based on the evaluation feedback results.

7. The network attack adaptive analysis and response system based on the attacker's perspective according to claim 6 is characterized in that: The network attack behavior modeling module is further used to: With reference to various current security standards and specifications, the advanced persistent threat (APT) organization reports disclosed by the structured threat information expression (STIX) are analyzed, and the logical relationship between each piece of knowledge and knowledge in the tactics, technology, sub-technology, and mitigation measures contained in the attacker behavior knowledge framework is described using structured language. The entity types in the attack behaviors applicable to the power industrial control system are redefined, including attackers, attack methods, attack targets, attack paths, and protection measures.

8. The network attack adaptive analysis and response system based on the attacker's perspective according to claim 7 is characterized in that: The attack dimension data provides common tactical intentions and technical patterns, as well as attack organization and software information; the asset dimension data comes from the platform asset ledger, and identifies the asset information dimension through detection and discovery, providing a structured naming specification description and identification for the system and hardware and software equipment; the vulnerable dimension data comes from the security vulnerabilities and non-compliance items in the security verification function of the network security management platform; the policy dimension data mainly comes from the policy configuration information of power-specific security equipment, the policy configuration information of general security equipment, and the operating status information of network equipment.

9. The network attack adaptive analysis and response system based on the attacker's perspective according to claim 8 is characterized in that: The emergency response module is further used to: From the bottom up, security incidents are orchestrated through the componentization of security facility interfaces and the eventization of network security alarms. From the top down, network security emergency response plans and on-site disposal plans are formalized and implemented to achieve the scenario-based alarm incident handling process. With the help of security event orchestration and scenario-based alarm incident handling process, the integration and orchestration of emergency response capabilities are achieved.

10. The network attack adaptive analysis and response system based on the attacker's perspective according to claim 9 is characterized in that: The security facilities mentioned above are various technologies, mechanisms, and tools in the cyberspace of the power industrial control system, including network security protection equipment.

11. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instruction to execute the steps of the network attack adaptive analysis and response method based on the attacker's perspective according to any one of claims 1-5.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the network attack adaptive analysis and response method based on the attacker's perspective described in any one of claims 1 to 5 are implemented.

Images