General complex network attack inference method based on Bayesian ATTCK network

Abstract

The invention discloses a method based on Bayesian ATTamp; the invention discloses a general complex network attack inference method for a CK network, and relates to the technical field of network security. Performing sequential logic modeling on tactics in the CK framework to ensure that a generated attack sequence is logically coherent and reflects a behavior pattern of a real complex network attack; based on the tactical sequential logic sequence, guiding of expert knowledge on tactical transfer is expanded into guiding on technology transfer, and a technology dependence network is constructed and formed; an anonymized data set from a real network attack event is adopted, and a technical dependency network is further optimized by utilizing a technical co-occurrence relation in the data set; bayesian ATTamp is carried out on the basis of a technical co-occurrence relation between a technical dependency network and a real network attack data set; the CK network performs structure learning and parameter learning, constructs a network model independent of a specific threat detection system, and realizes complex network attack inference independent of a specific system.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a general complex network attack inference method based on a Bayesian ATT&CK network. Background Art

[0002] Advanced Persistent Threat (complex network attacks) have posed a serious threat to global network security. Therefore, defense against complex network attacks has received increasing attention from network security personnel and has gradually become a research hotspot.

[0003] The use of advanced network attack techniques and complex multi-step attacks pose challenges to defense work. Currently, more and more research works are modeling complex network attacks from the tactics, techniques, and procedures (TTP) level of attack behavior, avoiding the underlying features such as intrusion indicators, network and host artifacts that are easily bypassed, and improving the robustness of the detection model. However, attack inference based on TTP still has two shortcomings: first, attack event reports list the tactics and techniques used in the attack activities, but few reports list the sequence information between the techniques, and the sequence information of the techniques is the key to attack prediction and attack investigation; second, the dependency correlation analysis between the techniques is insufficient, which restricts the ability to infer attack patterns.

[0004] In the previous complex network attack inference methods, HA Kholidy et al. proposed an intrusion alarm correlation method based on hidden Markov model, which used raw alarm data but could not represent the real APT attack behavior; Seungoh Choi proposed an attack sequence modeling based on hidden Markov model, but lacked data sets to build a real model and used too strong time series assumptions; Antonia Nisioti et al. proposed a data-driven decision support framework called DISCLOSE, which was modeled only based on expert knowledge rather than objective data, and the rationality of the model lacked real data verification; the BAN model proposed by Youngjoon Kim et al. tended to predict the next attack and defense behavior, but did not achieve modeling of the complete attack sequence. The current research has certain defects to varying degrees: lack of a large number of real and credible data sets, lack of research on modeling complex network attack sequences, and lack of a combination of expert knowledge and objective data. Summary of the invention

[0005] The purpose of the present invention is to provide a general complex network attack inference method based on the Bayesian ATT&CK network to solve the problems existing in the prior art of lack of a large amount of authentic and reliable data sets when inferring complex network attacks, lack of research on modeling complex network attack sequences, and lack of combination of expert knowledge and objective data.

[0006] To achieve the above object, the present invention provides a general complex network attack inference method based on Bayesian ATT&CK network, comprising the following steps: Step 1: Tactical temporal logic modeling based on expert knowledge: Using Cyber ​​Kill Chain and empirical rules as the research basis, the tactics in the ATT&CK framework are modeled in temporal logic to ensure that the generated tactical sequence is logically coherent and reflects the behavior patterns of real complex cyber attacks. Step 2: Construct a technology dependency network based on tactical temporal logic. The technology dependency network uses a weighted directed acyclic graph (DAG) to represent the dependency relationship between attack technologies. Nodes represent technologies, and edges represent the dependency between technologies. The dependency weights between technologies are evenly differentiated to form a technology dependency network. Step 3: Optimize the structure of the technology dependency network based on technology co-occurrence. The structure optimization of the technology dependency network is based on the technology co-occurrence relationship in the real network attack data set. The hill climbing algorithm is combined with the Bayesian Information Criterion (BIC) scoring function to optimize the network structure, so that the technology dependency network can more accurately model the dependency relationship between technologies. Step 4: Bayesian ATT&CK network modeling based on the technology dependency network and real data sets: Based on the technology dependency network and anonymized data sets from real network attack events, use the maximum likelihood estimation method to learn the technology co-occurrence relationship in the data set, and model the network structure and optimize the parameters based on the technology co-occurrence relationship. Based on this, the Bayesian network is constructed to obtain a Bayesian ATT&CK network that can reflect the dependency relationship between attack technologies. Step 5: Inference of complex network attacks based on variational inference: Use the approximate inference method based on variational inference to infer the Bayesian ATT&CK network. By adjusting the parameters of the approximate distribution, the approximate posterior distribution is made close to the true posterior distribution, so as to infer the next attack technology in the complex network attack.

[0007] Preferably, the tactical timing logic in step 1 is extracted from two aspects: on the one hand, it is extracted based on the correspondence between the ATT&CK framework and the kill chain model, and on the other hand, it is extracted based on the attack process rules; the kill chain model includes the following stages: reconnaissance, weaponization, delivery, external exploitation, installation, command and control, action, and influence.

[0008] Preferably, the specific content of step 2 is: let S be the set of all tactics, T be the set of all attack techniques, and define a mapping ,in Represents all subsets of the technology set T; for any tactic S, the set of technologies associated with tactic S can be obtained through mapping. When tactic S is executed, the technologies involved are all in the T set; if tactic S2 depends on tactic S1, then the technology set T2 corresponding to tactic S2 also depends on the technology set T1 corresponding to tactic S1. The dependency weights between technologies are averaged and differentiated. The calculation formula for the dependency weights between any two technologies is as follows: ; In the formula, Indicates the dependency weight from technology a to technology b; Indicates the tactical stage number of technology a; The number of tactical stages containing technology b that tactical stage i where technology a is located can transfer to; It represents the number of all tactical stages to which tactical stage i where technology a is located can be transferred; Represents the number of all techniques contained in tactical stage j.

[0009] Preferably, the process of step 3 is as follows: establish a technology dependency whitelist based on the dependency relationship in the technology dependency network obtained in step 2, learn the technology co-occurrence relationship in the attack event based on the technology dependency whitelist, use the hill climbing algorithm, and combine the Bayesian information criterion BIC scoring function to optimize the network structure, so that the model fits the data better and has better generalization performance. The principle of the BIC scoring function is based on the Bayesian information criterion, which comprehensively considers the goodness of fit and model complexity of the model to avoid overfitting. The calculation expression of the BIC scoring function is as follows: ; In the formula, Represents the network structure, represents the number of parameters of the model, represents the number of samples in the dataset, represents the likelihood function, defined as the observation technique The joint probability of is expressed as follows: ; In the formula, the parameters is the probability parameter in the technology dependency network, Represents a sub-technology node in the technology dependency network.

[0010] Preferably, the process of step 4 is as follows: S41. Based on the technology dependency network in step 3 and the data set from real network attack events, the maximum likelihood estimation method MLE is used to model the Bayesian network and calculate the joint probability distribution. The expression is as follows: ; In the formula, Represents a sub-technology node in the technology dependency network, Represents the parent technology node in the technology dependency network.

[0011] S42. Through the maximum likelihood estimation method, the technical co-occurrence relationship in the data set is learned and the parameters are optimized. The expression for optimizing the parameters is as follows: ; In the formula, As parameters, is the probability of a technology given a parent node; S43. Calculate the estimated values ​​of the parameters and obtain the Bayesian ATT&CK network. The expression is as follows: ; In the formula, represents the parameter learning using the dataset, G represents the technology dependency network, represents the parameters estimated based on maximum likelihood, represents parameter maximization, Represents the parameters in the technology dependency network.

[0012] Preferably, the process of step 5 is as follows: S51. Use the approximate inference method based on variational inference to infer the Bayesian network and maximize the variational lower bound , the expression is as follows: ; In the formula, Indicates about expect, represents the joint distribution, represents unobserved technology, is an approximate distribution; S52. Calculate the conditional probability of the next step of technology through the Bayesian network. The calculation expression is as follows: ; In the formula, Indicates at technology node Under the condition of determining the state, the technology node The probability of occurrence, Display Technology The probability of occurrence, Indicates technology node Probability of occurrence.

[0013] Therefore, the present invention adopts the above-mentioned general complex network attack inference method based on the Bayesian ATT&CK network. The method introduces two types of expert knowledge, the kill chain model and the empirical rule, into the ATT&CK framework to construct tactical temporal logic, ensuring that the generated attack sequence is logically coherent and can reflect the typical behavior patterns of complex network attacks in the real world. At the same time, a weighted directed acyclic graph (DAG) is used to represent the dependency relationship between attack technologies. The guidance of tactical transfer in the process of complex network attacks based on expert knowledge is extended to the guidance of technology transfer, and a technology dependency network that reflects the dependency relationship between technologies is constructed. Based on the technology co-occurrence relationship in the anonymized data set of real network attack events, the hill climbing algorithm and the Bayesian Information Criterion (BIC) scoring function are used to further optimize the structure of the technology dependency network so that it can more accurately reflect the dependency relationship between attack technologies. Make full use of the technology co-occurrence relationship in the technology dependency network and the real network attack data set, perform structural learning and parameter learning on the Bayesian ATT&CK network, and effectively ensure the logical coherence and practical applicability of the inference results. Furthermore, the inference method proposed in the present invention is independent of the specific threat detection system and has good adaptability and portability, so that it can be flexibly applied in a multi-network environment.

[0014] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A step diagram of a general complex network attack inference method based on a Bayesian ATT&CK network of the present invention; Figure 2 It is a flow chart of a general complex network attack inference method based on Bayesian ATT&CK network of the present invention; Figure 3 A schematic diagram of a technology dependency network based on tactical sequential logic according to an embodiment of the present invention; Figure 4 This is a flowchart of the Bayesian ATT&CK inference network modeling according to an embodiment of the present invention. DETAILED DESCRIPTION

[0016] The following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] See also Figure 1-Figure 4 , a general complex network attack inference method based on Bayesian ATT&CK network, including the following steps: Step 1: Tactical temporal logic modeling based on expert knowledge; Using Cyber ​​Kill Chain and empirical rules as the research basis, the tactics in the ATT&CK framework are modeled for temporal logic to ensure that the generated tactical sequence is logically coherent and reflects the behavior patterns of real complex network attacks; the tactical temporal logic is extracted from two aspects: on the one hand, it is extracted based on the correspondence between the ATT&CK framework and the kill chain model, and on the other hand, it is extracted based on the attack process rules; by integrating the tactics in the ATT&CK framework and the tactical temporal relationship in the kill chain, tactical temporal logic modeling is performed. The kill chain model includes the following stages: reconnaissance, weaponization, delivery, external exploitation, installation, command and control, action, and influence; the correspondence between ATT&CK and the kill chain is shown in Table 1 below Table 1 Correspondence between ATT&CK and the kill chain ;

[0018] External reconnaissance and weaponization correspond to the PRE-ATT&CK part of the ATT&CK model, which is difficult to detect and predict in practice. ATT&CK for enterprise covers the last five stages of the kill chain. In the modeling process, the techniques and procedures in the ATT&CK framework are combined to map the tactics and techniques in each attack stage to the corresponding stage of the kill chain to generate tactical timing logic.

[0019] At the same time, by analyzing the information about attack methods in existing security reports and security articles and mapping this information to the tactics and techniques in the ATT&CK framework, the following rules are proposed to ensure that the generated attack sequence is logically coherent and can reflect the typical behavior patterns of complex network attacks in the real world: Rule 1: , , so that T′ is executed before T; Rule 2: , , so that T′ is executed before T; Rule 3: if Since it is a continuous technology, it does not need to be executed repeatedly on the same host.

[0020] Step 2: Construct a technology dependency network based on tactical temporal logic. The technology dependency network uses a weighted directed acyclic graph (DAG) to represent the dependency relationship between attack technologies. Nodes represent technologies, and edges represent the dependencies between technologies. The dependency weights between technologies are evenly differentiated to form a technology dependency network. The specific content is: Let S be the set of all tactics, T be the set of all attack technologies, and define a mapping ,in Represents all subsets of the technology set T; for any tactic S, the set of technologies associated with tactic S can be obtained through mapping. When tactic S is executed, the technologies involved are all in the T set; if tactic S2 depends on tactic S1, then the technology set T2 corresponding to tactic S2 also depends on the technology set T1 corresponding to tactic S1. The dependency weights between technologies are averaged and differentiated. The calculation formula for the dependency weights between any two technologies is as follows: ; In the formula, Indicates the dependency weight from technology a to technology b; Indicates the tactical stage number of technology a; The number of tactical stages containing technology b that tactical stage i where technology a is located can transfer to; It represents the number of all tactical stages to which tactical stage i where technology a is located can be transferred; Represents the number of all techniques contained in tactical stage j.

[0021] Step 3: Optimize the structure of the technology dependency network based on technology co-occurrence; The structure optimization of the technology dependency network is based on the technology co-occurrence relationship in the real network attack data set. The network structure is optimized using the hill climbing algorithm combined with the Bayesian Information Criterion BIC scoring function, so that the technology dependency network can more accurately model the dependency relationship between technologies; The specific process is as follows: Establish a technology dependency whitelist based on the dependency relationship in the technology dependency network obtained in step 2, learn the technology co-occurrence relationship in the attack event based on the technology dependency whitelist, use the hill climbing algorithm, and optimize the network structure in combination with the Bayesian Information Criterion BIC scoring function, so that the model can better fit the data and have better generalization performance. The principle of the BIC scoring function is based on the Bayesian Information Criterion, which comprehensively considers the goodness of fit and model complexity of the model to avoid overfitting. The calculation expression of the BIC scoring function is as follows: ; In the formula, Represents the network structure, represents the number of parameters of the model, represents the number of samples in the dataset, represents the likelihood function, defined as the observation technique The joint probability of is expressed as follows: ; In the formula, the parameters are probability parameters in the technology dependency network, which describe the probability distribution of each technology node when its parent node is given. The parent node is , then the parameter include For all possible values ​​of , the likelihood function It is used to represent the probability of attack technology appearing under given network parameters. It measures the ability of model parameters to explain known attack technologies, and its specific form depends on the relationship between known attack technologies and their model assumptions. In specific operations, the hill climbing algorithm starts from the initial network structure and tries to optimize the network structure of the technology dependency network by adding, deleting or reversing edges. Finding the network structure with the highest BIC score as the final technology dependency network structure can effectively represent the technology dependency relationship in complex network attacks.

[0022] Step 4: Bayesian ATT&CK network modeling based on the technology dependency network and real data sets: Based on the technology dependency network and anonymized data sets from real network attack events, use the maximum likelihood estimation method to learn the technology co-occurrence relationship in the data set, and model the network structure and optimize the parameters based on the technology co-occurrence relationship. Based on this, the Bayesian network is constructed to obtain a Bayesian ATT&CK network that can reflect the dependency relationship between attack technologies. The specific process is as follows: S41. Based on the technology dependency network in step 3 and the data set from real network attack events, the maximum likelihood estimation method MLE is used to model the Bayesian network and calculate the joint probability distribution. The expression is as follows: ; In the formula, Represents a sub-technology node in the technology dependency network, Represents the parent technology node in the technology dependency network; Through the maximum likelihood estimation method, the technology co-occurrence relationship in the data set is learned and the parameters are optimized. The optimized Bayesian network can better reflect the actual APT attack mode. The goal of parameter learning is to maximize the conditional probability of the observed data in the network model, thereby obtaining the conditional probability of each node technology.

[0023] S42. Through the maximum likelihood estimation method, the technical co-occurrence relationship in the data set is learned and the parameters are optimized. The expression for optimizing the parameters is as follows: ; In the formula, As parameters, is the probability of a technology given a parent node; S43. Calculate the estimated values ​​of the parameters and obtain the Bayesian ATT&CK network. The expression is as follows: ; In the formula, represents the parameter learning using the dataset, G represents the technology dependency network, represents the parameters estimated based on maximum likelihood, represents parameter maximization, Represents the parameters in the technology dependency network. Based on this, the parameters of the Bayesian network are learned to obtain the best Bayesian ATT&CK inference network.

[0024] Step 5. Inference of complex network attacks based on variational inference; Use the approximate inference method based on variational inference to infer the Bayesian ATT&CK network, and adjust the parameters of the approximate distribution so that the approximate posterior distribution is close to the true posterior distribution, so as to infer the attack technology that may appear in the next step of the complex network attack. In this step, the Bayesian network is inferred using the approximate inference method based on variational inference to infer the attack technology that may appear in the next step of the APT attack. Variational inference finds the best approximation by approximating the posterior probability distribution to a simpler distribution, and then maximizing or approximately maximizing a certain similarity measure between the two distributions. The core idea is to adjust the parameters of the approximate distribution so that the approximate posterior distribution is as close to the true posterior distribution as possible. The specific process is as follows: S51. Introducing a parameterized approximate distribution , so that it can be as close as possible to the true posterior probability distribution , use the approximate inference method based on variational inference to infer the Bayesian network and maximize the variational lower bound , the expression is as follows: ; In the formula, Indicates about expect, represents the joint distribution, represents unobserved technology, is an approximate distribution; the variational inference algorithm optimizes the variational lower bound by iteratively updating the parameters until it converges to a stable approximate distribution. In each iteration, the parameterized approximate distribution is updated , which makes the variational lower bound increase continuously, thus gradually approaching the true posterior probability distribution; S52. Calculate the conditional probability of the next step of technology through the Bayesian network. The calculation expression is as follows: ; In the formula, Indicates at technology node Under the condition of determining the state, the technology node The probability of occurrence, Display Technology The probability of occurrence, Indicates technology node Probability of occurrence. This formula represents the probability of inferring the next attack technique when the previous attack techniques are known. By inferring the techniques with the highest probability, the attacker's next move can be predicted, and ultimately the inference of complex network attacks can be achieved.

[0025] Therefore, the present invention adopts the above-mentioned general complex network attack inference method based on the Bayesian ATT&CK network, adopts the kill chain and empirical knowledge as the research basis, and performs temporal logic modeling on the tactics in the ATT&CK framework to ensure that the generated attack sequence is logically coherent and reflects the behavior pattern of real complex network attacks. Based on the tactical temporal logic sequence, the guidance of expert knowledge on tactical transfer is extended to guidance on technology transfer, and a technology dependency network is constructed. An anonymized data set from real network attack events is used, and the technology co-occurrence relationship in the data set is used to further optimize the technology dependency network. Based on the technology co-occurrence relationship between the technology dependency network and the real network attack data set, the Bayesian ATT&CK network performs structural learning and parameter learning to construct a network model that does not rely on a specific threat detection system, thereby realizing complex network attack inference independent of the specific system.

[0026] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A general complex network attack inference method based on Bayesian ATT&CK network, characterized in that: The following steps are involved: Step 1: Modeling the tactical temporal logic based on expert knowledge: Using the kill chain and empirical rules as the research basis, model the temporal logic of the tactics in the ATT&CK framework; Step 2: Construct a technology dependency network based on tactical temporal logic. The technology dependency network uses a weighted directed acyclic graph (DAG) to represent the dependency relationship between attack technologies. Nodes represent technologies, and edges represent the dependency between technologies. The dependency weights between technologies are evenly differentiated to form a technology dependency network. Step 3: Optimize the structure of the technology dependency network based on technology co-occurrence. The structure optimization of the technology dependency network is based on the technology co-occurrence relationship in the real network attack data set, and the network structure is optimized using the hill climbing algorithm combined with the Bayesian Information Criterion (BIC) scoring function. Step 4: Bayesian ATT&CK network modeling based on technology dependency network and real data set; Based on the technology dependency network and anonymized data sets from real network attack events, the maximum likelihood estimation method is used to learn the technology co-occurrence relationship in the data set, and the network structure is modeled and the parameters are optimized based on the technology co-occurrence relationship. Based on this, a Bayesian network is constructed to obtain a Bayesian ATT&CK network that can reflect the dependency relationship between attack technologies. Step 5: Inference of complex network attacks based on variational inference: Use the approximate inference method based on variational inference to infer the Bayesian ATT&CK network. By adjusting the parameters of the approximate distribution, the approximate posterior distribution is made close to the true posterior distribution, so as to infer the next attack technology in the complex network attack.

2. According to claim 1, a general complex network attack inference method based on Bayesian ATT&CK network is characterized in that: The tactical timing logic in step 1 is extracted from two aspects: on the one hand, it is extracted based on the correspondence between the ATT&CK framework and the kill chain model, and on the other hand, it is extracted based on the attack process rules; the kill chain model includes the following stages: reconnaissance, weaponization, delivery, external exploitation, installation, command and control, action, and influence.

3. According to claim 2, a general complex network attack inference method based on Bayesian ATT&CK network is characterized in that: The specific content of step 2 is: Let S be the set of all tactics, T be the set of all attack techniques, and define a mapping ,in Represents all subsets of the technology set T; for any tactic S, the set of technologies associated with tactic S is obtained through mapping. When tactic S is executed, the technologies involved are all in the T set; if tactic S2 depends on tactic S1, then the technology set T2 corresponding to tactic S2 also depends on the technology set T1 corresponding to tactic S1. The dependency weights between technologies are averaged and differentiated. The calculation formula for the dependency weights between any two technologies is as follows: ； In the formula, Indicates the dependency weight from technology a to technology b; Indicates the tactical stage number of technology a; The number of tactical stages containing technology b that tactical stage i where technology a is located can transfer to; It represents the number of all tactical stages to which tactical stage i where technology a is located can be transferred; Represents the number of all techniques contained in tactical stage j.

4. According to claim 3, a general complex network attack inference method based on Bayesian ATT&CK network is characterized in that: The process of step 3 is as follows: establish a technology dependency whitelist based on the dependency relationship in the technology dependency network obtained in step 2, learn the technology co-occurrence relationship in the attack event based on the technology dependency whitelist, use the hill climbing algorithm, and combine the Bayesian Information Criterion BIC scoring function to optimize the network structure. The calculation expression of the BIC scoring function is as follows: ； In the formula, Represents the network structure, represents the number of parameters of the model, represents the number of samples in the dataset, represents the likelihood function, defined as the observation technique The joint probability of is expressed as follows: ； In the formula, the parameters is the probability parameter in the technology dependency network, Represents a sub-technology node in the technology dependency network.

5. According to claim 4, a general complex network attack inference method based on Bayesian ATT&CK network is characterized in that: The process for step 4 is as follows: S41. Based on the technology dependency network in step 3 and the data set from real network attack events, the maximum likelihood estimation method MLE is used to model the Bayesian network and calculate the joint probability distribution. The expression is as follows: ； In the formula, Represents a sub-technology node in the technology dependency network, Represents the parent technology node in the technology dependency network; S42. Through the maximum likelihood estimation method, the technical co-occurrence relationship in the data set is learned and the parameters are optimized. The expression for optimizing the parameters is as follows: ； In the formula, As parameters, is the probability of a technology given a parent node; S43. Calculate the estimated values ​​of the parameters and obtain the Bayesian ATT&CK network. The expression is as follows: ； In the formula, represents the parameter learning using the dataset, G represents the technology dependency network, represents the parameters estimated based on maximum likelihood, represents parameter maximization, Represents the parameters in the technology dependency network.

6. According to claim 5, a general complex network attack inference method based on Bayesian ATT&CK network is characterized in that: The process for step 5 is as follows: S51. Use the approximate inference method based on variational inference to infer the Bayesian network and maximize the variational lower bound , the expression is as follows: ； In the formula, Indicates about expect, represents the joint distribution, represents unobserved technology, is an approximate distribution; S52. Calculate the conditional probability of the next step of technology through the Bayesian network. The calculation expression is as follows: ； In the formula, Indicates at technology node Under the condition of determining the state, the technology node The probability of occurrence, Display Technology The probability of occurrence, Indicates technology node Probability of occurrence.

Images