An advanced persistent threat intelligent lateral movement behavior game method

Abstract

The application provides a senior persistent threat intelligent horizontal movement behavior game method, relates to the technical field of network security, and comprises the following steps: constructing an undirected graph corresponding to an organization, wherein the undirected graph comprises a plurality of organization nodes; classifying the organization nodes into target nodes, ordinary nodes, senior employee nodes and administrator nodes; constructing an attack-defense interaction model of an attacker and a defender based on a discrete time step set, and obtaining state and action spaces of the attacker and the defender, and strategy spaces of the defender and the attacker based on the attack-defense interaction model; obtaining rewards of the attacker and the defender based on a game end condition, and calculating value functions of the attack and defense sides to obtain Nash equilibrium strategies of the attack and defense sides. The application applies game theory to APT horizontal movement behavior modeling, considers the worst case from the perspective of the defender, and determines the node subjected to security review by the defender according to the current state, so that detection is more efficient, and the defense strategy is more robust.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an advanced persistent threat intelligent lateral movement behavior game method. Background Art

[0002] Advanced persistent threats (APTs) are a stealthy and highly sophisticated type of cyberattack. Attackers are typically well-funded and technologically advanced. Their common objectives are to steal confidential data from large organizations (such as large enterprises, government agencies, and military bases) and to disrupt critical infrastructure. Compared to traditional cyberattacks, APT attacks have a high penetration success rate. Once an APT attacker establishes a foothold within an organization's intranet, for example by installing a backdoor, they attempt to move laterally toward their target nodes—the organization's most valuable nodes, such as servers—in order to steal critical data and information. Due to their highly concealed nature, APT attacks are often difficult for organizations to detect, allowing APT attackers to remain within the organization for extended periods of time. This poses a serious threat to modern organizations.

[0003] Most existing APT defense solutions typically assume that an attacker's lateral movement behavior conforms to certain assumptions. For example, an intact node will become compromised at a certain rate due to the influence of adjacent compromised nodes. Although existing work has considered that the rate of APT lateral movement is controllable, in reality, the capabilities of APT attackers may still be underestimated. They can effectively evade detection by designing more intelligent lateral movement strategies, successfully approaching and infiltrating target nodes within an organization.

[0004] Therefore, it is urgent to provide a solution to improve the above problems. Summary of the Invention

[0005] The purpose of the present invention is to provide an advanced persistent threat intelligent lateral movement behavior game method to improve the problem of low defense effectiveness of existing technologies in solving APT problems.

[0006] The present invention provides an advanced persistent threat intelligent lateral movement behavior game method, which adopts the following technical solutions:

[0007] Constructing an undirected graph corresponding to the organizational structure, wherein the undirected graph includes a plurality of organizational nodes;

[0008] Classifying the organization nodes into target nodes, ordinary nodes, senior employee nodes and administrator nodes;

[0009] Constructing an attack-defense interaction model of the attacker and the defender based on a set of discrete time steps, and obtaining the state and action space of the attacker and the defender, the strategy space of the defender, and the strategy space of the attacker based on the attack-defense interaction model;

[0010] Based on the game end conditions, the rewards of the attacker and defender are obtained, and the value functions of the attacker and defender are calculated to obtain the Nash equilibrium strategies of the attacker and defender.

[0011] The beneficial effect of the advanced persistent threat intelligent lateral movement behavior game method provided by the present invention is that the present invention applies game theory to APT lateral movement behavior modeling, considers the worst-case scenario from the defender's perspective: the APT attacker may adopt the most efficient attack strategy, establishes a game theory mathematical model, and characterizes the strategic interaction process between the APT attacker and the defender. When building a defense strategy, always selecting the most important target nodes for security review may be inefficient because carefully reviewing these nodes may require high costs. In the present invention, the defender determines the nodes for security review based on the current status, making detection more efficient. In addition, since the worst-case scenario is taken into account, the defender's defense strategy can be made more robust.

[0012] Optionally, the organizational structure includes 13 nodes, including nodes 1 to 13, which are represented as an undirected graph G=(V, E), wherein the mathematical expressions of the node set and the edge set are:

[0013] V={v1,…,v 13};

[0014]

[0015] Where V={v1,…,v N} is the node set, E is the edge set, {v i ,v j}∈E indicates that node i can communicate with node j through the intranet.

[0016] Optionally, among the 13 nodes, No. 1-6 are ordinary nodes, corresponding to ordinary employees of the organization, No. 7-9 are senior employee nodes, corresponding to senior employees of the organization, No. 10-11 are administrator nodes, corresponding to administrators of the organization, and No. 12-13 are target nodes.

[0017] Optional process of constructing an attack-defense interaction model between attackers and defenders based on a set of discrete time steps, including:

[0018] The attacker successfully penetrates a node of the organization through reconnaissance and spear-phishing emails at the initial time step and uses it as the initial penetration node for lateral movement. The attacker then selects a target node and moves laterally along the shortest path from the initial penetration node to the target node at each subsequent time step.

[0019] The defender selects a node for security review at each time step. When the attacker and defender arrive at the same damaged node at the same time, the defender captures the attacker and restores the damaged node to a safe state.

[0020] Optionally, the state space and action space of the defender include:

[0021]

[0022] in, represents the defender state, t represents the time step, h t represents the historical review node sequence as of time t, Indicates the defender's action, A def =V represents the defender's action space.

[0023] Optionally, at time t=0, The defender's status is The defender can choose one of the nodes for security review, and the defender's action space is A def =V, if at time t=0, the defender decides to censor node v7, then the defender's state at time t=1 becomes

[0024] Optionally, the specific process of obtaining the attacker's state space and action space includes: the attacker selects a target node after gaining control of the initial penetration node, and the attacker's state space is a set of non-target nodes The action space is the target node set V′, where the mathematical expressions of the non-target node set and the target node set are:

[0025] V′={v 12 ,v 13};

[0026]

[0027] Among them, v 12 ,v 13 Indicates target nodes 12 and 13, {v1,…,v 11} represents nodes 1-11, and \ represents set subtraction operation.

[0028] Optionally, the defender's strategy space includes: assuming π def :S def →Δ(A def ) is the defender’s strategy, defined as the mapping from state space to action space probability distribution, with π def ∈Π def , where Π def represents the defender’s strategy space, Sdef represents the state space of the defender, Δ(A def ) represents the probability distribution of the defender’s action space;

[0029] The attacker's strategy space includes: let π att : The attacker's strategy is to determine the attacker's target node at time t = 0, and then select a shortest path p from the initial penetration node to the target node. att For lateral movement, there is π att ∈Π att , where Π att represents the attacker’s strategy space, represents the set of non-target nodes, and Δ(V′) represents the probability distribution over the set V′.

[0030] Optionally, the process of obtaining rewards for the attacker and the defender based on the game end condition includes:

[0031] The defender captures the attacker within the preset maximum time step, and at the current time, the defender's state space is equal to the attacker's action space. If the current time is less than the game deadline, the attacker and defender's rewards are both 0. If the current time is equal to the game deadline, the defender receives a positive reward. Attackers are punished

[0032] The attacker reaches the selected target node within the preset maximum time step. If the current time is less than the game deadline, the rewards of the attacker and the defender are both 0. If the current time is equal to the game deadline, the defender is punished. The attacker receives a positive reward

[0033] The game time reaches the preset maximum time step. If the current time is less than the game deadline, the rewards of the attacker and the defender are both 0. If the current time is equal to the game deadline, the defender is punished. The attacker receives a positive reward

[0034] Optionally, the mathematical expression of the value function is:

[0035]

[0036] Among them, V def (π def ,v′) and V att (π def ,v′) represent the given defender strategy π defand the value function of the defender and attacker when the attacker selects the target node v′, T represents the maximum time step, represents the reward obtained by the defender at time t, represents the reward obtained by the attacker at time t, and the expectation Through the defender strategy π def The multiple interaction trajectories generated under a given target node v′ are calculated. For a given attack and defense strategy combination (π def ,π att ), the mathematical expression of the value function of the attacker and defender is:

[0037]

[0038] The mathematical expression of Nash equilibrium is:

[0039]

[0040] Among them, V def (π def ,π att ) and V att (π def ,π att ) respectively represent the attack and defense strategy combinations in a given def ,π att ) under the value function of the defender and attacker, V def (π def ,v′) and V att (π def ,v′) represent the given defender strategy π def and the value function of the defender and attacker when the attacker chooses the target node v′, and Represents the equilibrium strategy portfolio The value functions of the defender and attacker are: Indicates that the attacker adopts a balanced strategy and the defender adopts any strategy π def The value function of the defender is Indicates that the defender adopts an equilibrium strategy and the attacker adopts any strategy π att The attacker's value function. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flowchart showing an advanced persistent threat intelligent lateral movement behavior game method provided by the present invention;

[0042] Figure 2 A schematic diagram of the APT lateral movement game between attackers and defenders provided by the present invention is shown. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0044] The embodiment of the present invention provides an advanced persistent threat intelligent lateral movement behavior game method, see Figure 1 ,include:

[0045] S1. Construct an undirected graph corresponding to the organizational structure, wherein the undirected graph includes multiple organizational nodes;

[0046] S2. Classify the organization nodes into target nodes, common nodes, senior staff nodes, and administrator nodes;

[0047] S3. Constructing an attack-defense interaction model of the attacker and the defender based on a set of discrete time steps, and obtaining the state space and action space of the attacker and the defender, and the strategy space of the attacker and the defender based on the attack-defense interaction model;

[0048] S4. Obtain the rewards of the attacker and defender based on the game end conditions, calculate the value functions of the attacker and defender, and obtain the Nash equilibrium strategies of the attacker and defender.

[0049] In some embodiments, when executing step S1, the organization structure includes 13 nodes, including nodes 1-13, represented as an undirected graph G=(V, E), where the mathematical expressions of the node set and the edge set are:

[0050] V={v1,…,v 13};

[0051]

[0052] Where V={v1,…,v N} is the node set, E is the edge set, {v i ,v j}∈E indicates that node i can communicate with node j through the intranet.

[0053] For details, see Figure 2, which contains a set of N nodes numbered from 1 to N. Nodes can be divided into different types with different importance, such as ordinary hosts used by ordinary employees to organize daily business, workstations used by senior employees for more complex or critical tasks, and various types of servers that can only be accessed by authorized members (such as administrators). Each node is connected to other nodes through the intranet. Without loss of generality, the organization can be abstracted as a simple undirected graph G = (V, E), where V = {v1,…,v N} is the node set, E is the edge set. i ,v j}∈E indicates that node i can communicate with node j through the intranet.

[0054] In some embodiments, when executing step S2 to classify the organizational nodes, among the 13 nodes, No. 1-6 are ordinary nodes, corresponding to ordinary employees of the organization, No. 7-9 are senior employee nodes, corresponding to senior employees of the organization, No. 10-11 are administrator nodes, corresponding to administrators of the organization, and No. 12-13 are target nodes.

[0055] In reality, there are multiple important nodes in an organization, such as different types of servers. These nodes are used to store the organization's high-value data, perform data analysis, or control critical infrastructure. Therefore, these nodes are often targeted by APT attackers, whose main purpose is to steal sensitive information and private data from the organization. Let the set of these target nodes be Although these nodes are attractive to attackers, it is usually difficult for APT attackers to directly infiltrate these target nodes because organizations often have more advanced security technologies to resist network attacks. In other words, if these target nodes are attacked directly, the cost of the attack will be very high. Instead, a more common strategy of APT attackers is to first break into some relatively weakly defended ordinary nodes, such as hosts used by ordinary employees, and then gradually approach the target node through lateral movement.

[0056] In some embodiments, the process of constructing the attack-defense interaction model of the attacker and the defender based on the discrete time step set in step S3 includes:

[0057] S3-1: At the initial time step, the attacker successfully penetrates a node of the organization through reconnaissance and spear-phishing emails and uses it as the initial penetration node for lateral movement. The attacker then selects a target node and moves laterally along the shortest path from the initial penetration node to the target node at each subsequent time step.

[0058] S3-2. The defender selects a node for security review at each time step. When the attacker and defender arrive at the same damaged node at the same time, the defender successfully captures the attacker and restores the damaged node to a safe state.

[0059] Specifically, when executing step S3-1, it is assumed that represents the set of discrete time steps. Let the initial node that the attacker successfully penetrates through social engineering means such as reconnaissance and spear phishing emails be Next, the attacker selects a target node And move laterally through the shortest path from the initial penetration node to the target node, attempting to reach the target node within T time steps, such as Figure 2 (b) Specifically, the attacker Determine the node to move to at each time step.

[0060] Furthermore, when executing step S3-2, the attacker's goal is to satisfy the conditions: t′≤T and That is, reach the target node before the end of the game time For the defender, at each time step The defender selects a node Conduct security audits. Once the attacker and defender reach the same node at the same time, the defender can capture the attacker and restore the compromised node to a safe state.

[0061] In practice, if the defender always selects the most important nodes (i.e., the target nodes in V′) for review, its defense efficiency may be relatively low. On the one hand, it takes an attacker a certain amount of time to reach the target node, and on the other hand, carefully reviewing these nodes may be costly, such as consuming more computing resources. Therefore, the defender needs to adopt a more efficient node review strategy based on the current state of the system.

[0062] See Figure 2 , the process of establishing the attack-defense interaction model includes: setting the maximum time step to T = 10. Figure 2 As shown in (b), assuming that the attacker's initial penetration node is node 4, that is, The target node selected by the attacker is node 12, that is, The attacker uses the shortest path p att =(v4,v7,v 10 ,v 12 ) determines the node to move to at each time step. The defender selects a node for security review based on the current state.

[0063] In some embodiments, when executing step S3, the defender's state space and action space include:

[0064]

[0065] in, represents the defender state, t represents the time step, h t represents the historical review node sequence as of time t, Indicates the defender's action, A def =V represents the defender's action space.

[0066] Specifically, at time t=0, since the defender has no historical review nodes, The defender's status is In this state, the defender can select one of the nodes for security review, so the defender's action space is A def = V. Assume that at time t = 0, the defender decides to censor node v7, then the state of the defender at time t = 1 becomes

[0067] In some embodiments, when executing step S3, the specific process of obtaining the attacker's state space and action space includes: the attacker selects a target node after obtaining control of the initial penetration node, and the attacker's state space is a set of non-target nodes. The action space is the target node set V′, where the mathematical expression is:

[0068] V′={v 12 ,v 13};

[0069]

[0070] Among them, v 12 ,v 13 Indicates target nodes 12 and 13, {v1,…,v 11} represents nodes 1-11, and \ represents set subtraction operation.

[0071] In some embodiments, when executing step S3, the defender's strategy space includes: assuming π def :S def →Δ(A def ) is the defender’s strategy, defined as the mapping from state space to action space probability distribution, with π def ∈Π def , where Π def represents the defender’s strategy space, S def represents the state space of the defender, Δ(A def) represents the probability distribution on the action space of the defender;

[0072] The strategy space of the attacker includes: Let π att : be the strategy of the attacker. At time t = 0, determine the target node of the attacker, and then select a shortest path p from the initial penetration node to this target node att for lateral movement, with π att ∈Π att , where Π att represents the strategy space of the attacker, represents the set of non-target nodes, and Δ(V′) represents the probability distribution on the set V′.

[0073] In some embodiments, when performing step S4, the process of obtaining the rewards of the attacker and the defender based on the game end condition includes:

[0074] 1) The defender captures the attacker within the preset maximum time step T, and when at the current time t, the state space of the defender is equal to the action space of the attacker, if the current time t is less than the game cut-off time t′, the rewards of both the attacker and the defender are 0. If the current time t is equal to the game cut-off time t′, the defender obtains a positive reward and the attacker is punished

[0075] 2) The attacker reaches the selected target node within the preset maximum time step T. If the current time t is less than the game cut-off time t′, the rewards of both the attacker and the defender are 0. If the current time t is equal to the game cut-off time t′, then the defender is punished and the attacker obtains a positive reward

[0076] 3) The game time reaches the preset maximum time step T. If the current time t is less than the game cut-off time t′, the rewards of both the attacker and the defender are 0. If the current time t is equal to the game cut-off time t′, the defender is punished and the attacker obtains a positive reward

[0077] [[ID=四十一]]Specifically, the preset maximum time step is T = 10. For t < t′, the rewards of the attacker and the defender

[0078] are 0, that is when t = t′, for end condition 1), the defender can obtain a positive reward while the attacker is punished Figure 2 because the defender successfully captures the attacker, as shown in (c). For the ending conditions 2) and 3), the defender is penalized The attacker gets a positive reward Because the attacker successfully evades the defender's detection or successfully reaches the target node v within a given time 12 ,like Figure 2 (d) shows that

[0079] In some embodiments, when executing step S4, a target node is given The mathematical expression of the value function is:

[0080]

[0081] Among them, V def (π def ,v′) and V att (π def ,v′) represent the given defender strategy π def and the value function of the defender and attacker when the attacker selects the target node v′, T represents the maximum time step, represents the reward obtained by the defender at time t, represents the reward obtained by the attacker at time t, and the expectation Through the defender strategy π def The multiple interaction trajectories generated under a given target node v′ are calculated. For a given attack and defense strategy combination (π def ,π att ), the mathematical expression of the value function of the attacker and defender is:

[0082]

[0083] Furthermore, according to the value functions of the attacker and defender, the Nash equilibrium strategy combination of the attacker and defender can be obtained. The mathematical expression is:

[0084]

[0085] Among them, V def (π def ,π att ) and V att (π def ,π att ) respectively represent the attack and defense strategy combinations in a given def ,π att ) under the value function of the defender and attacker, V def (π def ,v′) and V att (πdef ,v′) represent the given defender strategy π def and the value function of the defender and attacker when the attacker chooses the target node v′, and Represents the equilibrium strategy portfolio The value functions of the defender and attacker are: Indicates that the attacker adopts a balanced strategy and the defender adopts any strategy π def The value function of the defender is Indicates that the defender adopts an equilibrium strategy and the attacker adopts any strategy π att The attacker's value function.

[0086] Under the above conditions, neither the attacker nor the defender can achieve higher expected returns by unilaterally changing their own strategies.

[0087] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A method for intelligent lateral movement behavior game of advanced persistent threats, characterized by: include: Constructing an undirected graph corresponding to the organizational structure, wherein the undirected graph includes a plurality of organizational nodes; Classifying the organization nodes into target nodes, ordinary nodes, senior employee nodes and administrator nodes; An attack-defense interaction model of an attacker and a defender is constructed based on a set of discrete time steps, and a state space and an action space of the attacker and the defender, as well as a strategy space of the attacker and the defender, are obtained based on the attack-defense interaction model. The process of constructing the attack-defense interaction model of the attacker and the defender based on the set of discrete time steps includes: the attacker successfully penetrates a node of the organization through reconnaissance and spear-phishing emails in an initial time step and uses the node as the initial penetration node for lateral movement, then selects a target node and moves laterally along a shortest path from the initial penetration node to the target node in each subsequent time step, the defender selects a node for security review in each time step, and when the attacker and the defender arrive at the same damaged node at the same time, the defender captures the attacker and restores the damaged node to a safe state; Based on the game end conditions, the rewards of the attacker and defender are obtained, and the value functions of the attacker and defender are calculated to obtain the Nash equilibrium strategies of the attacker and defender.

2. The method for intelligent lateral movement behavior game of advanced persistent threats according to claim 1 is characterized in that: The organizational structure includes 13 nodes, including nodes 1 to 13, represented as an undirected graph , where the mathematical expressions of node sets and edge sets are: ； ； in, is a node set, is an edge set, Representation node Can be connected to the node through the intranet to communicate.

3. The method for intelligent lateral movement behavior game of advanced persistent threats according to claim 2, characterized in that: Among the 13 nodes, No. 1-6 are ordinary nodes, corresponding to ordinary employees of the organization, No. 7-9 are senior employee nodes, corresponding to senior employees of the organization, No. 10-11 are administrator nodes, corresponding to administrators of the organization, and No. 12-13 are target nodes.

4. The method for intelligent lateral movement behavior game of advanced persistent threats according to claim 1 is characterized in that: The state space and action space of the defender include: ； ； in, Indicates the defender state. represents the time step, Indicates the deadline The historical review node sequence, Indicates the defender's actions, represents the defender’s action space.

5. The method for intelligent lateral movement behavior game of advanced persistent threats according to claim 4 is characterized in that: At the moment , , the defender's status is , the defender selects one of the nodes for security review, and the defender’s action space is , if at time , the defender decides to censor the node , then the defender at time The status becomes .

6. The method for intelligent lateral movement behavior game of advanced persistent threats according to claim 1 is characterized in that: The specific process of obtaining the attacker's state space and action space includes: the attacker selects a target node after gaining control of the initial penetration node, and the attacker's state space is a set of non-target nodes , the action space is the target node set , where the mathematical expressions of the non-target node set and the target node set are: ； ； in, Indicates target nodes 12 and 13, Indicates nodes 1-11, Represents the set subtraction operation.

7. The method for intelligent lateral movement behavior game of advanced persistent threats according to claim 1 is characterized in that: The defender's strategy space includes: The defender's strategy is defined as a mapping from the state space to the action space probability distribution, with ,in, represents the defender’s strategy space, represents the state space of the defender, represents the probability distribution on the defender's action space; The attacker's strategy space includes: The attacker's strategy is Always determine the attacker's target node and then choose the shortest path from the initial penetration node to the target node To move laterally, ,in, represents the attacker’s strategy space, represents the set of non-target nodes, Representing a collection The probability distribution on .

8. The method for intelligent lateral movement behavior game of advanced persistent threats according to claim 1 is characterized in that: The process of obtaining rewards for the attacker and defender based on the game end condition includes: The defender captures the attacker within the preset maximum time step, and at the current time, the defender's state space is equal to the attacker's action space. If the current time is less than the game deadline, the attacker and defender's rewards are both 0. If the current time is equal to the game deadline, the defender receives a positive reward. , the attacker is punished ; The attacker reaches the selected target node within the preset maximum time step. If the current time is less than the game deadline, the rewards of the attacker and the defender are both 0. If the current time is equal to the game deadline, the defender is punished. , the attacker gets a positive reward ; The game time reaches the preset maximum time step. If the current time is less than the game deadline, the rewards of the attacker and the defender are both 0. If the current time is equal to the game deadline, the defender is punished. , the attacker gets a positive reward .

9. The method for intelligent lateral movement behavior game of advanced persistent threats according to claim 1, characterized in that: The mathematical expression of the value function is: ； ； in, and Respectively represent the given defender strategy and the attacker chooses the target node The value functions of the defender and attacker are: represents the maximum time step, Indicates that the defender is at time Rewards received, The attacker at time Rewards obtained, expectations By Defender Strategy At a given target node Calculate the multiple interactive trajectories generated under the given attack and defense strategy combination , the mathematical expression of the value function of the attacker and defender is: ； ； The mathematical expression of Nash equilibrium is: ； ； in, and Respectively represent the given attack and defense strategy combination The value functions of the defender and attacker are: and The distribution represents the given defender strategy and the attacker chooses the target node The value functions of the defender and attacker are: and Represents the equilibrium strategy portfolio The value functions of defender and attacker, They represent the situation when the attacker adopts a balanced strategy and the defender adopts any strategy The value function of the defender is Indicates that the defender adopts an equilibrium strategy and the attacker adopts any strategy The attacker's value function.

Images