Attack implementation process prediction method and device, equipment and storage medium

Abstract

The invention belongs to the field of computers, and discloses an attack implementation process prediction method and device, equipment and a storage medium. The method comprises the following steps: carrying out attack process identification on network attack information in a network attack entity library to obtain technical and tactical information used by an attacker; determining a tactical of a current simulation attack, and determining attack technical information corresponding to the tactical based on the technical and tactical information; and determining a popularity prediction result of the attack implementation process according to the attack technical information. According to the method, attack process identification is carried out on the network attack information in the network attack entity library, so that the technical and tactical information used by an attacker is obtained, and the popularity prediction result of the attack implementation process is determined according to the technical and tactical information. According to the method, the popularity prediction result of the common attack implementation process in the current network attack can be determined, so that the attack implementation process for simulating the attack can be selected based on the popularity prediction result, and the attack simulation efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular, to a method, apparatus, device, and storage medium for predicting the implementation process of an attack. Background Art

[0002] With the increasing popularity of solutions such as breach and attack simulation (BAS) that simulate attackers to test the effectiveness of network defenses and help enterprises minimize security risks by making the most of existing security resources, from the current BAS workflow, how to select the most effective and objective attack vectors that can reflect the current real network attack tactics, techniques, and implementation processes (TTP) has become one of the important factors in measuring BAS products. Therefore, how to predict the popularity of the current real network attack tactics, techniques, and implementation processes, and then select the network attack implementation process that can most objectively reflect the current real network attack environment based on the prediction results for simulated attacks has become an urgent technical problem to be solved.

[0003] The above content is only used to assist in understanding the technical solution of the present invention, and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main object of the present invention is to provide a method, apparatus, device, and storage medium for predicting the implementation process of an attack, aiming to solve the technical problem that in the prior art, when performing simulated attacks, the attack implementation process cannot be efficiently selected, resulting in low efficiency of simulated attacks.

[0005] To achieve the above object, the present invention provides a method for predicting the implementation process of an attack, the method comprising the following steps:

[0006] Identify the attack process of the network attack information in the network attack entity library to obtain the tactics and techniques information used by the attacker;

[0007] Determine the tactics of the current simulated attack, and determine the attack technique information corresponding to the tactics based on the tactics and techniques information;

[0008] Determine the popularity prediction result of the attack implementation process according to the attack technique information.

[0009] Optionally, the step of determining the popularity prediction result of the attack implementation process according to the attack technique information includes:

[0010] Determine the usage times and weight coefficients of the attack techniques according to the attack technique information;

[0011] Determine the popularity score of the attack technique according to the usage times and the weight coefficients;

[0012] Determine the popularity prediction result of the attack implementation process based on the popularity score.

[0013] Optionally, the step of determining the weight coefficient of the attack technique according to the attack technique information includes:

[0014] Determine the detection rule information of the attack technique according to the attack technique information;

[0015] Determine the weight coefficient of the attack technique based on the detection rule information and the total number of rules corresponding to the tactic.

[0016] Optionally, the step of determining the usage times of the attack technique according to the attack technique information includes:

[0017] Determine the usage times of the attack technique when it is the main attack technique according to the attack technique information.

[0018] Optionally, the step of performing an attack process identification on the network attack information in the network attack entity library to obtain the technique and tactic information used by the attacker includes:

[0019] Input the network attack information in the network attack entity library into a preset technique and tactic information recognition model, so that the preset technique and tactic information recognition model performs an attack process identification on the network attack information in the network attack entity library to obtain the technique and tactic information used by the attacker.

[0020] Optionally, before the step of inputting the network attack information in the network attack entity library into a preset technique and tactic information recognition model, so that the preset technique and tactic information recognition model performs an attack process identification on the network attack information in the network attack entity library to obtain the technique and tactic information used by the attacker, it further includes:

[0021] Determine the model training sample data according to the network attack information;

[0022] Train a target pre-trained model based on the model training sample data to obtain a preset technique and tactic information recognition model.

[0023] Optionally, before the step of training the target pre-trained model based on the model training sample data, it further includes:

[0024] Determine the language information of the network attack information in the network attack entity library;

[0025] Select a target pre-trained model from the pre-trained language models to be selected based on the language information.

[0026] Optionally, the step of determining the model training sample data according to the network attack information includes:

[0027] Perform part-of-speech tagging and semantic dependency analysis on the network attack information through natural language processing technology to obtain the analysis results;

[0028] Determine the technical and tactical association information based on the analysis results;

[0029] Determine the model training sample data based on the technical and tactical association information and the network attack information.

[0030] Optionally, the step of training the target pre-trained model based on the model training sample data to obtain the preset technical and tactical information recognition model includes:

[0031] Determine the value range of the preset model hyperparameters;

[0032] Train the target pre-trained model based on the value range of the preset model hyperparameters and the model training sample data to obtain the trained recognition model;

[0033] Determine the model evaluation score of the trained recognition model. When the model evaluation score meets the preset model training conditions, terminate the model training to obtain the preset technical and tactical information recognition model.

[0034] Optionally, after the step of training the target pre-trained model based on the model training sample data to obtain the preset technical and tactical information recognition model, it further includes:

[0035] Perform model distillation and model compression on the preset technical and tactical information recognition model to obtain the lightweight preset technical and tactical information recognition model.

[0036] Optionally, after the step of determining the popularity prediction result of the attack implementation process according to the attack technology information, it further includes:

[0037] Determine the target technology according to the popularity prediction result;

[0038] Determine the simulation attack implementation process corresponding to the current simulation attack according to the target technology;

[0039] Perform a simulation attack based on the simulation attack implementation process.

[0040] Optionally, the step of performing attack process recognition on the network attack information in the network attack entity library to obtain the technical and tactical information used by the attacker includes:

[0041] Obtain the network attack information in the network attack entity library;

[0042] Extract attack features from the network attack information through the N-Gram sliding window and anaphora resolution;

[0043] Identify the attack process based on the attack characteristics to obtain the techniques and tactics information used by the attacker.

[0044] In addition, to achieve the above object, the present invention also provides an attack implementation process prediction device, which includes:

[0045] An attack process identification module, configured to identify the attack process for the network attack information in the network attack entity library to obtain the techniques and tactics information used by the attacker;

[0046] A determination module, configured to determine the tactics of the current simulated attack, and determine the attack technique information corresponding to the tactics based on the techniques and tactics information;

[0047] A prediction module, configured to determine the popularity prediction result of the attack implementation process according to the attack technique information.

[0048] In addition, to achieve the above object, the present invention also proposes an attack implementation process prediction device, which includes: a memory, a processor, and an attack implementation process prediction program stored on the memory and executable on the processor, and the attack implementation process prediction program is configured to implement the steps of the attack implementation process prediction method as described above.

[0049] In addition, to achieve the above object, the present invention also proposes a storage medium, on which an attack implementation process prediction program is stored, and when the attack implementation process prediction program is executed by a processor, it implements the steps of the attack implementation process prediction method as described above.

[0050] The present invention identifies the attack process for the network attack information in the network attack entity library to obtain the techniques and tactics information used by the attacker; determines the tactics of the current simulated attack, and determines the attack technique information corresponding to the tactics based on the techniques and tactics information; determines the popularity prediction result of the attack implementation process according to the attack technique information. Since the present invention identifies the attack process for the network attack information in the network attack entity library to obtain the techniques and tactics information used by the attacker, and determines the popularity prediction result of the attack implementation process according to the techniques and tactics information. The above method of the present invention can determine the popularity prediction result of the commonly used attack implementation process in the current network attack, and then can select the attack implementation process for the simulated attack based on the popularity prediction result, improving the efficiency of the simulated attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 is a schematic structural diagram of an attack implementation process prediction device in the hardware operating environment related to the embodiment solution of the present invention;

[0052] Figure 2 is a schematic flowchart of the first embodiment of the attack implementation process prediction method of the present invention;

[0053] Figure 3 It is a schematic flowchart of the second embodiment of the method for predicting the attack implementation process of the present invention;

[0054] Figure 4 It is a schematic flowchart of the third embodiment of the method for predicting the attack implementation process of the present invention;

[0055] Figure 5 It is a structural block diagram of the first embodiment of the device for predicting the attack implementation process of the present invention.

[0056] The implementation, functional features and advantages of the object of the present invention will be further described with reference to the embodiments and the accompanying drawings. Detailed implementation manners

[0057] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0058] Refer to Figure 1 , Figure 1 It is a schematic structural diagram of an attack implementation process prediction device for the hardware operating environment involved in the embodiment solution of the present invention.

[0059] As Figure 1 shown, the attack implementation process prediction device may include: a processor 1001, such as a Central Processing Unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display) and an input unit such as a keyboard (Keyboard). Optionally, the user interface 1003 may further include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a Wireless-Fidelity (WI-FI) interface). The memory 1005 may be a high-speed Random Access Memory (RAM) or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0060] Those skilled in the art can understand that Figure 1 the structure shown in

[0061] As Figure 1As shown in the figure, the memory 1005, which is a storage medium, may include an operating system, a network communication module, a user interface module, and an attack implementation process prediction program.

[0062] In Figure 1 In the attack implementation process prediction device shown in the figure, the network interface 1004 is mainly used for data communication with a network server; the user interface 1003 is mainly used for data interaction with a user; the processor 1001 and the memory 1005 in the attack implementation process prediction device of the present invention may be provided in the attack implementation process prediction device. The attack implementation process prediction device calls the attack implementation process prediction program stored in the memory 1005 through the processor 1001 and executes the attack implementation process prediction method provided by the embodiments of the present invention.

[0063] Based on the above attack implementation process prediction device, an embodiment of the present invention provides an attack implementation process prediction method. Referring to Figure 2 , Figure 2 is a schematic flowchart of the first embodiment of the attack implementation process prediction method of the present invention.

[0064] In this embodiment, the attack implementation process prediction method includes the following steps:

[0065] Step S10: Identify the attack process for the network attack information in the network attack entity library to obtain the tactics and techniques information used by the attacker.

[0066] It should be noted that the execution subject of this embodiment may be a computing service device with data processing, network communication, and program running functions, such as a mobile phone, a tablet computer, a personal computer, etc., or an electronic device or an attack implementation process prediction device capable of implementing the above functions. Hereinafter, the attack implementation process prediction device will be taken as an example to illustrate this embodiment and the following embodiments.

[0067] It should be noted that the network attack entity library may include network attack reports in the current and past preset time periods continuously collected in the form of TTP intelligence. The preset time period may be a custom time range such as one year or half a year. The network attack information may be the network attack reports in the network attack entity library, including information such as the network attack tactics, techniques, and implementation processes used in each network attack. The identification of the attack process for the network attack information in the network attack entity library may be to determine the tactics, techniques, and implementation process adopted during the network attack according to the network attack information, that is, the tactics and techniques information used by the attacker.

[0068] Further, in order to accurately identify the attack process of the cyber attack information in the cyber attack entity library, obtain the tactics and techniques information used by the attacker, and improve the identification efficiency of the tactics and techniques information, step S10 may include step S100: input the cyber attack information in the cyber attack entity library into a preset tactics and techniques information identification model, so that the preset tactics and techniques information identification model identifies the attack process of the cyber attack information in the cyber attack entity library, and obtains the tactics and techniques information used by the attacker.

[0069] It should be noted that the preset tactics and techniques information identification model may be a model pre-trained for identifying the cyber attack tactics, techniques, and implementation processes used in the cyber attack information.

[0070] Further, in order to improve the identification efficiency of the attack process, step S10 may include: obtaining the cyber attack information in the cyber attack entity library;

[0071] extracting attack features from the cyber attack information through an N-Gram sliding window and anaphora resolution;

[0072] identifying the attack process according to the attack features to obtain the tactics and techniques information used by the attacker.

[0073] It should be noted that the attack features may include attack tactics, attack techniques, and other attack features. Extracting attack features from the cyber attack information through an N-Gram sliding window and anaphora resolution may be to extract attack features from the context of the attack description of the cyber attack information using an N-Gram sliding window and anaphora resolution, and then obtain the tactics and techniques information used by the attacker according to the attack features. This avoids the loss of important TTP due to the dispersion of the attack description in the cyber attack information.

[0074] Step S20: Determine the tactics of the current simulated attack, and determine the attack technique information corresponding to the tactics based on the tactics and techniques information.

[0075] It should be noted that the tactics of the current simulated attack can be the simulated attack tactics adopted when the current simulated attack is to be carried out, which can be determined by the type of BAS product. The determination of the attack technology information corresponding to the tactics based on the technical and tactical information can be to determine what attack technology is adopted when using the tactics in the current network attack according to the technical and tactical information, that is, the attack technology information. For example, taking the tactic [TA0006, Credential Acquisition] as an example, when using this tactic for network attack, the attack technologies used are: [T1110, Brute Force], [T1555, Obtain Credentials from Common Password Storage Locations], [T1212, Obtain Credentials by Exploiting Software Vulnerabilities], [T1111, Two-Factor Interception], [T1003, Operating System Credential Export], etc., up to 77 attack technologies. The attack technology information also includes the usage quantity of each attack technology, as well as the main technology and secondary technology used in each attack.

[0076] Step S30: Determine the popularity prediction result of the attack implementation process according to the attack technology information.

[0077] It should be noted that the determination of the popularity prediction result of the attack implementation process according to the attack technology information can be to sort the attack technologies according to the usage times of each attack technology in the attack technology information to obtain the sorting result of the usage times of the attack technologies, determine the attack implementation process corresponding to the attack technology, and use the sorting result of the usage times of the attack technologies as the popularity prediction result of the attack implementation process corresponding to the attack technology.

[0078] Furthermore, in order to select the most effective attack technologies and attack implementation processes that can objectively reflect the current real network attack environment for simulated attack and improve the efficiency of simulated attack, after step S30, it further includes: determining the target technology according to the popularity prediction result;

[0079] Determine the simulated attack implementation process corresponding to the current simulated attack according to the target technology;

[0080] Conduct a simulated attack based on the simulated attack implementation process.

[0081] It should be noted that the determination of the target technology according to the popularity prediction result can be to select the attack technologies with higher scores as the target technology according to the popularity scores in the popularity prediction result. The target technology can include at least one. For example, select 5 attack technologies with higher scores as the target technology according to the popularity scores in the popularity prediction result. Determine the attack implementation process corresponding to the target technology, that is, the simulated attack implementation process, and conduct a simulated attack according to the simulated attack implementation process.

[0082] In this embodiment, the attack process of the cyber-attack information in the cyber-attack entity library is identified to obtain the technical and tactical information used by the attacker; the tactic of the current simulated attack is determined, and the attack technology information corresponding to the tactic is determined based on the technical and tactical information; the popularity prediction result of the attack implementation process is determined according to the attack technology information. Since this embodiment identifies the attack process of the cyber-attack information in the cyber-attack entity library to obtain the technical and tactical information used by the attacker, and determines the popularity prediction result of the attack implementation process according to the technical and tactical information. The above method of this embodiment can determine the popularity prediction result of the commonly used attack implementation process in the current cyber-attack, and then the attack implementation process for simulated attack can be selected based on the popularity prediction result, improving the efficiency of simulated attack.

[0083] Reference Figure 3 , Figure 3 is a schematic flowchart of the second embodiment of the method for predicting the attack implementation process of the present invention.

[0084] Based on the above first embodiment, in this embodiment, the step S30 includes:

[0085] Step S301: Determine the usage times and weight coefficients of the attack technologies according to the attack technology information.

[0086] It should be noted that the determination of the usage times of the attack technologies according to the attack technology information may be to separately obtain the usage times when the attack technology is the main attack technology, the usage times when it is the secondary attack technology, and the total usage times. The determination of the weight coefficients of the attack technologies according to the attack technology information may be to determine the target usage times of each of the attack technologies as the main attack technology, and the total usage times are obtained by adding up the target usage times of each attack technology. The weight coefficient of the attack technology may be: the target usage times of the attack technology / the total usage times.

[0087] Further, in order to improve the accuracy of popularity prediction, the step of determining the weight coefficients of the attack technologies according to the attack technology information includes:

[0088] Determine the detection rule information of the attack technologies according to the attack technology information;

[0089] Determine the weight coefficients of the attack technologies based on the detection rule information and the total number of rules corresponding to the tactic.

[0090] It should be noted that the detection rule information may include the number of detection rules or relationship analysis rules for detecting the attack technique. For example, for T1110, the attack technique of brute force cracking has 10 corresponding detection rules. The determination of the weight coefficient of the attack technique based on the detection rule information and the total number of rules corresponding to the tactic may be obtained by dividing the number of detection rules of the attack technique by the sum of the rules of all attack techniques corresponding to the tactic, resulting in the weight coefficient of the attack technique. For example: for the [TA0006, Credential Access] tactic, the corresponding attack techniques are: [T1110, Brute Force Cracking], [T1003, Operating System Credential Dumping], [T1111, Two-Factor Interception], etc. The detection rules of these attack techniques include: [T1110, Brute Force Cracking, 10 detection rules], [T1003, Operating System Credential Dumping, 25 detection rules], [T1111, Two-Factor Interception, 1 detection rule]. Then it can be obtained that: the weight coefficient of T1110 brute force cracking = 10 / total number of rules, the weight coefficient of T1003 operating system credential dumping = 25 / total number of rules, the weight coefficient of T1111 two-factor interception = 1 / total number of rules. Assuming that for the [TA0006, Credential Access] tactic, there are a total of 786 rules, thus the weight coefficient of T1110 brute force cracking = 10 / 786, the weight coefficient of T1003 operating system credential dumping = 25 / 786, and the weight coefficient of T1111 two-factor interception = 1 / 786. Further, when determining the weight coefficient of the attack technique in the above manner, the step of determining the usage times of the attack technique according to the attack technique information includes: determining the usage times of the attack technique when it is the main attack technique according to the attack technique information.

[0091] Step S302: Determine the popularity score of the attack technique based on the usage times and the weight coefficient.

[0092] It should be noted that the determination of the popularity score of the attack technique based on the usage times and the weight coefficient may be obtained by multiplying the total usage times of the attack technique by the weight coefficient of the attack technique to obtain the popularity score of the attack technique.

[0093] Step S303: Determine the popularity prediction result of the attack implementation process based on the popularity score.

[0094] It should be noted that the determination of the popularity prediction result of the attack implementation process based on the popularity score may be to sort the popularity scores of each attack technique to obtain the popularity ranking result of the attack technique, and use the popularity ranking result as the popularity prediction result of the attack implementation process corresponding to the attack technique.

[0095] In specific implementation, the tactics of the current simulated attack can be determined according to the type of BAS products. Taking the tactic [TA0006, Credential Acquisition] as an example, there are up to 77 attack techniques under this tactic, including [T1110, Brute Force], [T1555, Obtain Credentials from Common Password Storage Locations], [T1212, Obtain Credentials by Exploiting Software Vulnerabilities], [T1111, Two-Factor Interception], [T1003, Operating System Credential Export], etc. It is possible to count the network attack information in the past year to find out which network attack processes are commonly used, and thus the [TA0006, Credential Acquisition] tactic in the most recent year can be obtained. Sorting by the number of times used as the main attack technique, we can get [T1110, Brute Force, 710 times], [T1003, Operating System Credential Export, 304 times], [T1111, Two-Factor Interception, 9 times]... According to the operability of the attack technique, that is, the number of mitigation and detection means, the weight of the current technique is determined. For example, the number of local detection rules and relationship analysis rules here is used as the weight coefficient. For example, [T1110, Brute Force, 710 times, 10 detection rules], [T1003, Operating System Credential Export, 304 times, 25 detection rules], [T1111, Two-Factor Interception, 9 times, 1 detection rule]. It can be obtained that the weight coefficient of T1110 Brute Force = 10 / total number of rules, the weight coefficient of T1003 Operating System Credential Export = 25 / total number of rules, and the weight coefficient of T1111 Two-Factor Interception = 1 / total number of rules. Assuming that there are 786 rules for [TA0006, Credential Acquisition], the final popularity ranking is obtained as: [T1003, Operating System Credential Export, POP: 9.66], [T1110, Brute Force, POP: 9.03], [T1111, Two-Factor Interception, POP: 0.01]...

[0096] In this embodiment, the usage times and weight coefficients of attack techniques are determined according to the attack technique information; the popularity scores of attack techniques are determined according to the usage times and the weight coefficients; and the popularity prediction results of the attack implementation process are determined based on the popularity scores. In this embodiment, the popularity scores of attack techniques are determined according to the usage times and weight coefficients of attack techniques in the current network attack environment; and then the popularity prediction results of the attack implementation process are determined based on the popularity scores. It is possible to determine the attack technique information that can most objectively reflect the current real network attack environment, providing a basis for the selection of the attack implementation process in the simulated attack process and improving the efficiency of the simulated attack.

[0097] Reference Figure 4 , Figure 4 is a schematic flowchart of the third embodiment of the attack implementation process prediction method of the present invention.

[0098] Based on the above embodiments, in this embodiment, before the step S100, the method further includes:

[0099] Step S001: Determine model training sample data according to network attack information.

[0100] It should be noted that determining the model training sample data according to the network attack information may be to mark the main technology and secondary technology in the network attack information through prior knowledge to obtain the model training sample data for model training. Among them, the main technical tactics (i.e., the main technology) are the attack technologies used by the attacker to achieve the main purpose when conducting a specific attack, and the secondary technology is some attack technologies attached to the main attack technology, mainly some tool-based technologies.

[0101] In a specific implementation, combined with the actual attack scenario, the main and secondary attack technical tactics are distinguished by prior knowledge, and the number of positive example (TP) data in each training set is not less than 50. For example:

[0102] "Disabled antivirus (AV) programs such as Windows Defender add \"HKLM\Software\Policies\Microsoft\Windows Defender\" / v DisableAntiVirus / t REG_DWORD / d 1 / f add \"HKLM\Software\Policies\Microsoft\Windows Defender\" / v DisableAntiSpyware / t REG_DWORD / d 1 / f add \"HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine\" / v MpEnablePus / t REG_DWORD / d 0 / f" can also refer to Table 1 below. Table 1 shows the main technology and secondary technology used in a certain network attack:

[0103] Table 1 - Main Technology and Secondary Technology Used in a Certain Network Attack

[0104]

[0105]

[0106] Among them, True is used to represent the main technology, TA0005 is used to represent the tactic, T1562.001 is the main technology, and T1112 is the secondary technology. At the same time, each training set also includes negative examples (TN), and the negative example data is initially set to be optional.

[0107] Step S002: Train the target pre-trained model based on the model training sample data to obtain a preset technical and tactical information recognition model.

[0108] It should be noted that the target pre-trained model can be a training model selected from the pre-trained language models to be selected according to the language information of the network attack information. To improve the accuracy of model training, in this embodiment, a model that supports the language of the network attack information is selected as the training model. For example, in this embodiment, the languages of the network attack information include Chinese and English, and pre-trained language models that can support Chinese and English respectively need to be selected. In addition, since different pre-trained language models may adopt different language tasks, word segmentation, and masking techniques, a pre-trained language model suitable for this embodiment is initially selected in this embodiment. Then, according to the actual test results and actual hardware conditions, a target pre-trained model is selected from the pre-trained language models. In this embodiment, the following pre-trained language models are tested and selected: The pre-trained language models that support Chinese are: bert-base-chinese, bert-wwm-chinese, bert-wwm-ext-chinese, roberta-wwm-ext, roberta-wwm-ext-large, ernie-3.0-base-zh, and ernie-3.0-xbase-zh, etc. The pre-trained language models that support English are: bert-base-cased, bert-base-uncased, bert-large-uncased-whole-word-masking, bert-large-cased-whole-word-masking, and ernie-2.0-large-en, etc.

[0109] It should be noted that the training of the target pre-trained model based on the model training sample data can be to train the target pre-trained model with the model training sample data, obtain the output result of the model, and calibrate the output result manually, so as to perform backtracking loop training and continuously optimize and improve the model recognition and extraction accuracy.

[0110] Furthermore, to improve the accuracy of model prediction, step S001 of this embodiment may further include: performing part-of-speech tagging and semantic dependency analysis on the network attack information through natural language processing technology to obtain an analysis result;

[0111] Determine the technical and tactical association information based on the analysis result;

[0112] Determine the model training sample data based on the technical and tactical association information and the network attack information.

[0113] It should be noted that the part-of-speech tagging and semantic dependency analysis of network attack information through natural language processing technology can obtain analysis results. This can be achieved by collecting information such as key tools and commands that can be used in information retrieval technology through part-of-speech tagging (POS) and semantic dependency analysis (SDP) in natural language processing technology, and establishing the association between key tools, commands and techniques and tactics. For example:

[0114] The fetched payload is supposed to be saved in%Profile%\update.dll. Eventually, the fetched file is spawned with the following commands:

[0115] Command#1: rundll32 exe%Profle%\updated, #1

[0116] 5pOylrsNaAYqx8JNZSTouZNjo+j5XEFHxzxllqpQ==

[0117] Command#2: rundll32 exe%Profle%\update dl, #1

[0118] 5oGygYVhos+laqBINdFaVJSfMiwhh4LCDn4=

[0119] It should be noted that the determination of the association information of techniques and tactics based on the analysis results can be to establish the association between key tools, commands and techniques and tactics according to the analysis results, obtain the association information of techniques and tactics, and assist the model in identifying the attack process by adding the association information of techniques and tactics to the model training sample data, so as to obtain the techniques and tactics information used by the attacker.

[0120] Furthermore, when performing model training, in order to improve the accuracy of model training, step S002 further includes: determining the value range of the preset model hyperparameters;

[0121] Training the target pre-trained model based on the preset model hyperparameter value range and the model training sample data to obtain a trained recognition model;

[0122] Determining the model evaluation score of the trained recognition model, and terminating the model training when the model evaluation score meets the preset model training conditions to obtain a preset techniques and tactics information recognition model.

[0123] It should be noted that the determination of the value range of the preset model hyperparameters can be to define the value range of the following key hyperparameters through a script and select the parameters used for the best training result.

[0124] 1) Define the maximum Token value length: MAX_SEQ_LENGTH, and the optional values are 128, 256, and 512;

[0125] 2) Define the length of batch training and update parameters: BATCH_SIZE, and the optional values are 8, 16, and 32;

[0126] 3) Select an optimizer, define a loss function, and define a learning rate to control the learning speed. Since it is transfer learning, a smaller value is required: Learning Rate, and the optional values of Learning Rate are 1e-5, 2e-5, 3e-5, and 5e-5. The loss function is BCEWithLogitsLoss, and the optimizer uses the Adam W optimization algorithm of BERT.

[0127] It should be noted that the determination of the model evaluation score of the trained recognition model, when the model evaluation score meets the preset model training conditions, terminates the model training, and obtaining the preset technical and tactical information recognition model can be to define the evaluation index using Macro F1. First, calculate the precision-recall and its f1 score for each category, and then obtain the f1 score on the entire sample by taking the average. Use the f1 score as the training score of the model, and stop the model training when the training score does not improve for N consecutive times, where N can be a preset value.

[0128] Furthermore, in order to improve the model accuracy and reduce the model latency, after the step S002, it further includes: performing model distillation and model compression on the preset technical and tactical information recognition model to obtain the lightweight preset technical and tactical information recognition model.

[0129] It should be noted that the model distillation and model compression of the preset technical and tactical information recognition model can be in the task distillation stage. By using the distillation intermediate layer, distill the last layer of the model (i.e., the preset technical and tactical information recognition model) with the best test score, calculate the Klloss between the k-q matrix and the v-v matrix of the attention layer of the model's transformer and the corresponding matrices of the teacher model, and perform distillation on the prediction layer to produce the final model that can be used in the production environment, that is, the lightweight preset technical and tactical information recognition model.

[0130] This embodiment determines model training sample data based on network attack information; trains a target pre-trained model based on the model training sample data to obtain a preset technical and tactical information recognition model. By training the model in this embodiment to obtain a preset technical and tactical information recognition model and using the preset technical and tactical information recognition model to identify the attack process, the recognition speed and accuracy of the attack process can be improved, thereby improving the popularity prediction efficiency of the attack implementation process.

[0131] Refer to Figure 5 , Figure 5 which is the structural block diagram of the first embodiment of the attack implementation process prediction device of the present invention.

[0132] As Figure 5 shown, the attack implementation process prediction device proposed in the embodiment of the present invention includes:

[0133] An attack process recognition module 10, configured to perform attack process recognition on network attack information in a network attack entity library to obtain the technical and tactical information used by an attacker;

[0134] A determination module 20, configured to determine the tactics of a current simulated attack and determine the attack technical information corresponding to the tactics based on the technical and tactical information;

[0135] A prediction module 30, configured to determine a popularity prediction result of an attack implementation process according to the attack technical information.

[0136] In this embodiment, attack process recognition is performed on network attack information in a network attack entity library to obtain the technical and tactical information used by an attacker; the tactics of a current simulated attack are determined, and the attack technical information corresponding to the tactics is determined based on the technical and tactical information; a popularity prediction result of the attack implementation process is determined according to the attack technical information. Since this embodiment performs attack process recognition on network attack information in a network attack entity library to obtain the technical and tactical information used by an attacker and determines the popularity prediction result of the attack implementation process according to the technical and tactical information. The above method in this embodiment can determine the popularity prediction result of the commonly used attack implementation process in the current network attack, and then the attack implementation process for the simulated attack can be selected based on the popularity prediction result, improving the simulated attack efficiency.

[0137] It should be noted that the above-described work process is only illustrative and does not limit the protection scope of the present invention. In actual applications, those skilled in the art can select some or all of them according to actual needs to achieve the purpose of the solution of this embodiment, and no limitation is made here.

[0138] In addition, for the technical details not described in detail in this embodiment, reference can be made to the attack implementation process prediction method provided in any embodiment of the present invention, which will not be elaborated here.

[0139] Based on the first embodiment of the attack implementation process prediction device of the present invention, a second embodiment of the attack implementation process prediction device of the present invention is proposed.

[0140] In this embodiment, the prediction module 30 is further configured to determine the usage times and weight coefficients of the attack techniques according to the attack technique information;

[0141] Determine the popularity score of the attack technique according to the usage times and the weight coefficients;

[0142] Determine the popularity prediction result of the attack implementation process based on the popularity score.

[0143] Further, the prediction module 30 is further configured to determine the detection rule information of the attack technique according to the attack technique information;

[0144] Determine the weight coefficient of the attack technique based on the detection rule information and the total number of rules corresponding to the tactics.

[0145] Further, the prediction module 30 is further configured to determine the usage times of the attack technique when it is used as the main attack technique according to the attack technique information.

[0146] Further, the attack process recognition module 10 is further configured to input the network attack information in the network attack entity library into a preset technique and tactic information recognition model, so that the preset technique and tactic information recognition model performs attack process recognition on the network attack information in the network attack entity library to obtain the technique and tactic information used by the attacker.

[0147] Further, the attack process recognition module 10 is further configured to determine model training sample data according to the network attack information;

[0148] Train a target pre-trained model based on the model training sample data to obtain a preset technique and tactic information recognition model.

[0149] Further, the attack process recognition module 10 is further configured to determine the language information of the network attack information in the network attack entity library;

[0150] Select a target pre-trained model from the pre-trained language models to be selected based on the language information.

[0151] Further, the attack process recognition module 10 is further configured to perform part-of-speech tagging and semantic dependency analysis on the network attack information through natural language processing technology to obtain an analysis result;

[0152] Determine technique and tactic association information based on the analysis result;

[0153] Determine model training sample data based on the technical and tactical association information and the network attack information.

[0154] Furthermore, the attack process recognition module 10 is further configured to determine a preset model hyperparameter value range;

[0155] Train the target pre-trained model based on the preset model hyperparameter value range and the model training sample data to obtain a trained recognition model;

[0156] Determine the model evaluation score of the trained recognition model. When the model evaluation score meets the preset model training condition, terminate the model training to obtain a preset technical and tactical information recognition model.

[0157] Furthermore, the attack process recognition module 10 is further configured to perform model distillation and model compression on the preset technical and tactical information recognition model to obtain the lightweight preset technical and tactical information recognition model.

[0158] Furthermore, the prediction module 30 is further configured to determine a target technology according to the popularity prediction result;

[0159] Determine the simulation attack implementation process corresponding to the current simulation attack according to the target technology;

[0160] Perform a simulation attack based on the simulation attack implementation process.

[0161] Furthermore, the attack process recognition module 10 is further configured to obtain network attack information in a network attack entity library;

[0162] Extract attack features from the network attack information through an N-Gram sliding window and anaphora resolution;

[0163] Perform attack process recognition according to the attack features to obtain the technical and tactical information used by the attacker. Other embodiments or specific implementation manners of the attack implementation process prediction device of the present invention may refer to the above method embodiments, which will not be elaborated here.

[0164] In addition, an embodiment of the present invention further provides a storage medium, on which an attack implementation process prediction program is stored. When the attack implementation process prediction program is executed by a processor, the steps of the attack implementation process prediction method as described above are implemented.

[0165] It should be noted that in this article, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, method, article or system including a series of elements not only includes those elements but also includes other elements not expressly listed, or elements inherent to such process, method, article or system. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article or system including such element.

[0166] The serial numbers of the above embodiments of the present invention are only for description and do not represent the superiority or inferiority of the embodiments.

[0167] Through the description of the above embodiments, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus a necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as a read-only memory / random access memory, magnetic disk, optical disk), and includes several instructions for causing a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in various embodiments of the present invention.

[0168] The above are only the preferred embodiments of the present invention, and do not limit the patent scope of the present invention accordingly. Any equivalent structure or equivalent process transformation made by using the content of the specification and drawings of the present invention, or directly or indirectly applied in other related technical fields, shall be equally included in the patent protection scope of the present invention.

[0169] The present invention discloses A1, a method for predicting the attack implementation process. The method for predicting the attack implementation process includes the following steps:

[0170] Identify the attack process for the network attack information in the network attack entity library to obtain the technical and tactical information used by the attacker;

[0171] Determine the tactics of the current simulated attack, and determine the attack technology information corresponding to the tactics based on the technical and tactical information;

[0172] Determine the popularity prediction result of the attack implementation process according to the attack technology information.

[0173] A2. The method for predicting the attack implementation process as described in A1, the step of determining the popularity prediction result of the attack implementation process according to the attack technology information includes:

[0174] Determine the usage times and weight coefficients of the attack technique according to the attack technique information;

[0175] Determine the popularity score of the attack technique according to the usage times and the weight coefficients;

[0176] Determine the popularity prediction result of the attack implementation process based on the popularity score.

[0177] A3. The attack implementation process prediction method as described in A2, the step of determining the weight coefficient of the attack technique according to the attack technique information includes:

[0178] Determine the detection rule information of the attack technique according to the attack technique information;

[0179] Determine the weight coefficient of the attack technique based on the detection rule information and the total number of rules corresponding to the tactic.

[0180] A4. The attack implementation process prediction method as described in A2, the step of determining the usage times of the attack technique according to the attack technique information includes:

[0181] Determine the usage times of the attack technique when it is the main attack technique according to the attack technique information.

[0182] A5. The attack implementation process prediction method as described in any one of A1 - A4, the step of performing attack process recognition on the network attack information in the network attack entity library to obtain the technique and tactic information used by the attacker includes:

[0183] Input the network attack information in the network attack entity library into a preset technique and tactic information recognition model, so that the preset technique and tactic information recognition model performs attack process recognition on the network attack information in the network attack entity library to obtain the technique and tactic information used by the attacker.

[0184] A6. The attack implementation process prediction method as described in A5, before the step of inputting the network attack information in the network attack entity library into a preset technique and tactic information recognition model, so that the preset technique and tactic information recognition model performs attack process recognition on the network attack information in the network attack entity library to obtain the technique and tactic information used by the attacker, further includes:

[0185] Determine model training sample data according to the network attack information;

[0186] Train a target pre - trained model based on the model training sample data to obtain a preset technique and tactic information recognition model.

[0187] A7. The attack implementation process prediction method as described in A6. Before the step of training the target pre-trained model based on the model training sample data, it further includes:

[0188] Determine the language information of the network attack information in the network attack entity library;

[0189] Select a target pre-trained model from the pre-trained language models to be selected based on the language information.

[0190] A8. The attack implementation process prediction method as described in A6. The step of determining the model training sample data according to the network attack information includes:

[0191] Perform part-of-speech tagging and semantic dependency analysis on the network attack information through natural language processing technology to obtain an analysis result;

[0192] Determine the technical and tactical association information based on the analysis result;

[0193] Determine the model training sample data based on the technical and tactical association information and the network attack information.

[0194] A9. The attack implementation process prediction method as described in A6. The step of training the target pre-trained model based on the model training sample data to obtain a preset technical and tactical information recognition model includes:

[0195] Determine the value range of the preset model hyperparameters;

[0196] Train the target pre-trained model based on the value range of the preset model hyperparameters and the model training sample data to obtain a trained recognition model;

[0197] Determine the model evaluation score of the trained recognition model. When the model evaluation score meets the preset model training conditions, terminate the model training to obtain a preset technical and tactical information recognition model.

[0198] A10. The attack implementation process prediction method as described in A6. After the step of training the target pre-trained model based on the model training sample data to obtain a preset technical and tactical information recognition model, it further includes:

[0199] Perform model distillation and model compression on the preset technical and tactical information recognition model to obtain a lightweight preset technical and tactical information recognition model.

[0200] A11. The attack implementation process prediction method as described in any one of A1 - A4. After the step of determining the popularity prediction result of the attack implementation process according to the attack technical information, it further includes:

[0201] Determine the target technology according to the popularity prediction result;

[0202] Determine the simulation attack implementation process corresponding to the current simulation attack according to the target technology;

[0203] Perform a simulation attack based on the simulation attack implementation process.

[0204] A12. The attack implementation process prediction method according to any one of A1 - A4, wherein the step of identifying the attack process from the network attack information in the network attack entity library to obtain the technical and tactical information used by the attacker includes:

[0205] Obtain the network attack information in the network attack entity library;

[0206] Extract attack features from the network attack information through an N - Gram sliding window and anaphora resolution;

[0207] Identify the attack process according to the attack features to obtain the technical and tactical information used by the attacker.

[0208] The present invention discloses B13. An attack implementation process prediction device, the attack implementation process prediction device includes:

[0209] An attack process identification module, configured to identify the attack process from the network attack information in the network attack entity library to obtain the technical and tactical information used by the attacker;

[0210] A determination module, configured to determine the tactics of the current simulation attack, and determine the attack technology information corresponding to the tactics based on the technical and tactical information;

[0211] A prediction module, configured to determine the popularity prediction result of the attack implementation process according to the attack technology information.

[0212] B14. The attack implementation process prediction device according to B13, wherein the prediction module is further configured to determine the usage times and weight coefficients of the attack technology according to the attack technology information;

[0213] Determine the popularity score of the attack technology according to the usage times and the weight coefficients;

[0214] Determine the popularity prediction result of the attack implementation process based on the popularity score.

[0215] B15. The attack implementation process prediction device according to B14, wherein the prediction module is further configured to determine the detection rule information of the attack technology according to the attack technology information;

[0216] Determine the weight coefficient of the attack technology based on the detection rule information and the total number of rules corresponding to the tactics.

[0217] B16. The attack implementation process prediction device as described in B13, wherein the attack process recognition module is further configured to input the network attack information in the network attack entity library into a preset technical and tactical information recognition model, so that the preset technical and tactical information recognition model recognizes the attack process of the network attack information in the network attack entity library to obtain the technical and tactical information used by the attacker.

[0218] B17. The attack implementation process prediction device as described in B16, wherein the attack process recognition module is further configured to determine model training sample data according to the network attack information;

[0219] Based on the model training sample data, train a target pre-trained model to obtain a preset technical and tactical information recognition model.

[0220] B18. The attack implementation process prediction device as described in B17, wherein the attack process recognition module is further configured to determine the language information of the network attack information in the network attack entity library;

[0221] Based on the language information, select a target pre-trained model from the pre-trained language models to be selected.

[0222] The present invention discloses C19. An attack implementation process prediction device, the device includes: a memory, a processor, and an attack implementation process prediction program stored on the memory and executable on the processor, the attack implementation process prediction program is configured to implement the steps of the attack implementation process prediction method as described in any one of A1 to A12.

[0223] The present invention discloses D20. A storage medium, on which an attack implementation process prediction program is stored, and when the attack implementation process prediction program is executed by a processor, it implements the steps of the attack implementation process prediction method as described in any one of A1 to A12.

Claims

1. A method for predicting the attack implementation process, characterized in that, the method for predicting the attack implementation process includes the following steps: Identify the attack process for the network attack information in the network attack entity library to obtain the technical and tactical information used by the attacker; Determine the current simulated attack tactic, and determine the attack technology information corresponding to the tactic based on the technical and tactical information; Determine the popularity prediction result of the attack implementation process according to the attack technology information.

2. The method for predicting the attack implementation process according to claim 1, characterized in that, the step of determining the popularity prediction result of the attack implementation process according to the attack technology information includes: Determine the usage times and weight coefficients of the attack technology according to the attack technology information; Determine the popularity score of the attack technology according to the usage times and the weight coefficients; Determine the popularity prediction result of the attack implementation process based on the popularity score.

3. The method for predicting the attack implementation process according to claim 2, characterized in that, the step of determining the weight coefficient of the attack technology according to the attack technology information includes: Determine the detection rule information of the attack technology according to the attack technology information; Determine the weight coefficient of the attack technology based on the detection rule information and the total number of rules corresponding to the tactic.

4. The method for predicting the attack implementation process according to claim 2, characterized in that, the step of determining the usage times of the attack technology according to the attack technology information includes: Determine the usage times of the attack technology when it is the main attack technology according to the attack technology information.

5. The method for predicting the attack implementation process according to any one of claims 1-4, characterized in that, the step of identifying the attack process for the network attack information in the network attack entity library to obtain the technical and tactical information used by the attacker includes: Input the network attack information in the network attack entity library into a preset technical and tactical information recognition model, so that the preset technical and tactical information recognition model identifies the attack process for the network attack information in the network attack entity library to obtain the technical and tactical information used by the attacker.

6. The method for predicting the attack implementation process according to claim 5, characterized in that, before the step of inputting the network attack information in the network attack entity library into a preset technical and tactical information recognition model, so that the preset technical and tactical information recognition model identifies the attack process for the network attack information in the network attack entity library to obtain the technical and tactical information used by the attacker, further includes: Determine the model training sample data according to the network attack information; Train the target pre-trained model based on the model training sample data to obtain a preset technical and tactical information recognition model.

7. The method for predicting the attack implementation process according to claim 6, characterized in that, before the step of training the target pre-trained model based on the model training sample data, further includes: Determine the language information of the network attack information in the network attack entity library; Select a target pre-trained model from the pre-trained language models to be selected based on the language information.

8. An apparatus for predicting the attack implementation process, characterized in that, The attack implementation process prediction device includes: An attack process recognition module, configured to recognize the attack process from the network attack information in the network attack entity library to obtain the techniques and tactics information used by the attacker; A determination module, configured to determine the tactics of the current simulated attack, and determine the attack technique information corresponding to the tactics based on the techniques and tactics information; A prediction module, configured to determine the popularity prediction result of the attack implementation process according to the attack technique information.

9. An attack implementation process prediction device, Characterized in that, The device includes: a memory, a processor, and an attack implementation process prediction program stored on the memory and executable on the processor, and the attack implementation process prediction program is configured to implement the steps of the attack implementation process prediction method according to any one of claims 1 to 7.

10. A storage medium, Characterized in that, An attack implementation process prediction program is stored on the storage medium, and when the attack implementation process prediction program is executed by a processor, the steps of the attack implementation process prediction method according to any one of claims 1 to 7 are implemented.

Images