A network security defense method based on a minimum cut set algorithm

Abstract

The application provides a network security defense method based on a minimum cut set algorithm, and solves the problems that when seeking a minimum cut set to determine a defense point, all cut sets are not comprehensively considered, resulting in missing key defense points, and when processing a large-scale attack graph, the response time is too long, and the security protection cannot be realized in time. It includes the following steps: a scanning system obtains a vulnerability report and a network configuration, generates an attack graph, and obtains equivalent formulas of the attack graph from front to back according to attackers and attacked persons of the attack graph; the equivalent formulas are replaced and expanded from left to right, pruned, and then subjected to Cartesian product to obtain a minimum cut set; intermediate expressions are found in the equivalent formulas, negative terms in the intermediate expressions are removed and self-checked, if a subset of the minimum cut set is contained, the subset is removed, subjected to Cartesian product, and incorporated into the minimum cut set to obtain a minimum defense strategy. The application can be widely applied in the field of network security technology.

Description

Technical Field

[0001] This application belongs to the field of network security technology, and more specifically, relates to a network security defense method based on the minimum cut set algorithm. Background Technology

[0002] SCADA / ICS systems are the control backbone of many critical infrastructures, such as power grids, nuclear power plants, transportation systems, and water / gas distribution networks. In recent years, due to the cloud computing and IoT revolution, SCADA / ICS systems have frequently been threatened by cyberattacks. To attempt to analyze these threats, attack graphs were proposed. It is a tool for graphically representing system-level security vulnerabilities in SCADA / ICS systems. Attack graphs provide a comprehensive overview, showing how attackers might exploit the interdependencies of component-level atomic vulnerabilities to compromise the system. This in-depth representation can both prevent attacks and enable system administrators to optimize their allocation of defense resources.

[0003] Generally, even small systems can have large and complex attack graphs. Therefore, protecting all vulnerabilities contained within the attack graph may be impractical for system administrators limited by system downtime, budget, and resources. Furthermore, the scale of the attack graph makes it difficult to rely solely on manual intervention. Therefore, protecting SCADA / ICS systems requires an automated tool to help system administrators analyze attack graphs to determine the minimum viable defenses to protect their systems. Calculating the minimum cut sets of the attack graph undoubtedly provides an effective way to analyze minimum defense strategies. By finding the cut sets of the attack graph, we can understand how to break the original attack graph into two connected components with minimal resources, interrupting all attack paths from the attacker to the target asset, and achieving effective defense against potential attacks.

[0004] However, current algorithms for finding the minimum cut set of an attack graph often focus only on certain specific types of edge cut sets, failing to comprehensively consider all possible cut sets. This leads to the omission of critical defense points, creating vulnerabilities in security protection. Furthermore, existing algorithms frequently get trapped in local optima, failing to find the globally optimal minimum cut set of the attack graph, thus affecting the effectiveness of the final defense strategy. Moreover, many existing minimum edge cut set algorithms have excessively high computational complexity when processing attack graphs. In practical applications, the time required to solve for all cut sets diverges too rapidly with the size of the attack graph, making it impossible to handle large-scale attack graphs in a timely manner and creating vulnerabilities in security protection. Therefore, there is an urgent need to provide a defense solution system based on a minimum cut set algorithm to address these problems. Summary of the Invention

[0005] The purpose of this application is to provide a network security defense method based on the minimum cut set algorithm, so as to solve the technical problems in the prior art that when seeking the minimum cut set to determine the defense point, not all cut sets are fully considered, resulting in the omission of key defense points, and the response time is too long when processing large-scale attack graphs, making it impossible to achieve security protection in a timely manner.

[0006] To achieve the above objectives, this application provides a network security defense method based on the minimum cut set algorithm, which includes scanning the system to obtain vulnerability reports and network configurations, generating an attack graph, and also includes obtaining an equivalent formula for the attack graph from front to back based on the attacker and the attacked in the attack graph.

[0007] Replace and expand the equivalent formula from left to right, perform pruning, and then perform Cartesian product to obtain the minimum cut set;

[0008] Find the intermediate expression from the equivalent formula, remove the negative terms in the intermediate expression and perform a self-check. If it contains a subset of the minimum cut set, remove the subset and perform a Cartesian product. Add the minimum cut set to obtain the minimum defense strategy.

[0009] The intermediate expression includes equivalent formulas containing negative terms.

[0010] Preferably, the method for obtaining the equivalent formula of the attack graph includes starting from the attacker in the attack graph, using outgoing edges to represent incoming edges, and repeating this step until the attacker is reached.

[0011] Preferably, the replacement process is as follows: based on the stack data structure, starting from the meta-expression of the attack graph, each edge of the attack graph is represented by an equivalent formula. The meta-expression is replaced sequentially from left to right until there are no more terms to be replaced, thus obtaining the first branch of the replaced equivalent formula; after popping the stack to the expression containing unreplaced terms, the replacement continues from left to right until all terms of the replaced expressions are replaced, thus obtaining the replaced equivalent formula.

[0012] The meta-expression refers to the sum of the outgoing edges of the attacker in the attack graph.

[0013] Preferably, the pruning process includes replacing all positive terms of the equivalence formula with non-one-to-one structures; edges in the same one-to-one structure belong to the same equivalence class, defining an equivalence class, and when edges belonging to the same equivalence class appear, directly using the Cartesian product of the remaining edges in the equivalence class except for that edge to obtain the minimum cut set.

[0014] Preferably, when a negative term appears in the replaced expression during the replacement process, the negative term is retained.

[0015] Preferably, when the replaced expression contains mutually canceling positive and negative terms, they are directly merged.

[0016] Preferably, the intermediate expression refers to the equivalent formula that still contains negative terms after replacing and merging all terms.

[0017] Preferably, the equivalent formula containing negative terms appears in many-to-one and many-to-many structures;

[0018] Negative terms represent constraints;

[0019] The constraint means that when choosing an outgoing edge to replace an incoming edge in a many-to-one or many-to-many structure, it is necessary to ensure that all other incoming edges in the incoming edge structure are replaced.

[0020] Preferably, expansion refers to expanding all combinations of edges related to the equivalence formula.

[0021] Preferably, the attack graph is an unweighted directed graph, where the attacker is the source node, the attacked node is the sink node, the other nodes besides the source and sink nodes are atomic vulnerabilities, and the edges connecting the other nodes are attack steps.

[0022] The beneficial effects of this application are as follows: This application provides a network security defense method based on the minimum cut set algorithm. It obtains the equivalent formulas of the attack graph from front to back, based on the attacker and the attacked party, thus obtaining the equivalent formulas for each edge of the entire attack graph. Using a stack data structure, these equivalent formulas are replaced from left to right to obtain all equivalent formulas from the attacker to the attacked party. This method of sequentially replacing from left to right and using the stack data structure to process the equivalent formulas significantly improves the efficiency of calculating the minimum cut set, enabling faster computation of the same attack graph and reducing the time required for attack graph computation. This allows the application to process the attack graph in real time and provide real-time security protection for the attacked party. Subsequently, redundant equivalent formulas are pruned to reduce redundancy and avoid exploring unnecessary branches, further improving the efficiency of calculating the minimum cut set and enabling faster computation of the same attack graph. From all equivalent formulas, intermediate expressions are identified, negative terms are removed, and self-checked before being added to the minimum cut set to obtain the minimum defense strategy. This approach achieves both a minimal defense strategy to protect against vulnerabilities at the lowest cost and a comprehensive consideration of all possible cut sets, ensuring no critical defense points are overlooked, providing more comprehensive security protection, preventing potential cyberattack threats, and ensuring the stable operation of critical infrastructure. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 A schematic diagram of the overall process of a cutset-based system vulnerability research method provided in an embodiment of this application;

[0025] Figure 2 The attack diagram provided for one embodiment of this application includes a block diagram of four basic structural units;

[0026] Figure 3 A schematic diagram of the attack graph provided in one embodiment of this application;

[0027] Figure 4 This is an unfolded spatial structure diagram of E2+E3+E4 provided in an embodiment of this application;

[0028] Figure 5 A schematic diagram of the unfolded trajectory of E2+E3+E4 provided in an embodiment of this application;

[0029] Figure 6 Attack provided for an embodiment of this application Figure 4 A structural diagram showing sixteen possible combinations of basic structural units;

[0030] Figure 7 This is a structural diagram of a combination method with missing solutions provided in an embodiment of this application;

[0031] Figure 8 This application provides an embodiment of an attack graph structure containing missing solutions;

[0032] Figure 9 An experimental result diagram of this application is provided for one embodiment of this application;

[0033] Figure 10 This is a test result diagram of the YTL algorithm provided in an embodiment of this application;

[0034] Figure 11 An attack graph calculated using the YTL algorithm is provided in one embodiment of this application;

[0035] Figure 12 This application provides a minimum defense strategy diagram that cannot be obtained using the YTL algorithm, as provided in one embodiment of the application.

[0036] Figure 13 This application provides an embodiment of a path graph where the YTL algorithm fails to derive missing solutions. Detailed Implementation

[0037] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0038] Please see Figure 1 A network security defense method based on the minimum cut set algorithm, provided in one embodiment of this application, includes:

[0039] S1: After obtaining vulnerability reports and network configurations using scanning tools, import them into an attack graph generation tool to generate an attack graph.

[0040] During the input phase, data preparation is performed. The generation of the attack graph requires two types of core input data, including vulnerability scan reports and network configuration information.

[0041] First, obtain vulnerability reports from the output systems of scanning tools such as Nessus, OpenVAS, or Nexpose. The vulnerability reports include known vulnerabilities (CVE numbers), CVSS scores, affected services (e.g., Apache 2.4 vulnerabilities), and exploitability of the target system.

[0042] Then, network configuration information is obtained based on firewall rules, routing tables, access control lists (ACLs), host connectivity, etc. This network configuration information includes network topology (such as subnetting), connectivity between hosts (such as allowing external access to the DMZ web server), and permission configuration (such as user permission inheritance relationships).

[0043] In the tool processing phase, rule engines and inference are performed. Taking MulVAL, an attack graph generation tool, as an example, the input data is first converted into logical facts, and then the inference engine runs. The inference is causal inference, which refers to deriving the causal relationship of attack steps based on the input facts and rules. For example, an attacker might compromise a web server (DMZ) from an external network using a vulnerability (CVE-2021-44228), and then laterally move to an internal database server (Internal Network) using a weak SSH password. During this inference process, a state space traversal is used for path discovery, traversing all possible attack paths using breadth-first search (BFS) or depth-first search (DFS) to generate an attack graph. Specifically, all possible attack paths are traversed to ensure the attack graph covers all potential attack chains. Dependencies between vulnerabilities are simulated through state transitions (e.g., gaining access using vulnerability A, and then escalating privileges using vulnerability B). This ensures the attack graph includes all possible attacker actions, avoiding omissions of critical paths. For example, in penetration testing, traversing possible states includes: unauthorized access → ordinary user privileges → local administrator privileges → domain administrator privileges. The traversal process explores the possibility of each attack step.

[0044] To avoid repetitive states (such as the same host being compromised multiple times) and optimize computational efficiency, sampling loop detection is used to avoid infinite loops and redundant calculations.

[0045] Specifically, loop detection is used to identify recurring states during state space traversal, thereby avoiding infinite loops and redundant calculations and optimizing computational efficiency. For example, when an attacker repeatedly resets a service using vulnerability C but fails to gain new privileges, loop detection will mark that state as accessed, thus avoiding repeated analysis of that state.

[0046] S2: Obtain the equivalent formula of the attack graph from front to back based on the attacker and the attacked in the attack graph.

[0047] Import the acquired attack graph containing attacker V0 and victim V11, where the attack graph includes node and edge numbers, etc., convert it into an adjacency matrix storage method for directed graphs in a computer, and then input the adjacency matrix into pre-written Python code. Please refer to [link to Python code]. Figure 3 This is a block diagram illustrating the principle of an attack graph. The attack graph is an unweighted directed graph. The attacker refers to the source vertex of the unweighted directed graph, the attacked vertex refers to the sink vertex, and all other nodes besides the source and sink vertex represent atomic vulnerabilities. Each edge represents an attack step connecting two vulnerabilities. To obtain a minimum defense strategy for the attack graph that disconnects its edges with minimal resources, it is necessary to obtain the minimum cut set of the unweighted directed graph. The minimum cut set of an unweighted directed graph is one that has no proper subset and is also a cut set. To obtain the minimum cut set and thus the minimum defense strategy, this application converts each node and edge of the attack graph into an equivalent formula.

[0048] Specifically, please refer to Figure 2 Unweighted directed graphs include four basic structural units: one-to-one, many-to-one, one-to-many, and many-to-many. Therefore, atomic vulnerabilities and attack steps in attack graphs also include these four basic structures. To obtain a minimal defense strategy, this application uses outgoing edges of atomic vulnerabilities to represent incoming edges. Therefore, when dealing with one-to-one relationships, the equivalent formula is:

[0049] E n =E n+1 ;

[0050] In the formula, E n For the incoming edge of an atomic vulnerability, E n+1 This is the outbound edge of an atomic vulnerability.

[0051] When dealing with a one-to-many relationship, the equivalence formula is:

[0052] E n =E n+1 +E n+2 ;

[0053] In the formula, E n For the incoming edge of an atomic vulnerability, E n+1 E n+2This is the outbound edge of an atomic vulnerability.

[0054] When dealing with many-to-one relationships, the equivalent formula is:

[0055] E n =E n+2 -E n+1 ;

[0056] In the formula, E n E n+1 For the incoming edge of an atomic vulnerability, E n+2 This is the outbound edge of an atomic vulnerability.

[0057] When dealing with many-to-many relationships, the equivalent formula is:

[0058] E n =E n+3 +E n+2 -E n+1 ;

[0059] In the formula, E n E n+1 For the incoming edge of an atomic vulnerability, E n+2 E n+3 This is the outbound edge of an atomic vulnerability.

[0060] Please see Figure 3 The graph obtained in this application contains multiple one-to-one, one-to-many, many-to-one, and many-to-many relationships. By using the outgoing edges of an atomic vulnerability to represent incoming edges, the equivalent formula can be obtained as follows:

[0061] E1 = E2 + E3 + E4;

[0062] E2 = E5;

[0063] E3 = E6;

[0064] E4 = E7;

[0065] E5 = E8 + E9 - E6;

[0066] E6 = E8 + E9 - E5;

[0067] E7 = E12 - E11;

[0068] E8 = E10;

[0069] E9 = E11;

[0070] E10 = E13-E12;

[0071] E11 = E12 - E7;

[0072] E12 = E13 - E10;

[0073] E13 = E14;

[0074] E14 = T;

[0075] In the attack graph of this application, the incoming edges of the attacked V11 are terminated with the character T, which is used to indicate that the attacked V11 no longer has outgoing edges.

[0076] S3: Replace the equivalent formula from left to right to obtain the replaced equivalent formula.

[0077] Specifically, based on the equivalence formula, the meta-expression is replaced sequentially from left to right until no replacement item remains. Then, an expression with unreplaced items is popped from the stack and the replacement continues until all expressions are replaced. When mutually canceling positive and negative terms appear, they are directly merged. Here, a negative term represents a constraint and is not replaced. The meta-expression refers to the sum of the attacker's outgoing edges. This application uses a depth-first replacement method. This depth-first replacement method searches deeper along each branch during the sequential replacement process to find hidden unreplaced items for replacement, ensuring the accuracy of the replacement.

[0078] Based on the equivalent formula of the attack graph above, the replacement is performed from left to right to obtain the replaced equivalent formula. The replacement process is as follows:

[0079] In an alternative embodiment, a "stack" data structure is applied to... Figure 3 The attacker E1 performs substitutions from left to right according to the equivalence formula, replacing E1 with E2+E3+E4. The next time, the attacker replaces the first term E2 in the parent expression E2+E3+E4 according to E2 = E5, resulting in E5+E3+E4. Then, the attacker replaces the first term E5 in the sub-expression E5+E3+E4 according to E5 = E8+E9-E6, resulting in E8+E9-E6+E3+E4.

[0080] It's worth noting the presence of a minus sign here. Based on the equivalent formulas for the four basic structural units mentioned above, it's easy to see that negative terms only appear when there's a "many-to-one" or "many-to-many" structure. In this case, the negative term represents a constraint: when replacing an incoming edge with an outgoing edge from a "many-to-one" or "many-to-many" structure, it must be ensured that all other incoming edges in the multiple incoming edge structures are replaced; otherwise, redundancy will occur, making it difficult to ensure the "minimum." Therefore, when encountering a negative term during this replacement process, it should not be replaced with the subsequent equivalent formulas; only positive terms should be replaced during the replacement process.

[0081] Next, according to the equivalent formula E8=E10, the first term E8 of the replaced expression E8+E9-E6+E3+E4 is replaced to obtain E10+E9-E6+E3+E4. Then, according to E10=E13-E12, the first term E10 is replaced to obtain E13-E12+E9-E6+E3+E4. According to E13=E14, the first term E13 is replaced to obtain E14-E12+E9-E6+E3+E4. Finally, according to E14=T, E14 is replaced to obtain T-E12+E9-E6+E3+E4. The appearance of T indicates that the attacked party in the attack graph has been reached, ending this cyclic replacement and marking the end of the first branch of the replacement.

[0082] Next, to find another branch, pop the stack from the above expression T-E12+E9-E6+E3+E4, returning to: E14-E12+E9-E6+E3+E4. Since E14 has already been replaced and all replacements for E14 have been searched, it will not be replaced again. The negative term only expresses one constraint that cannot be replaced, so the next term is replaced starting from E9. According to E9=E11, the expression E14-E12+E9-E6+E3+E4 is replaced with E14-E12+E11-E6+E3+E4. Then, according to E11=E12-E7, E11 is replaced to obtain E14-E12+E12-E7-E6+E3+E4.

[0083] As can be seen, the expression contains canceling positive and negative terms, indicating that the multi-input edge structure has been confirmed. For example, -E12 in the expression is introduced by E10 = E13 - E12. The reason -E12 appears repeatedly in the expression is that for the many-to-one structure of Atomic V9, it is necessary to confirm that all the input edges of Atomic V9 exist before it can be replaced with E13. For expressions that cancel each other out, they are directly merged, and the replaced terms are not replaced. The merged expression is: E14 - E7 - E6 + E3 + E4.

[0084] The next step is to replace E3 with E6 to get E14-E7-E6+E6+E4, which is then merged into E14-E7+E4. The next step is to replace E4 with E4=E7 to get E14-E7+E7, which is then merged into E14.

[0085] When a formula without negative terms is obtained, check if it is in the result of the replaced expression. If not, add it. Then pop the stack back to: E14-E12+E11-E6+E3+E4. Since E11 has already been replaced by the formula, replace E3 with E3=E6 to get E14-E12+E11+E4 (already merged). Replace E4 with E4=E7 to get E14-E12+E11+E7. Replace E7 with E7=E12-E11 and merge to get E14-E12+E11+E12-E11=E14. Since this expression does not contain negative terms, but {E14} has already been added to the result set, it is not added again. At this point, there are no more items to pop, so we continue popping from the stack until we reach the top, which is E14-E12+E11-E6+E3+E4. We then replace E3 with E3, which equals E6, to get E14-E12+E11+E4. We then replace E4 with E4, which equals E7, to get E14-E12+E11+E7. Finally, we replace E7 with E7, which equals E12-E11, to get E14-E12+E11+E12-E11=E14.

[0086] Similarly, E14 is already in the result set of the replaced expression. Next, pop the stack to E14-E12+E11-E6+E3+E4, replace E4 to get E14-E12+E11-E6+E3+E7, replace E7 and merge to get: E14-E6+E3. Since E14 and E3 have already been replaced, pop the stack directly to: E13-E12+E9-E6+E3+E4, and perform formula replacement on E9.

[0087] Repeat the above process until all terms are replaced, resulting in the equivalent formula after replacement.

[0088] S4: Expand the equivalent formula after replacement, perform pruning operations, and then perform Cartesian product to obtain the minimum cut set.

[0089] Specifically, the equivalent formula obtained after substitution is expanded, and "()" is defined as the expansion space of a certain side, that is, all the expansion terms of a certain side. Then (E2) refers to all expansions of E2, including: E5, E8+E9-E6, E10+E9-E6, E13-E12+E9-E6, E14-E12+E9-E6, E14-E12+E11-E6, E14-E7-E6, E14-E12+E12-E7-E6, E13-E12+E11-E6, E13-E 7-E6, E13-E12+E12-E7-E6, E10+E11-E6, E10+E12-E7-E6, E13-E7-E6, E10+E13- E10-E7-E6, E8+E11-E6, E8+E12-E7-E6, E8+E13-E10-E7-E6, E8+E14-E10-E7-E6.

[0090] The process of expanding the expression from left to right using a stack, as described above, is actually representing E2 using all combinations of edges related to E2. In this application, Ei-j represents the j-th expanded combination of edge i, and |(E2)| is the number of combinations in the expanded space of E2.

[0091] Taking E2+E3+E4 as an example, the expansion space is obtained as follows: Figure 4 As shown, its unfolding trajectory is as follows Figure 5 As shown. It can be seen that the expanded space is a Cartesian product of (E2), (E3) and (E4), i.e., (E2)×(E3)×(E5). Therefore, the size of the expanded space is: |(E2)| * |(E3)|*|(E5) |.

[0092] After expanding and replacing the equivalent formula, a pruning operation is performed on the expanded equivalent formula. This application uses a sinking operation to prune the expanded and replaced equivalent formula. The sinking operation is a pruning operation performed without changing the original expansion space. The specific operation process includes sinking all positive terms of the equivalent formula to non-"one-to-one" structures. When edges in the same "one-to-one" structure are in the same equivalence class, an equivalence class EC1 is defined. When an edge equivalent to it appears, the Cartesian product of equivalence class EC1 and all other edges except that edge is directly used to obtain the minimum cut set.

[0093] In an optional embodiment, the equivalent formula E2+E3+E4 is used for the bottoming operation. When E2=E5 and E3=E6, the expanded spaces (E2)×(E3)×(E4) and (E5)×(E3)×(E4) of E2+E3+E4 and E5+E3+E4 are similar because E2 will be replaced by E5, so the expanded spaces are exactly the same. At the same time, E5 and E2 have a one-to-one structure, so E2 and E5 can be replaced at any time. Furthermore, because the equivalent formula in this application is represented by using outgoing edges to represent incoming edges, there will be no negative terms of E2 in (E3)×(E4), so they can be directly replaced.

[0094] Once the expression E2+E3+E4 is obtained, a search is performed directly on E5+E3+E4. Simultaneously, to ensure no solutions are missed later, if the minimum cut set obtained during the replacement of E5+E3+E4 contains E5, E5 is directly replaced with E2 to obtain a new minimum cut set.

[0095] Therefore, the bottoming operation can merge those one-to-one structures that can be directly replaced, thus reducing the expansion space. Therefore, after replacing E1 to obtain E2+E3+E4, the bottoming operation can be directly performed on each item to obtain E5+E6+E7. When a result is obtained later, it is only necessary to replace E5 with E2, E6 with E3, and E7 with E4 in the obtained minimum cut set to obtain a new minimum cut set.

[0096] In an optional embodiment, for multiple "one-to-one" structures connected in series, if there exists an equivalence formula for a graph: E2=E5=E6=E7=E8, all edges appearing in the equivalence formula (E2 or any one of E2, E6, E7) are directly "sinked" into E8. Then, whenever E8 appears in the minimum cut set, it can be replaced by E2~E7. An "equivalence class" is established, where edges within the same "one-to-one" structure belong to the same equivalence class. For example, {E2, E5, E6, E7, E8} belongs to the same equivalence class EC1. When a minimum cut set is obtained later and E8 is detected, a new minimum cut set can be obtained by performing a Cartesian product of EC1 and other edges.

[0097] By performing a bottoming operation on all equivalent formulas and then taking a Cartesian product, we obtain the minimum cut set, as shown in the following equation:

[0098] {(0, 1)}

[0099] {(1, 2), (1, 3), (4, 8)}

[0100] {(1, 2), (1, 3), (1, 4)}

[0101] {(4, 8), (1, 2), (3, 5)}

[0102] {(1, 4), (1, 2), (3, 5)}

[0103] {(2, 5), (1, 3), (4, 8)}

[0104] {(2, 5), (1, 3), (1, 4)}

[0105] {(4, 8), (2, 5), (3, 5)}

[0106] {(1, 4), (2, 5), (3, 5)}

[0107] {(4, 8), (6, 9), (7, 8)}

[0108] {(1, 4), (6, 9), (7, 8)}

[0109] {(4, 8), (6, 9), (5, 7)}

[0110] {(1, 4), (6, 9), (5, 7)}

[0111] {(4, 8), (5, 6), (7, 8)}

[0112] {(1, 4), (5, 6), (7, 8)}

[0113] {(4, 8), (5, 6), (5, 7)}

[0114] {(1, 4), (5, 6), (5, 7)}

[0115] {(9, 10)}

[0116] {(10, 11)}

[0117] {(8, 9), (6, 9)}

[0118] {(8, 9), (5, 6)}

[0119] Where ( ) represents the expansion space of a certain side, and (n, m) represents the attack steps of atomic vulnerability n and atomic vulnerability m.

[0120] S5: Based on the basic structural units containing negative terms in the equivalent formula, find the solutions containing negative terms in the intermediate expressions, remove the negative terms to obtain the missing solutions, and then perform self-checking. If it contains a subset of the minimum cut set, remove the subset and perform a Cartesian product, then incorporate it into the minimum cut set to obtain the minimum defense strategy.

[0121] Specifically, please refer to Figure 6 This application is an attack. Figure 4 Sixteen combinations of basic structural units. Among them, the combinations with missing solutions include... Figure 7 The four structures are: g (one-to-many + many-to-one); h (one-to-many + many-to-many); o (many-to-many + many-to-one); p (many-to-many + many-to-many).

[0122] The missing solutions correspond to the four missing minimal cut sets {E1, E5}, {E1, E5, E6}, {E1, E2, E6}, and {E1, E2, E6, E7}, respectively. These four missing minimal cut sets have the following characteristics: For g (one-to-many + many-to-one), E5 needs to be replaced by E1; for h (one-to-many + many-to-many), {E5, E6} needs to be replaced by E1; for o (many-to-many + many-to-one), E6 needs to be replaced by {E1, E2}; and for p (many-to-many + many-to-many), {E6, E7} needs to be replaced by {E1, E2}.

[0123] In the previous process of obtaining the minimum cut set, the edges that were replaced and those obtained through replacement were merged because they canceled out each other's positive and negative terms, so they could not appear in the result at the same time. Furthermore, intermediate expressions containing negative terms that were not considered minimum cut sets were omitted, resulting in missing solutions. This meant that some minimum defense strategies were not found in the obtained attack graph, creating a security risk.

[0124] Therefore, in order to obtain the missed minimum cut sets and comprehensively acquire the minimum defense strategy for the attack graph, this application analyzes the aforementioned missed solutions and finds that: During the algorithm's calculation process, many intermediate expressions that are not minimum cut sets are generated. These expressions cannot be merged, resulting in expressions containing negative signs. Furthermore, expressions containing negative terms are not considered minimum cut sets, leading to missed solutions.

[0125] Specifically, the attack graph for the missing solutions {E1, E5, E6} is as follows: Figure 8As shown, the equivalent formulas are as follows: E1 = E2 + E3; E3 = E5 + E6 - E4; E4 = E5 + E6 - E3; the meta-expression is: E1 + E4; substituting E1 yields: E2 + E3 + E4; since E2 cannot be replaced, E3 is replaced to obtain: E2 + E5 + E6 - E4 + E4; merging yields: E2 + E5 + E6; since E2, E5, and E6 cannot be replaced, E1 + E4 is popped from the stack. Since E1 has been replaced, E4 is replaced to obtain: E1 + E5 + E6 - E3; since E1, E5, and E6 cannot be replaced, E1 + E4 is popped from the stack. This expression has been replaced, and the stack is popped until empty, ending this loop. It can be seen that the obtained E1 + E5 + E6 - E3 cannot be merged, thus producing a negative term. And E1 + E5 + E6 is exactly... Figure 8 The minimum cut set, i.e. the missing solution {E1, E5, E6} mentioned above, is the missing solution that the attack graph missed when an intermediate expression that cannot be combined and contains negative terms is removed. This allows for a comprehensive consideration of all possible cut sets, ensuring that no critical defense points are overlooked and providing more comprehensive security protection.

[0126] This application defines an intermediate expression as the equivalent formula in which negative terms still exist after substituting and merging all terms. All missing solutions are searched within the intermediate expression. The specific implementation process includes:

[0127] In an optional embodiment, two sets are known, wherein set A is the set of minimum cut sets (set of sets) calculated in the equivalent formula, and set B is the set of edge cut sets (set of sets) obtained by processing the intermediate expression, wherein a part of the set is a minimum cut set and the other part is an edge cut set but not a minimum cut set.

[0128] To find any missing solutions in set B (the set of sets), we start with set B and remove sets that contain any element from set A, resulting in set C. To ensure that each set in set C is as small and independent as possible, set C performs a self-check: if any set in set C is a subset of another set R in set C, then that subset is removed from set C. After this step, the resulting new set is called set D (the set of sets). Then, an empty set E is created. If each element d in set D is not in set E, the Cartesian product of elements d is added to set E. Finally, set E is directly merged into the result set. Here, each element d in set D represents a set.

[0129] Using the above method of finding missing solutions, we can find... Figure 3The missing solutions in the graph are as follows: {(8, 9), (2, 5), (3, 5)}, {(1, 2), (8, 9), (1, 3)}, {(8, 9), (2, 5), (1, 3)}, and {(1, 2), (8, 9), (3, 5)}. These missing solutions are then incorporated into the obtained minimum cut set to obtain the attack graph. Figure 3 The minimum cut sets of the attack graph are used to obtain the minimum defense strategy.

[0130] Specific Implementation Example 1: Comparison Experiment of This Application with Other Algorithms

[0131] The minimum defense strategy for attack graphs is obtained simultaneously using the algorithm proposed in this application and the YTL algorithm. The experimental results of this application are as follows: Figure 9 As shown. The meanings of the English characters in the image are:

[0132] The modified total runtime of the run_time algorithm (including the following four time items);

[0133] The deal_time algorithm takes time to preprocess the graph, i.e., the time to generate the formula.

[0134] until_stack_time is the total time of the original algorithm (with missing solutions);

[0135] The total time for the pop stack process in the stack_time algorithm;

[0136] The result_deal_time is the extra time the algorithm spends to find missing solutions;

[0137] result_length is the minimum total number of cut sets;

[0138] node_num: Total number of nodes in the graph;

[0139] The test results of the YTL algorithm are as follows: Figure 10 As shown in the figure. It can be seen from the graph that the algorithm takes too long to run, and after reproducing the problem, it was found that for... Figure 11 Many minimum cut sets cannot be derived using the YTL algorithm. Specific minimum defense strategies that cannot be derived include... Figure 12 As shown. For example, {(2, 3), (1, 7), (2, 5), (1, 6), (0, 3), (0, 6)} is... Figure 13The highlighted part is shown in red. According to the YTL algorithm, the cut set is formed by X = {0, 1, 2}. However, this situation cannot occur during the calculation of the YTL algorithm. The reason is that the YTL algorithm stipulates that when a point is added to the set, the tail endpoints of all its incoming edges have been added to X. To add V2, V6 must be added first; to add V6, V1 must be added first. Among them, the cut set generated by V1 is {E5, E8, E4, E2, E3}, and the cut sets generated by V1 and V0 for V6 are: {E8, E6, E9, E2, E3}, {E1, E6, E9, E2, E3}. Therefore, it can be seen that the cut set generated by V2 from V0 and V6 cannot obtain {(2, 3), (1, 7), (2, 5), (1, 6), (0, 3), (0, 6)}. Therefore, the YTL algorithm cannot find all the minimum defense strategies, which poses a security risk.

[0140] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0141] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A network security defense method based on the minimum cut set algorithm, comprising scanning the system to obtain vulnerability reports and network configurations, and generating an attack graph, characterized in that, It also includes an equivalent formula for obtaining the attack graph from front to back based on the attacker and the attacked in the attack graph; The equivalent formula is replaced and expanded from left to right, pruned, and then Cartesian product is performed to obtain the minimum cut set; Find the intermediate expression from the equivalent formula, remove the negative terms in the intermediate expression and perform a self-check. If it contains a subset of the minimum cut set, remove the subset and perform a Cartesian product. Add the subset to the minimum cut set to obtain the minimum defense strategy. The intermediate expression includes the equivalent formula containing negative terms; The method of obtaining the equivalent formula of the attack graph includes starting from the attacker in the attack graph, using outgoing edges to represent incoming edges, and repeating this step until the attacked is reached; The replacement process is as follows: based on the stack data structure, starting from the meta-expression of the attack graph, each edge of the attack graph is represented by the equivalent formula, and the meta-expression is replaced sequentially from left to right until there are no more items to replace, thus obtaining the first branch of the replaced equivalent formula. After popping the stack to an expression containing unreplaced terms, continue replacing from left to right until all terms of the replaced expression are replaced, resulting in the equivalent formula after replacement. The meta-expression refers to the sum of the outgoing edges of the attacker in the attack graph; The pruning process includes replacing all positive terms of the equivalence formula with non-one-to-one structures; edges in the same one-to-one structure are in the same equivalence class, the equivalence class is defined, and when an edge belonging to the same equivalence class appears, the Cartesian product of the remaining edges in the equivalence class except for that edge is directly used to obtain the minimum cut set; When a negative term appears in the replaced expression during the replacement process, the negative term is retained. When the replaced expression contains mutually canceling positive and negative terms, they are directly merged.

2. The network security defense method based on the minimum cut set algorithm as described in claim 1, characterized in that, The intermediate expression refers to the equivalent formula that still contains negative terms after replacing and merging all terms.

3. The network security defense method based on the minimum cut set algorithm as described in claim 2, characterized in that, The equivalent formula containing negative terms appears in many-to-one and many-to-many structures; The negative terms represent constraints; The constraint means that when the outgoing edge of the many-to-one or many-to-many structure is selected to replace the incoming edge, it is necessary to ensure that all other incoming edges of the incoming edge structure are replaced.

4. The network security defense method based on the minimum cut set algorithm as described in claim 3, characterized in that, The expansion refers to expanding all combinations of edges related to the equivalence formula.

5. The network security defense method based on the minimum cut set algorithm as described in claim 4, characterized in that, The attack graph is an unweighted directed graph. The attacker refers to the source node, the attacked node refers to the sink node, and the other nodes besides the source and sink nodes refer to atomic vulnerabilities. The edges connected to the other nodes are the attack steps.

Images