Flexible grayscale adaptive data association analysis system based on attack link

Abstract

The invention discloses a flexible grayscale adaptive data association analysis system based on an attack link, which relates to the technical field of attack link association analysis, and is characterized in that a rule matching unit is used for giving weight scores to attack nodes formed by combining a plurality of collected attack nodes in pairs according to a rule at least comprising one association item; adding the weight scores obtained according to different rules to obtain an association score of the attack node group, and marking associated segmented words exceeding a set value as an association node group; meanwhile, the association node groups are integrated through a group chain unit, and the association node groups with association form a plurality of attack links comprising a plurality of branch chains according to the sequence of occurrence of the association node groups; according to the method, attack nodes occurring in a period of time can be effectively captured, and an attack link is specifically formed, so that network personnel can better analyze a security policy and formulate a proper protection method; the method is simple, effective, easy and practical.

Description

Technical Field

[0001] The present invention belongs to the technical field of attack link association analysis, and in particular to a flexible grayscale adaptive data association analysis system based on attack links. Background Art

[0002] Patent publication number CN116208416A discloses a method and system for mining attack links in the Industrial Internet. The method includes: establishing a vulnerability set based on the device information of the Industrial Internet; evaluating the risk correlation between the devices in the Industrial Internet system based on the vulnerability set, and constructing a risk association graph based on the evaluation results; dividing the node set of the risk association graph according to preset node levels, and mining reachable attack links from the association risk graph based on the division results to generate a set of alternative attack links; calculating the implementation cost of each alternative attack link, screening out alternative attack links whose implementation cost exceeds a preset threshold, and generating feasible attack links for the Industrial Internet system. The present invention can accurately mine and evaluate high-threat attack links in the Industrial Internet system, helping technicians to protect the information of the Industrial Internet system and improve the level of network security protection.

[0003] However, there is a lack of an effective way to form a good attack chain for different attack nodes, and it can form an attack chain based on past situations. Based on this, a solution is provided. Summary of the Invention

[0004] The present invention aims to solve at least one of the technical problems existing in the prior art;

[0005] To this end, the present invention proposes a flexible grayscale adaptive data association analysis system based on attack links, including:

[0006] A rule matching unit is used to assign weight scores to attack nodes formed by combining two or more of the collected attack nodes according to a rule containing at least one association, add the weight scores obtained according to different rules to obtain an association score for the attack node group, and mark those with an association segment exceeding a set value as an associated node group;

[0007] The association rule means that the time interval between two attack nodes in any attack node group is within the interval range; several historical intervals are determined based on the time intervals between two consecutive attack nodes in several previously determined attack links, and the interval range is determined based on the data dispersion of the historical intervals;

[0008] A chain unit is used to integrate the associated node groups and form several attack chains containing several branches with the associated node groups according to the order in which the associated node groups appear.

[0009] The existence of association in the associated node group means that there is at least one identical node in the associated node group.

[0010] Furthermore, it also includes a data collection unit for extracting attack information including attack nodes and attack time from network traffic logs, terminal behavior data, and threat intelligence database.

[0011] Furthermore, the rule matching unit is also used to assign weight scores to the attack node groups in combination with the behavioral rules. The behavioral rules are that if there is a connection between two attack nodes in the attack node group, the corresponding attack node group correlation is assigned a weight score. Here, the weight score is X2, and X2 is a preset value; the existence of a connection refers to the corresponding two attack nodes being in the front and back positions in the previous attack chain.

[0012] Furthermore, the rule matching unit is also used to assign weight scores to the attack node group in combination with the coherence rule. The coherence rule is that if event A creates event B, and event B accesses the set sensitive registry, a weight score of X3 is assigned, where X3 is a preset value.

[0013] Furthermore, the interval range is specifically determined as follows:

[0014] For several historical intervals, the difference between the historical interval and its mean is not more than the preset value X4, which is used as the screening condition. Those that do not meet the condition are eliminated, and then the screening is continued until all historical intervals meet the screening condition. The out-of-frame ratio representing the proportion of the number of eliminated historical intervals to the total number of historical intervals is obtained. If the out-of-frame ratio does not exceed the set ratio, the range from the minimum to the maximum value of the historical intervals that are not eliminated is marked as the interval range.

[0015] Furthermore, if the out-of-frame ratio exceeds the set ratio, all historical interval data are automatically obtained, and the historical intervals that are smaller than the median of the mean and minimum values of the historical interval data are marked as average-low values, and several average-low values constitute an average-low data segment;

[0016] Similarly, the historical intervals that are greater than the mean and the median of the maximum values of the historical interval data are marked as above-average values, and several above-average values constitute an above-average data segment;

[0017] The lower limit value and the upper limit value of the interval range are determined according to the discrete degree of the data in the average lower data segment and the average upper data segment to obtain the interval range.

[0018] Furthermore, the lower limit and upper limit of the interval range are determined in the following manner:

[0019] Get all the average values in the average data segment and automatically calculate the deviation value W of all the average values. The calculation formula is:

[0020] ;

[0021] In the formula, Pj refers to all mean values, which means there are m mean values, m≤n, and U is the mean value corresponding to Pj;

[0022] If the W value exceeds the preset value X5, the minimum value at this time is marked as the lower limit value of the corresponding interval range; otherwise, the mean value of Pj is marked as the lower limit value of the corresponding interval range;

[0023] Perform the same processing on the average upper value in the average upper data segment to obtain the upper limit value, and thus obtain the interval range.

[0024] Furthermore, when the chain unit integrates the nodes in the associated node group to form an attack link,

[0025] If the same nodes exist in any associated node group, the nodes are arranged in the order in which they appear in the associated node group to form an attack chain. If any different nodes have the same order in the associated node group, a branch of the attack chain is formed.

[0026] The same sequence position means that the corresponding different nodes are at the front end or the back end of different nodes in different associated node groups at the same time.

[0027] Furthermore, if different nodes in any associated node group obtained by subsequent combination of the branch chains appear in the attack chain, the nodes of the branch chains are integrated into the attack chain in chronological order.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] The present application assigns weighted scores to attack nodes formed by combining two or more of the collected attack nodes according to a rule containing at least one association, adds the weighted scores obtained according to different rules to obtain the association score of the attack node group, and marks the associated segmented words exceeding the set value as an associated node group; at the same time, the associated node groups are integrated by the chaining unit, and the associated associated node groups are formed into several attack chains containing several branches according to the order in which the associated node groups appear.

[0030] It can effectively capture attack nodes that occur within a period of time and form targeted attack links, which is convenient for network personnel to better analyze security strategies and formulate appropriate protection methods. The present invention is simple, effective, and easy to use. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a system block diagram of the present invention. DETAILED DESCRIPTION

[0032] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0033] See also Figure 1 ,This application provides a flexible grayscale adaptive data association analysis system based on attack links;

[0034] As the first embodiment of the present application, it specifically includes:

[0035] A rule matching unit is used to assign weight scores to attack nodes formed by combining two or more of the collected attack nodes according to a rule containing at least one association, add the weight scores obtained according to different rules to obtain an association score for the attack node group, and mark those with an association segment exceeding a set value as an associated node group;

[0036] The association rule means that the time interval between two attack nodes in any attack node group is within the interval range; several historical intervals are determined based on the time intervals between two consecutive attack nodes in several previously determined attack links, and the interval range is determined based on the data dispersion of the historical intervals;

[0037] A chain unit is used to integrate the associated node groups and form several attack chains containing several branches with the associated node groups according to the order in which the associated node groups appear.

[0038] The existence of association in the associated node group means that there is at least one identical node in the associated node group.

[0039] As the second embodiment of the present application, it specifically includes:

[0040] The data collection unit is used to extract attack information from network traffic logs, terminal behavior data, and threat intelligence libraries. The attack information includes attack nodes and attack times. Here, attack nodes refer to specific attack events. The rule matching unit is used to perform rule matching on the acquired attack nodes. The specific rule matching is as follows:

[0041] First, perform association rule matching. The association rules are:

[0042] The attack nodes are combined in pairs to obtain a number of node groups formed by combining two attack nodes. The node groups formed here are constructed in chronological order.

[0043] Assign an initial grayscale value to each node group. The grayscale value represents the correlation confidence between two node groups in the node group. The initial value of the correlation confidence is a set value, which can generally be 0 or 100.

[0044] Then select any node group and apply rule adaptation to it. The specific conditions of rule adaptation are as follows:

[0045] If the occurrence time of two attack nodes in the node group is within the set time interval, the correlation between the two nodes is assigned a corresponding weight score. Here, the weight score is X1 multiplied by B1. X1 is a preset value, generally 30, but can also be other values set by the administrator. The value of B1 is based on;

[0046] The specific method for determining the interval range here is:

[0047] Obtain all confirmed attack links that are associated, obtain two random consecutive attack nodes from the attack links, and mark them as a historical node group;

[0048] Get the interval time of all historical node groups, mark them as historical intervals, get several historical intervals Li, i = 1, ..., n, indicating that there are n historical intervals, and get the mean value P of Li;

[0049] Then use the filter box to filter Li, the filter condition is |Li-P|≤X4, X4 is the set value;

[0050] Obtain the historical intervals that do not meet the screening conditions, filter them out, and then use the same method to filter the remaining historical intervals again. If there are still historical intervals that do not meet the screening conditions, continue filtering until all the remaining historical intervals meet the corresponding screening conditions.

[0051] Obtain the number of items that do not meet the screening conditions, divide it by n, and obtain the value marked as the out-of-frame ratio. When the out-of-frame ratio does not exceed the preset ratio, the remaining Li minimum to maximum values are marked as the interval range;

[0052] If it exceeds the preset ratio, the average lower data segment and the average upper data segment in the original data Li are automatically obtained. Here, the average lower data segment refers to first obtaining the median of the mean and the minimum value in Li, marking all data less than the median as the average lower data segment, and marking the data in the average lower data segment as the average lower value. Similarly, the data in Li that exceeds the median of the mean and the maximum value are marked as the average upper value, and the average upper values constitute the average upper data segment;

[0053] Get all the average values in the average data segment and automatically calculate the deviation value W of all the average values. The calculation formula is:

[0054] ;

[0055] In the formula, Pj refers to all mean values, which means there are m mean values, m≤n, and U is the mean value corresponding to Pj;

[0056] If the W value exceeds the preset value X5, the minimum value at this time is marked as the lower limit value of the corresponding interval range; otherwise, the mean value of Pj is marked as the lower limit value of the corresponding interval range;

[0057] The same process is performed on the average value in the average data segment. If the W value exceeds X5 during this process, the maximum value in the average data segment is marked as the upper limit value of the corresponding interval range. Otherwise, the average value in the average data segment is still marked as the upper limit value of the corresponding interval range.

[0058] Get a determined interval range;

[0059] If the occurrence time of the two attack nodes here is within the set time interval, then let B1 take the value of 1; if the occurrence time of the two attack nodes is above the set interval range, then B1 is 0; if the real-time interval time between the two attack nodes is below the interval range, then divide the real-time interval time by the maximum value of the interval range, and the resulting value is marked as the corresponding B1 value.

[0060] Then perform the same process on all node groups to obtain the weight scores of all node groups;

[0061] Then, any node group is processed using the following two rules to obtain the corresponding weight score;

[0062] Behavior rules: If two events are related before and after, the correlation between the two events is assigned a weight score. Here, the weight score is X2, where X2 is a preset value, usually 45. The correlation between two events refers to any two events being in the previous attack chain.

[0063] Coherence rule: if event A creates event B, and event B accesses the set sensitive registry, then a weight score of X3 is assigned, where X3 is a preset value, typically 35.

[0064] Get the weight scores of any node group, add them up, and mark the sum as the association score of the corresponding node group;

[0065] Mark nodes with association scores exceeding the set value as association node groups;

[0066] The chain unit is used to integrate the associated node groups in the following ways:

[0067] If there is an intersection between any associated node groups, an attack chain is constructed as follows:

[0068] Get all associated node groups, select any one of them, and mark them as node A or node B in order;

[0069] If there are other associated node groups such as Node B and Node C, the attack chain formed by integration is: Node A, Node B, Node C;

[0070] If there is a related node group consisting of node D and node A, the attack chain formed by integration is: node D, node A, node B, node C;

[0071] Arrange attack chain 1 in a sequential order. If there are parallel nodes, such as nodes B and E, we will check whether node E exists in attack chain 1. If so, we will not process it. If not, we will form a branch chain at node B and check whether node E appears in the remaining associated node groups. If so, we will automatically obtain another node in the associated node group. If the other node is in attack chain 1, we will insert node E into attack chain 1 according to the occurrence time. Otherwise, we will place the other node after or before node E in the branch chain. Here, we arrange them in chronological order.

[0072] Subsequent straight chains are processed in the same way as attack chain one. If any subsequent node of the branch chain is the same as attack chain one, the branch chain is merged into attack chain one in chronological order. If it does not exist, attack chain one with several branches is formed.

[0073] Perform the same process on the remaining associated node groups to obtain all attack links with several branches;

[0074] The chain grouping unit is used to transmit all attack links with a plurality of branches to the display unit. The display unit receives all corresponding attack links with a plurality of branches and displays them in real time.

[0075] As the third embodiment of the present application, this embodiment is implemented on the basis of the second embodiment. The difference is that, in this embodiment, when matching the association scores of different attack node groups according to the association rules, behavior rules, and coherence rules, only one association rule can be used, or the association rule can be used and then any one of the behavior rules and coherence rules can be selected to obtain the association score.

[0076] Some of the data in the above formula are calculated by removing the dimensions and taking their numerical values. The formula is a formula that is closest to the actual situation obtained by software simulation of a large amount of collected data; the preset parameters and preset thresholds in the formula are set by technical personnel in this field according to actual conditions or obtained through simulation of a large amount of data.

[0077] The above embodiments are only used to illustrate the technical method of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A flexible grayscale adaptive data association analysis system based on attack links, characterized by: include: A rule matching unit is used to assign weight scores to attack nodes formed by combining two or more of the collected attack nodes according to a rule containing at least one association, add the weight scores obtained according to different rules to obtain an association score for the attack node group, and mark those with an association segment exceeding a set value as an associated node group; The association rule means that the time interval between two attack nodes in any attack node group is within the interval range; several historical intervals are determined based on the time intervals between two consecutive attack nodes in several previously determined attack links, and the interval range is determined based on the data dispersion of the historical intervals; A chain unit is used to integrate the associated node groups and form several attack chains containing several branches with the associated node groups according to the order in which the associated node groups appear. The existence of association in the associated node group means that there is at least one identical node in the associated node group.

2. The attack link-based flexible grayscale adaptive data association analysis system according to claim 1 is characterized in that: It also includes a data collection unit for extracting attack information including attack nodes and attack time from network traffic logs, terminal behavior data, and threat intelligence libraries.

3. The attack link-based flexible grayscale adaptive data association analysis system according to claim 1 is characterized in that: The rule matching unit is also used to assign weight scores to the attack node group in combination with the behavioral rules. The behavioral rule is that if there is a connection between two attack nodes in the attack node group, the corresponding attack node group correlation will be assigned a weight score. Here, the weight score is X2, where X2 is a preset value; the existence of a connection refers to the corresponding two attack nodes being in the front and back positions in the previous attack chain.

4. The attack link-based flexible grayscale adaptive data association analysis system according to claim 1 is characterized in that: The rule matching unit is also used to assign weight scores to the attack node group in combination with the coherence rule. The coherence rule is that if event A creates event B, and event B accesses the set sensitive registry, a weight score of X3 is assigned, where X3 is a preset value.

5. The attack link-based flexible grayscale adaptive data association analysis system according to claim 1 is characterized in that: The specific method for determining the interval range is: For several historical intervals, the difference between the historical interval and its mean is not more than the preset value X4, which is used as the screening condition. Those that do not meet the condition are eliminated, and then the screening is continued until all historical intervals meet the screening condition. The out-of-frame ratio representing the proportion of the number of eliminated historical intervals to the total number of historical intervals is obtained. If the out-of-frame ratio does not exceed the set ratio, the range from the minimum to the maximum value of the historical intervals that are not eliminated is marked as the interval range.

6. The attack link-based flexible grayscale adaptive data association analysis system according to claim 5 is characterized in that: If the out-of-frame ratio exceeds the set ratio, all historical interval data will be automatically obtained, and the historical intervals that are smaller than the mean and the median of the minimum value of the historical interval data will be marked as average-low values. Several average-low values constitute the average-low data segment. Similarly, the historical intervals that are greater than the mean and the median of the maximum values of the historical interval data are marked as above-average values, and several above-average values constitute an above-average data segment; The lower limit value and the upper limit value of the interval range are determined according to the discrete degree of the data in the average lower data segment and the average upper data segment to obtain the interval range.

7. The attack link-based flexible grayscale adaptive data association analysis system according to claim 5 is characterized in that: The specific method for determining the lower limit and upper limit of the interval range is: Get all the average values in the average data segment and automatically calculate the deviation value W of all the average values. The calculation formula is: ； In the formula, Pj refers to all mean values, which means there are m mean values, m≤n, and U is the mean value corresponding to Pj; If the W value exceeds the preset value X5, the minimum value at this time is marked as the lower limit value of the corresponding interval range; otherwise, the mean value of Pj is marked as the lower limit value of the corresponding interval range; Perform the same processing on the average upper value in the average upper data segment to obtain the upper limit value, and thus obtain the interval range.

8. The attack link-based flexible grayscale adaptive data association analysis system according to claim 1 is characterized in that: When the chain unit integrates the nodes in the associated node group to form an attack link, If the same nodes exist in any associated node group, the nodes are arranged in the order in which they appear in the associated node group to form an attack chain. If any different nodes have the same order in the associated node group, a branch of the attack chain is formed. The same sequence position means that the corresponding different nodes are at the front end or the back end of different nodes in different associated node groups at the same time.

9. The attack link-based flexible grayscale adaptive data association analysis system according to claim 8 is characterized in that: If different nodes in any associated node group obtained by subsequent combination of branches appear in the attack chain, then each node of the branch chain will be integrated into the attack chain in chronological order.

Images