Network attack graph generation method and device, equipment and storage medium

Abstract

The invention discloses a network attack graph generation method and device, equipment and a storage medium, and the method comprises the steps: obtaining a network topological graph corresponding to a target network, and determining a plurality of candidate attack paths corresponding to the target network according to the network topological graph; determining a target attack path in the candidate attack paths according to an access constraint condition and a defense constraint condition corresponding to the network topological graph; wherein the access constraint condition is that the candidate attack path does not comprise a predetermined access forbidding edge, and the defense constraint condition is that the candidate attack path does not comprise a predetermined defense edge; and according to the target attack path, generating the network attack graph corresponding to the target network, thereby preventing the generated network attack graph from containing a large number of invalid redundant paths, and improving the practicability of the network attack graph.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network attack graph generation method, device, equipment and storage medium. Background Art

[0002] As the complexity, stealth and harmfulness of cyber attacks have increased significantly, new threats such as advanced persistent threats, multi-step coordinated attacks and supply chain attacks continue to break through the boundaries of traditional passive defense. More and more companies and institutions are beginning to use network attack graphs as a core technical means to systematically analyze network security threats and support proactive defense decisions.

[0003] In existing technologies, network attack paths that attackers may exploit are typically constructed based on the interdependencies and propagation conditions between vulnerabilities, and a network attack graph is generated based on the constructed network attack paths. For example, a Bayesian network model can be used to calculate the probability of each network attack path, combining the likelihood of vulnerability occurrence and the impact relationship between vulnerabilities. A network attack graph is then generated based on network attack paths with a probability exceeding a preset probability threshold.

[0004] However, since existing technologies only focus on the dependencies and propagation conditions between vulnerabilities, some network attack paths generated by existing technologies are often impossible to implement, resulting in a large number of unrealistic redundant paths in the generated network attack graphs. This makes it difficult for network security managers to screen out truly risky network attack paths from network attack graphs containing a large number of redundant paths, thereby reducing the reference value of network attack graphs in network security protection. Summary of the Invention

[0005] The present invention provides a network attack graph generation method, apparatus, device and storage medium, which avoids the generated network attack graph from containing a large number of invalid redundant paths and improves the practicality of the network attack graph.

[0006] In a first aspect, an embodiment of the present invention provides a method for generating a network attack graph, the method comprising:

[0007] Obtaining a network topology map corresponding to the target network, and determining multiple candidate attack paths corresponding to the target network based on the network topology map;

[0008] Determine the target attack path from among the candidate attack paths based on the access constraints and defense constraints corresponding to the network topology diagram;

[0009] Among them, the access constraint condition is that the candidate attack path does not include the predetermined prohibited access edge, and the defense constraint condition is that the candidate attack path does not include the predetermined defense edge;

[0010] Based on the target attack path, a network attack graph corresponding to the target network is generated.

[0011] In a second aspect, an embodiment of the present invention further provides a network attack graph generating device, the device comprising:

[0012] A candidate path determination module is used to obtain a network topology corresponding to the target network and determine multiple candidate attack paths corresponding to the target network based on the network topology;

[0013] a target path determination module, configured to determine a target attack path from among candidate attack paths based on access constraints and defense constraints corresponding to the network topology;

[0014] Among them, the access constraint condition is that the candidate attack path does not include the predetermined prohibited access edge, and the defense constraint condition is that the candidate attack path does not include the predetermined defense edge;

[0015] The attack graph generation module is used to generate a network attack graph corresponding to the target network according to the target attack path.

[0016] In a third aspect, an embodiment of the present invention further provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network attack graph generation method provided in any embodiment of the present invention.

[0017] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a processor to implement the network attack graph generation method provided by any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention determines the target attack path from multiple candidate attack paths corresponding to the target network through access constraints and defense constraints corresponding to the network topology diagram, and generates a network attack graph corresponding to the target network based on the target attack path. It solves the problem that the existing technology only focuses on the dependencies and propagation conditions between vulnerabilities, resulting in a large number of unrealistic redundant paths in the generated network attack graph, making it difficult for network security managers to use network attack graphs containing a large number of invalid redundant paths for effective security risk management. It avoids the inclusion of a large number of invalid redundant paths in the generated network attack graph, thereby improving the practicality of the network attack graph.

[0019] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 This is a flowchart of a method for generating a network attack graph according to the first embodiment of the present invention;

[0022] Figure 2 This is a flowchart of another method for generating a network attack graph according to the second embodiment of the present invention;

[0023] Figure 3 This is a flowchart of a preferred method for generating a network attack graph according to an embodiment of the present invention;

[0024] Figure 4 This is a schematic diagram of the structure of a network attack graph generating device provided according to the third embodiment of the present invention;

[0025] Figure 5 It is a structural diagram of an electronic device provided by the fourth embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Example 1

[0029] Figure 1 This is a flowchart of a network attack graph generation method provided according to Example 1 of the present invention. This embodiment is applicable to situations where a network attack graph is generated. The method can be executed by a network attack graph generation device. The network attack graph generation device can be implemented in the form of hardware and / or software. The network attack graph generation device can be configured in an electronic device such as a computer.

[0030] like Figure 1 As shown, the present embodiment discloses a method for generating a network attack graph, including:

[0031] S110: Obtain a network topology map corresponding to the target network, and determine multiple candidate attack paths corresponding to the target network according to the network topology map.

[0032] In this embodiment, the target network can be understood as a network that requires the use of a network attack graph for threat analysis, defense decision-making, risk management and control, dynamic defense and other operations. The network topology graph can be understood as a directed topology graph including each network node corresponding to the target network, the node attribute information of each network node, and the network interaction information between every two network nodes. Among them, the node attribute information and the network interaction information can be set according to user needs. For example, the node attribute information can be set to include the Internet Protocol (IP) address, or the IP address and the communication port; the network interaction information can be set to include the connection relationship, or the connection relationship and the communication protocol. For example, a network topology graph G = (N, E) can be defined. Among them, N = {n1, n2,…, n m} is a set of network nodes, is the edge set, P is the communication protocol / communication port set, edge (n i ,n j ,p) represents the network node n i Network nodes can be accessed via communication protocols / communication portsj .

[0033] In this step, specifically, a query request can be sent to the agent of each network node in the target network through the Simple Network Management Protocol (SNMP) to obtain the node attribute information of each network node in the target network. Among them, the network nodes include but are not limited to hosts and routers. The node attribute information includes but is not limited to interface information, routing tables and connection status, and the interface information includes but is not limited to IP address, Media Access Control (MAC) address, subnet and communication port. The connectivity of the network nodes is detected through the Internet Control Message Protocol (ICMP), and the network interaction information between the network nodes is determined based on the connectivity of the network nodes. Then, a network topology corresponding to the target network can be generated based on each network node in the target network, at least one node attribute information of each network node, and at least one network interaction information between every two network nodes.

[0034] Finally, after initializing the state of each candidate attack path to ensure that all network nodes are unintrusive, a depth-first algorithm is used, starting from each starting node in the network topology graph, to perform attack simulations based on a pre-built set of attack actions. Specifically, for each network node in the network topology graph, all possible attack actions in the attack action set are traversed, and the target nodes and corresponding state changes triggered by the attack actions are calculated to form a candidate attack path. A candidate attack path can be understood as a path that includes network nodes, their node attribute information, and network interaction information and attack actions between each two network nodes.

[0035] S120 : Determine a target attack path from among the candidate attack paths according to the access constraint conditions and the defense constraint conditions corresponding to the network topology diagram.

[0036] The access constraint condition is that the candidate attack path does not include a predetermined prohibited access edge, and the defense constraint condition is that the candidate attack path does not include a predetermined defense edge.

[0037] Specifically, a candidate attack path that meets the access constraint condition and the defense constraint condition may be determined as a target attack path.

[0038] Optionally, before determining the target attack path in each candidate attack path based on the access constraints and defense constraints corresponding to the network topology graph, it also includes: determining the prohibited access edge in the network topology graph according to pre-defined access control list rules, and constructing the access constraint based on the prohibited access edge; obtaining the defense strategy corresponding to the network topology graph, determining the defense edge corresponding to the network topology graph according to the source node IP address and the target node IP address in the defense strategy, and constructing the defense constraint based on the defense edge.

[0039] Specifically, for access constraints, the access control list rules corresponding to the target system can be obtained from the pre-built Management Information Base (MIB) based on the system attribute information of the target system. The system attribute information may include the manufacturer to which the target system belongs, etc. The access control list rules may include information such as the source node IP address, the target node IP address, the communication port, the communication protocol, the rule action and the effective time. The rule action may include allow and deny. Then, according to the access control list rules corresponding to the target system, the prohibited access edges can be determined in the network topology diagram. For example, if the access control list rule is to deny any Transmission Control Protocol (TCP) data packet access to port 22 of the network node, then port 22 is identified, that is, the Secure Shell Protocol (SSH) service is disabled, so that all attack edges involving the SSH service in the network topology diagram are treated as prohibited access edges. Afterwards, the reachability matrix can be defined based on the prohibited access edges. in Represents network node n i Is it possible to access network node n via communication protocol / communication port p? j Finally, the reachability matrix can be used as access constraints.

[0040] For defense constraints, defense rules can be determined based on the source node IP address, target node IP address, and communication port in the defense strategy, or the source node IP address, target node IP address, and communication protocol, or the source node IP address, target node IP address, communication port, and communication protocol, and the defense edges corresponding to the network topology graph can be determined based on the defense rules. For example, the defense rule set D = {d1, d2, ..., d n}Where each defense rule d k Indicated as d k= (source node IP address, destination node IP address, communication protocol, communication port, action), where actions include allow and deny. Then, in the network topology, attack edges that match the defense rule indicating deny can be used as defense edges.

[0041] S130: Generate a network attack graph corresponding to the target network according to the target attack path.

[0042] In this step, specifically, a risk score corresponding to each target attack path can be determined, and based on each target attack path and the risk score corresponding to each target attack path, a network attack graph corresponding to the target network can be generated. Alternatively, repeated steps and paths that can be replaced by shorter paths can be determined in each target attack path, and these repeated steps and paths that can be replaced by shorter paths can be deleted. Based on the target attack paths that remain after the deletion, a network attack graph corresponding to the target network can be generated. Alternatively, based on the target attack paths that remain after the deletion and the risk scores of the target attack paths that remain after the deletion, a network attack graph corresponding to the target network can be generated.

[0043] Furthermore, determining the risk score corresponding to each target attack path may include: obtaining the initial vulnerability score and attack action of each network node corresponding to each target attack path, and determining the attack success rate corresponding to each network node based on the initial vulnerability score corresponding to each network node; determining the authority escalation range corresponding to each network node based on the attack action corresponding to each network node; and determining the risk score corresponding to each target attack path based on the initial vulnerability score, attack success rate, and authority escalation range of each network node corresponding to each target attack path.

[0044] The Initial Vulnerability Score (IVS) can be understood as a score assigned by the Common Vulnerability Scoring System to potential vulnerabilities in network nodes. A higher Vulnerability Score, attack success rate, and privilege escalation indicate a higher risk of exploitation of the target attack path.

[0045] Specifically, a risk score corresponding to each network node can be determined based on the initial vulnerability score, attack success rate, and privilege escalation range corresponding to each network node. The risk score of each network node in the target attack path can then be multiplied, added, or weighted summed to obtain the risk score of the target attack path.

[0046] For example, the risk score of a network node can be determined by the following specific calculation formula:

[0047] S(σ)=α·v cvss +β·(1-p success)+γ·△π

[0048] Among them, S(σ) is the risk score, α, β and γ are weight coefficients, and v cvss Score the initial vulnerability, p success is the attack success rate, △π is the degree of privilege escalation. Preferably, α can be set to 0.7, and β and γ can be set to 0.15.

[0049] Furthermore, after generating a network attack graph corresponding to the target network based on each target attack path and the risk score corresponding to each target attack path, the method further includes: determining a path to be highlighted in the network attack graph based on the risk score corresponding to each target attack path, and highlighting the path to be highlighted to obtain an updated network attack graph.

[0050] Specifically, each target attack path can be sorted in descending order by risk score to obtain a sorted result. A preset number of target attack paths before the sorted result are identified as paths to be highlighted. These paths can then be highlighted to ensure that high-risk paths are presented first, helping network security managers quickly locate key threats.

[0051] The technical solution of this embodiment obtains a network topology map corresponding to the target network, and determines multiple candidate attack paths corresponding to the target network based on the network topology map; determines a target attack path in each candidate attack path based on the access constraint and defense constraint corresponding to the network topology map; wherein the access constraint is that the candidate attack path does not include a predetermined prohibited access edge, and the defense constraint is that the candidate attack path does not include a predetermined defense edge; and generates a network attack graph corresponding to the target network based on the target attack path. This technical means solves the problem that the existing technology only focuses on the dependencies and propagation conditions between vulnerabilities, resulting in a large number of unrealistic redundant paths in the generated network attack graph, making it difficult for network security managers to use the network attack graph containing a large number of invalid redundant paths for effective security risk management. This avoids the inclusion of a large number of invalid redundant paths in the generated network attack graph, thereby improving the practicality of the network attack graph.

[0052] Example 2

[0053] Figure 2 This is a flowchart of another network attack graph generation method provided according to Example 2 of the present invention. This embodiment is a further optimization and expansion based on the above embodiments, and can be combined with various optional technical solutions in the above implementation methods.

[0054] like Figure 2 As shown, the present embodiment discloses a method for generating a network attack graph, including:

[0055] S210: Obtain a network topology map corresponding to the target network, and determine multiple candidate attack paths corresponding to the target network based on the network topology map.

[0056] S220 , determining a target attack path from among the candidate attack paths according to the access constraint conditions, defense constraint conditions, cost constraint conditions, authority constraint conditions, and node status constraint conditions corresponding to the network topology graph.

[0057] Among them, the access constraint condition is that the candidate attack path does not include predetermined prohibited access edges. The defense constraint condition is that the candidate attack path does not include predetermined defense edges. The cost constraint condition is that the estimated resource cost of the candidate attack path is lower than the preset resource cost threshold, and the estimated time cost is lower than the preset time cost threshold. The permission constraint condition is that the open permissions of each network node in the candidate attack path are higher than the minimum permissions required for the corresponding attack action. The node status constraint condition is that the network connection status of each network node in the candidate attack path is online, and the vulnerability repair status of each network node in the candidate attack path is unrepaired.

[0058] In this step, specifically, the "attack complexity" and "permission requirements" metrics for each vulnerability corresponding to each candidate attack path can be determined based on the Common Vulnerability Scoring System. Based on the "attack complexity" and "permission requirements" metrics for each vulnerability corresponding to each candidate attack path, as well as the resources required for the attack, the estimated resource cost for each candidate attack path can be determined. Based on the "attack complexity" and "permission requirements" metrics for each vulnerability corresponding to each candidate attack path, as well as the time required for the attack, the estimated time cost for each candidate attack path can be determined. "Attack complexity" reflects the technical difficulty and resource investment required to exploit the vulnerability; a higher value indicates a higher attack cost. "Permission requirements" reflects the level of permissions required before exploiting the vulnerability, which indirectly affects the attack cost assessment. It is worth noting that due to the differences in data formats and description emphases of various vulnerability libraries, before determining the "attack complexity" and "authority requirements" and other indicator values ​​of each vulnerability corresponding to each candidate attack path according to the common vulnerability scoring system, the collected vulnerability data can be cleaned to remove unnecessary data such as redundant fields and invalid descriptions, and deduplication operations can be performed using key information such as vulnerability numbers and vulnerability characteristics to ensure the accuracy and uniqueness of the vulnerability data.

[0059] Based on the pre-built role permission table, the open permissions corresponding to each network node are obtained. The role permission table can include the correspondence between users, roles, and permissions. For example, when the user's role is "ordinary employee", they only have file read permissions. When the user's role is "administrator", they also have system configuration modification permissions. Then, the open permissions of each network node can be updated according to the attack action corresponding to each network node in the candidate attack path. For example, when the attack action is to exploit a privilege escalation vulnerability to elevate the attacker's permissions, the open permissions of the network node can be updated according to the permissions that the attacker can elevate to.

[0060] After determining the estimated resource cost and estimated time cost of each candidate attack path, as well as the open permissions of each network node in each candidate attack path, the candidate attack path that simultaneously meets the access constraints, defense constraints, cost constraints, permission constraints and node status constraints can be determined as the target attack path based on the estimated resource cost and estimated time cost of each candidate attack path, as well as the open permissions of each network node in each candidate attack path.

[0061] S230: Delete target attack paths including at least two identical network nodes to obtain remaining attack paths.

[0062] S240: Add the remaining attack paths with the same source node and target node as the same type of redundant paths to the same redundant path set, and treat the remaining attack paths except the redundant paths as non-redundant paths.

[0063] S250: Determine a redundant reserved path corresponding to each redundant path set according to the path length of each redundant path corresponding to each redundant path set.

[0064] Specifically, in this step, each redundant path set may be sequentially used as the current redundant path set, and the redundant path with the longest path length in the current redundant path set may be used as the redundant reserved path. A determination is then made as to whether all redundant path sets corresponding to the target network have been processed. If not, the process returns to sequentially using each redundant path set as the current redundant path set until all redundant path sets corresponding to the target network have been processed.

[0065] S260: Generate a network attack graph corresponding to the target network based on the non-redundant paths and the redundant reserved paths.

[0066] In this step, specifically, after generating a network attack graph corresponding to the target network based on the non-redundant paths and the redundant retained paths, the risk score of each network node in the network attack graph is obtained, and the network attack graph is updated according to the risk score of each network node to obtain an updated network attack graph.

[0067] After obtaining the updated network attack graph, the validity of each path in the network attack graph can be automatically checked at preset intervals to ensure that the network attack graph reflects changes in the network environment in real time. Specifically, the network nodes involved in the path can be checked based on the pre-built node status constraints. For example, when the network connection status of any network node in the path is offline, or the vulnerability repair status of any network node in the path is repaired, the path can be marked as invalid. In addition, when the pre-built defense rule set is updated, it can be verified based on the updated defense rule set whether the edges in the path still meet the defense constraints. If the update of the defense rule set causes the path to be blocked, the path is marked as invalid. After marking each path as invalid, all invalid paths can be removed from the network attack graph to ensure the accuracy of the network attack graph.

[0068] After removing the invalid paths in the network attack graph, the filtered valid paths and risk ranking results can be integrated to generate a structured attack graph that includes node attribute information of each network node, network interaction information and attack actions between every two network nodes, as well as the risk score, estimated resource cost, and estimated time cost of each path. The structured attack graph can then be converted into a visual graph for network security managers to view or connect with other systems. Specifically, a force-directed layout algorithm can be used to arrange the network nodes in the structured attack graph. The color and shape of each network node are marked according to the node type (such as host and router) and security status (such as normal and high-risk vulnerabilities). The attack path is represented by a labeled arrow, and the attack action, communication protocol, communication port, and risk score are marked.

[0069] After converting the structured attack graph into a visual graph, you can configure a pop-up window for clicking a network node in the visualized structured attack graph. The window displays the vulnerability name, number, severity, remediation suggestions, and permission information, helping to quickly locate security issues. You can also configure a path interaction function for the visualized structured attack graph. When you right-click on the attack path, you can see the detailed steps of the attack path (e.g., scan port → exploit → privilege escalation), estimated resource cost, estimated time cost, risk score, and impact range. You can also configure a multi-format display function for the visualized structured attack graph, displaying the structured attack graph in Portable Network Graphics (PNG) or Joint Photographic Experts Group (JPG) format. You can also configure an attack graph export function for the visualized structured attack graph. When the user triggers the attack graph export option, the structured attack graph is exported as structured data in JavaScript Object Notation (JSON) format for integration with other systems, improving the practicality of the attack graph.

[0070] After configuring the visualization graph, it can connect to the network monitoring system in real time via an Application Programming Interface (API), continuously acquiring dynamic data such as host status (offline / online), service operation status, vulnerability remediation status, new vulnerability intelligence, and defense policy updates. This collected dynamic data can then be analyzed in real time to identify network environment change events, such as host status transitions (e.g., a server going from online to offline), new vulnerability releases, and firewall rule adjustments. Subsequently, upon detecting key changes that impact the network attack graph (e.g., a host going offline or a new high-risk vulnerability appearing), the attack graph update process is automatically triggered. Finally, based on the analysis results of the dynamic data, access constraints, defense constraints, cost constraints, permission constraints, and node status constraints can be updated, for example, adjusting node reachability, permission status, and vulnerability availability. Based on the updated constraints, the network attack graph is regenerated, accurately reflecting the dynamic evolution of the network security landscape and providing real-time and effective support for network security decision-making.

[0071] The technical solution of this embodiment determines the target attack path from each candidate attack path by using access constraints, defense constraints, cost constraints, authority constraints, and node status constraints corresponding to the network topology graph. This fully considers the restrictions on attack paths imposed by key factors such as network topology, defense strategy, attack cost, user authority, and node status, thereby avoiding the inclusion of a large number of invalid redundant paths in the generated network attack graph and improving the practicality of the network attack graph. Secondly, the remaining attack paths are obtained by deleting the target attack paths that include at least two identical network nodes; the remaining attack paths with the same source and target nodes are added as the same type of redundant paths to the same redundant path set, and the remaining attack paths excluding the redundant paths are treated as non-redundant paths; the redundant retained paths corresponding to each redundant path set are determined based on the path length of each redundant path corresponding to each redundant path set; and a network attack graph corresponding to the target network is generated based on the non-redundant paths and the redundant retained paths, thereby enhancing the logical simplicity of the network attack graph and improving the efficiency of security risk management using the network attack graph.

[0072] In a preferred embodiment, Figure 3 As shown, a depth-first search can be performed on each network node in the network topology graph. Each network node is verified according to node state constraints and permission constraints to obtain verified network nodes. Then, based on a pre-built attack action set, the attack action corresponding to the verified network node is determined. Based on the verified network nodes and the attack actions corresponding to the verified network nodes, candidate attack paths are constructed. Afterwards, the candidate attack paths are verified according to access constraints, defense constraints, and cost constraints. Candidate attack paths that pass verification are considered valid attack paths, while those that fail verification are discarded. Finally, a determination is made as to whether the valid attack path reaches the target node. If so, the valid attack path is used as the target attack path for generating the network attack graph. If not, a determination is made as to whether the verified network node has an extension node. If so, the operation returns to the depth-first search of each network node in the network topology graph. If no extension node exists for the verified network node, the target attack path generation process is terminated and the previous network node corresponding to the verified network node is backtracked to generate the network attack graph based on the existing target attack path.

[0073] Optionally, after generating the network attack graph, the method may further include dividing the target attack paths in the network attack graph into different subsets according to different attack targets. There may be multiple attack targets, such as specific hosts and critical services. Then, based on the estimated resource cost and estimated time cost of each target attack path corresponding to each subset, low-cost and high-cost paths may be determined within each subset. For example, target attack paths with estimated resource costs exceeding a preset maximum resource cost or estimated time costs exceeding a preset maximum time cost may be considered high-cost paths, while target attack paths with estimated resource costs below the preset maximum resource cost and estimated time costs below the preset maximum time cost may be considered low-cost paths. Subsequently, within the low-cost paths of each subset, paths with repeated steps and paths that can be replaced by shorter paths may be identified, and these repeated steps and paths that can be replaced by shorter paths may be deleted to obtain logically simplified paths corresponding to each subset. Finally, the network attack graph may be updated based on the logically simplified paths corresponding to each subset.

[0074] The advantage of this setup is that, compared to the need for detailed formal modeling of the target network, the operating status of each node in the network, as well as the possible actions taken by the attacker, are converted into logical rules that a computer can understand. For example, using a finite state machine to describe the changing state of network nodes, first determine all possible states of the network, then set the operations that can be performed in each state. By continuously simulating these operations, the entire state space is traversed to find all possible attack paths, and finally generate a network attack graph. Existing technologies do not rely on models, thus improving the efficiency of network attack graph generation. Secondly, by generating target attack paths in real time under access constraints, defense constraints, cost constraints, permission constraints, and node state constraints, it is possible to avoid further validity judgments on network nodes under invalid network nodes, thereby improving the efficiency of network attack graph generation.

[0075] Example 3

[0076] Figure 4 This is a schematic diagram of the structure of a network attack graph generation device provided according to Example 3 of the present invention. This embodiment is applicable to situations where a network attack graph is generated. The network attack graph generation device can be implemented in the form of hardware and / or software and can be configured in an electronic device such as a computer.

[0077] like Figure 4 As shown, the network attack graph generation device disclosed in this embodiment includes: a candidate path determination module 41, a target path determination module 42 and an attack graph generation module 43, wherein:

[0078] The candidate path determination module 41 is used to obtain a network topology map corresponding to the target network and determine multiple candidate attack paths corresponding to the target network based on the network topology map;

[0079] a target path determination module 42 for determining a target attack path from among the candidate attack paths based on access constraints and defense constraints corresponding to the network topology;

[0080] Among them, the access constraint condition is that the candidate attack path does not include the predetermined prohibited access edge, and the defense constraint condition is that the candidate attack path does not include the predetermined defense edge;

[0081] The attack graph generation module 43 is used to generate a network attack graph corresponding to the target network according to the target attack path.

[0082] The technical solution in this embodiment, through the mutual cooperation of the candidate path determination module 41, the target path determination module 42 and the attack graph generation module 43, solves the problem that the existing technology only focuses on the dependencies and propagation conditions between vulnerabilities, resulting in a large number of unrealistic redundant paths in the generated network attack graph, making it difficult for network security managers to use network attack graphs containing a large number of invalid redundant paths to effectively manage security risks. It avoids the inclusion of a large number of invalid redundant paths in the generated network attack graph and improves the practicality of the network attack graph.

[0083] Optionally, the device also includes a constraint determination module, which is used to: determine the prohibited access edges in the network topology map according to pre-defined access control list rules, and construct access constraints based on the prohibited access edges; obtain a defense strategy corresponding to the network topology map, determine the defense edges corresponding to the network topology map according to the source node IP address and the target node IP address in the defense strategy, and construct defense constraints based on the defense edges.

[0084] Optionally, the target path determination module 42 includes:

[0085] a target path determination unit, configured to determine a target attack path from among the candidate attack paths based on access constraints, defense constraints, cost constraints, authority constraints, and node status constraints corresponding to the network topology graph;

[0086] Among them, the cost constraint condition is that the estimated resource cost of the candidate attack path is lower than the preset resource cost threshold, and the estimated time cost is lower than the preset time cost threshold. The permission constraint condition is that the open permission of each network node in the candidate attack path is higher than the minimum permission required for the corresponding attack action. The node status constraint condition is that the network connection status of each network node in the candidate attack path is online, and the vulnerability repair status of each network node in the candidate attack path is unrepaired.

[0087] Optionally, the target path determination unit is specifically configured to determine a candidate attack path that satisfies access constraints, defense constraints, cost constraints, authority constraints, and node status constraints as a target attack path.

[0088] Optionally, the attack graph generation module 43 includes:

[0089] a path deletion unit, configured to delete a target attack path including at least two identical network nodes to obtain a remaining attack path;

[0090] a redundant path division unit, configured to add the remaining attack paths with the same source node and target node as the same type of redundant paths to the same redundant path set, and to treat the remaining attack paths other than the redundant paths as non-redundant paths;

[0091] a reserved path determining unit, configured to determine a redundant reserved path corresponding to each redundant path set according to the path length of each redundant path corresponding to each redundant path set;

[0092] A first attack graph generating unit, configured to generate a network attack graph corresponding to a target network based on the non-redundant paths and the redundant reserved paths;

[0093] a success rate determination unit, configured to obtain an initial vulnerability score and an attack action for each network node corresponding to each target attack path, and determine an attack success rate corresponding to each network node based on the initial vulnerability score corresponding to each network node;

[0094] a permission increase determination unit, configured to determine the permission increase range corresponding to each network node according to the attack action corresponding to each network node;

[0095] a risk score determination unit, configured to determine a risk score corresponding to each target attack path based on the initial vulnerability score, attack success rate, and privilege escalation magnitude of each network node corresponding to each target attack path;

[0096] The second attack graph generating unit is used to generate a network attack graph corresponding to the target network according to each target attack path and the risk score corresponding to each target attack path.

[0097] Optionally, the device further includes a path highlighting module, which is used to: determine the paths to be highlighted in the network attack graph according to the risk scores corresponding to each target attack path, and highlight the paths to be highlighted to obtain an updated network attack graph.

[0098] The network attack graph generation device provided in the embodiment of the present invention can execute the network attack graph generation method provided in any embodiment 1 of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For any content not fully described in this embodiment, please refer to the description of any method embodiment of this application.

[0099] Example 4

[0100] Figure 5 FIG. 1 is a schematic structural diagram of an electronic device 10 that can be used to implement an embodiment of the present invention.

[0101] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0102] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0103] The processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the network attack graph generation method.

[0104] In some embodiments, the network attack graph generation method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the network attack graph generation method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the network attack graph generation method in any other appropriate manner (for example, by means of firmware).

[0105] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0106] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0107] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0108] To provide interaction with a client user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the client user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the client user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the client user; for example, the feedback provided to the client user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and the input from the client user can be received in any form (including acoustic input, voice input, or tactile input).

[0109] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a client user computer having a graphical client user interface or a web browser through which a client user can interact with embodiments of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0110] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0111] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0112] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A network attack graph generation method, characterized in that: The method comprises: Obtaining a network topology map corresponding to a target network, and determining a plurality of candidate attack paths corresponding to the target network based on the network topology map; Determining a target attack path from among the candidate attack paths according to the access constraint conditions and the defense constraint conditions corresponding to the network topology diagram; The access constraint condition is that the candidate attack path does not include a predetermined prohibited access edge, and the defense constraint condition is that the candidate attack path does not include a predetermined defense edge; A network attack graph corresponding to the target network is generated according to the target attack path.

2. The method according to claim 1, characterized in that Before determining a target attack path from each of the candidate attack paths according to the access constraint conditions and the defense constraint conditions corresponding to the network topology graph, the method further includes: Determining prohibited access edges in the network topology graph according to predefined access control list rules, and constructing access constraint conditions based on the prohibited access edges; Obtain a defense strategy corresponding to the network topology graph, determine a defense edge corresponding to the network topology graph based on the source node IP address and the target node IP address in the defense strategy, and construct a defense constraint condition based on the defense edge.

3. The method according to claim 1, characterized in that Determining a target attack path from among the candidate attack paths according to the access constraint and the defense constraint corresponding to the network topology diagram includes: Determining a target attack path from among the candidate attack paths according to access constraints, defense constraints, cost constraints, authority constraints, and node status constraints corresponding to the network topology graph; Among them, the cost constraint condition is that the estimated resource cost of the candidate attack path is lower than the preset resource cost threshold, and the estimated time cost is lower than the preset time cost threshold; the permission constraint condition is that the open permission of each network node in the candidate attack path is higher than the minimum permission required for the corresponding attack action; the node status constraint condition is that the network connection status of each network node in the candidate attack path is online, and the vulnerability repair status of each network node in the candidate attack path is unrepaired.

4. The method according to claim 3, characterized in that Determining a target attack path from among the candidate attack paths according to access constraints, defense constraints, cost constraints, authority constraints, and node status constraints corresponding to the network topology graph includes: The candidate attack path that satisfies the access constraint, defense constraint, cost constraint, authority constraint and node status constraint at the same time is determined as the target attack path.

5. The method according to claim 1, wherein Generating a network attack graph corresponding to the target network according to the target attack path includes: Deleting target attack paths that include at least two identical network nodes to obtain remaining attack paths; The remaining attack paths with the same source node and target node are added to the same redundant path set as the same type of redundant paths, and the remaining attack paths except the redundant paths are regarded as non-redundant paths; Determining, according to the path length of each redundant path corresponding to each redundant path set, a redundant reserved path corresponding to each redundant path set; A network attack graph corresponding to the target network is generated according to the non-redundant paths and the redundant reserved paths.

6. The method according to claim 1, characterized in that Generating a network attack graph corresponding to the target network according to the target attack path includes: Obtaining an initial vulnerability score and attack action for each network node corresponding to each target attack path, and determining an attack success rate corresponding to each network node based on the initial vulnerability score corresponding to each network node; Determine the extent of the privilege escalation corresponding to each network node based on the attack actions corresponding to each network node; Determine the risk score corresponding to each target attack path based on the initial vulnerability score, attack success rate, and privilege escalation of each network node corresponding to each target attack path; A network attack graph corresponding to the target network is generated according to each target attack path and the risk score corresponding to each target attack path.

7. The method according to claim 6, characterized in that After generating a network attack graph corresponding to the target network based on each target attack path and the risk score corresponding to each target attack path, the method further includes: According to the risk score corresponding to each target attack path, a path to be highlighted is determined in the network attack graph, and the path to be highlighted is highlighted to obtain an updated network attack graph.

8. A network attack graph generating device, characterized in that: The device comprises: a candidate path determination module, configured to obtain a network topology map corresponding to a target network and determine, based on the network topology map, a plurality of candidate attack paths corresponding to the target network; a target path determination module, configured to determine a target attack path from among the candidate attack paths based on access constraints and defense constraints corresponding to the network topology graph; The access constraint condition is that the candidate attack path does not include a predetermined prohibited access edge, and the defense constraint condition is that the candidate attack path does not include a predetermined defense edge; An attack graph generation module is used to generate a network attack graph corresponding to the target network according to the target attack path.

9. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the network attack graph generation method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network attack graph generation method according to any one of claims 1 to 7 when executed.

Images