Harmless attack verification analysis method and system

Abstract

The invention discloses a harmless attack verification analysis method and system, and the method comprises the steps: obtaining multi-source security data, and determining attack cases in the multi-source security data to construct an attack knowledge graph; constructing a scenarized attack flow chart based on the attack knowledge graph, and formulating a harmless attack task based on the scenarized attack flow chart; determining a path number and a node number of attack paths in the harmless attack task, and based on the path number and the node number, decomposing the harmless attack task into a plurality of subtasks; obtaining path information of the attack path, determining complexity of the attack path based on the path information, and determining attack priorities of the subtasks based on the complexity; and determining an attack sequence of the sub-tasks based on the attack priorities, and performing simulation attack verification on the protection boundary by the sub-tasks according to the attack sequence. According to the method, the security and weakness of the protection boundary are determined by simulating a real attack behavior so as to help to discover and solve potential security vulnerabilities, so that the overall security of an information system is improved, and the security of the information system and data is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a harmless attack verification and analysis method and system. Background Art

[0002] In today's digital age, cybersecurity has become a critical issue requiring urgent attention by organizations and individuals. With the increasing sophistication of cyberattack techniques and the normalization of advanced persistent threats, cyberattacks are becoming increasingly complex and frequent. Traditional passive defense systems are gradually exposing shortcomings such as delayed detection and slow response when faced with highly concealed and multi-path attack chains. Security experts and organizations need to continuously improve their response and protection capabilities. Therefore, harmless attack verification and analysis methods have emerged. Their core goal is to simulate real-world attack behavior in an isolated environment to ensure a safe and controllable verification process and avoid damage to the production environment. Summary of the Invention

[0003] In order to solve the above technical problems, the present invention provides a harmless attack verification and analysis method and system, including: Acquire multi-source security data, identify attack cases in the multi-source security data, and construct an attack knowledge graph based on the attack cases in the multi-source security data; Build a scenario-based attack flowchart based on the attack knowledge graph, and formulate harmless attack tasks based on the attack flowchart; Determine the number of paths and nodes in the attack path of the harmless attack task, and decompose the harmless attack task into multiple subtasks based on the number of paths and nodes in the attack path; Obtaining path information of the attack path, determining the complexity of the attack path based on the path information, and determining the attack priority of the subtask based on the complexity of the attack path; The attack order of the subtasks is determined based on the attack priority, and the subtasks perform simulated attack verification on the protection boundary according to the attack order.

[0004] Furthermore, the acquiring of multi-source security data, determining attack cases in the multi-source security data, and constructing an attack knowledge graph based on the attack cases in the multi-source security data include: Acquire multi-source security data on the Internet through web crawlers and pre-process the multi-source security data, including data cleaning and data standardization; Identify attack events from pre-processed multi-source security data, and determine attack cases in the multi-source security data based on the attack events; Use the preset extraction model to extract the entities involved in the attack case, and analyze the relationship between different entities in the attack case based on dependency syntax; An attack knowledge graph is constructed based on the relationships between entities and entities, and the attack knowledge graph is updated regularly.

[0005] Furthermore, the construction of a scenario-based attack flowchart based on the attack knowledge graph and the formulation of a harmless attack task based on the attack flowchart include: Determine the attack scenarios corresponding to different attack cases in the attack knowledge graph, and determine the attackers, attack targets, attack methods, and attack paths in attack cases under different attack scenarios; The attacker, attack target, attack method and attack path are graphically drawn into an attack flowchart, and the attack flowchart is imported into a preset harmless attack engine, which automatically generates a harmless attack task.

[0006] Furthermore, the determining of the number of paths and the number of nodes in the attack path in the harmless attack task, and decomposing the harmless attack task into a plurality of subtasks based on the number of paths and the number of nodes in the attack path, includes: The number of paths and the number of nodes in the attack path in the harmless attack task are determined, the product of the number of paths and the number of nodes is calculated, and the harmless attack task is decomposed into multiple subtasks according to the product result.

[0007] Furthermore, obtaining path information of the attack path and determining the complexity of the attack path based on the path information includes: Obtaining path information of the attack path, which includes static indicators and dynamic indicators, and analyzing the static indicators and dynamic indicators to determine the indicator values ​​corresponding to the static indicators and the dynamic indicators; Each static indicator and each dynamic indicator is converted into a vector respectively, and the vectorized static indicators and dynamic indicators are normalized to obtain the weights corresponding to each static indicator and each dynamic indicator respectively; The static complexity of the attack path is determined based on the indicator values ​​and weights of the static indicators, and the dynamic complexity of the attack path is determined based on the indicator values ​​and weights of each dynamic indicator; The static complexity of the attack path and the dynamic complexity of the attack path are added together to obtain the complexity of the attack path.

[0008] Furthermore, analyzing the static indicators and the dynamic indicators to determine the indicator values ​​corresponding to the static indicators and the dynamic indicators includes: Determine static indicators and dynamic indicators. Static indicators include path length, vulnerability exploitation difficulty, and tool maturity. Dynamic indicators include protection equipment coverage, environmental context matching, and attacker resource requirements. Evaluate and value each indicator in the static indicators and dynamic indicators separately to obtain the indicator values ​​corresponding to the static indicators and dynamic indicators.

[0009] Furthermore, determining the static complexity of the attack path according to the indicator value and weight of the static indicator, and determining the dynamic complexity of the attack path according to the indicator value and weight of each dynamic indicator, includes: The static complexity of the attack path is calculated based on the index value and weight of the static index. The calculation formula of the static complexity of the attack path is: , Where A is the static complexity of the attack path, qi is the weight of the i-th indicator in the static indicator, li is the indicator value of the i-th indicator in the static indicator, and n is the number of indicators in the static indicator; The dynamic complexity of the attack path is calculated based on the indicator value and weight of the dynamic indicator. The calculation formula of the dynamic complexity of the attack path is: , Among them, B is the dynamic complexity of the attack path, pi is the weight of the i-th indicator in the dynamic indicator, ji is the indicator value of the i-th indicator in the dynamic indicator, and m is the number of indicators in the dynamic indicator.

[0010] Furthermore, the determination of the attack priority of the subtask based on the complexity of the attack path includes: A correspondence between attack priority and complexity interval is pre-set, wherein the correspondence between attack priority and complexity interval is associated with a corresponding attack priority for each complexity interval; The complexity of the subtask is obtained, and based on the mapping relationship between the complexity interval to which the complexity belongs and the attack priority-complexity interval correspondence, the attack priority corresponding to the complexity interval is selected as the attack priority of the subtask.

[0011] Furthermore, the attack order of the subtasks is determined based on the attack priority, and the subtasks perform simulated attack verification on the protection boundary according to the attack order, including: Determine the dependencies between subtasks, build a directed acyclic graph of subtasks based on the dependencies, and generate a topological sequence of subtasks based on the directed acyclic graph; Determine the attack priority of each subtask, and adjust the topological sequence according to the attack priority of each subtask on the basis of the topological sequence to obtain the attack order of the subtasks; Assign subtasks to different simulation nodes, and execute the corresponding subtasks of each simulation node in the attack order to verify the protection boundary through simulation attacks.

[0012] The present invention also provides a harmless attack verification and analysis system, comprising: A construction module for acquiring multi-source security data, identifying attack cases in the multi-source security data, and constructing an attack knowledge graph based on the attack cases in the multi-source security data; A development module is used to build a scenario-based attack flowchart based on the attack knowledge graph and formulate harmless attack tasks based on the attack flowchart; a decomposition module, configured to determine the number of paths and the number of nodes in the attack path in the harmless attack task, and decompose the harmless attack task into a plurality of subtasks based on the number of paths and the number of nodes in the attack path; a determination module, configured to obtain path information of an attack path, determine the complexity of the attack path based on the path information, and determine the attack priority of a subtask based on the complexity of the attack path; The verification module is used to determine the attack order of subtasks based on the attack priority, and the subtasks perform simulated attack verification on the protection boundary according to the attack order.

[0013] Compared with the prior art, the harmless attack verification and analysis method and system according to the embodiment of the present invention have the following advantages: The attack knowledge graph constructed by this invention helps to systematically organize and display attack-related information, including the relationship between attack types, attackers, victims, and attack methods, helping security teams better understand the background and patterns of attack incidents and improve their awareness and prevention capabilities of threats. This invention uses scenario-based attack flowcharts to clearly display the attacker's attack path and behavior, helping to simulate and understand the attack process, formulate harmless attack tasks, help organizations conduct security drills, and identify weaknesses and vulnerabilities in the system; The present invention decomposes the harmless attack task into subtasks, which helps to more effectively manage and execute the attack process. By evaluating the complexity of the attack path, the difficulty of the attack can be determined, and high-risk and high-complexity attack paths can be prioritized. The present invention determines the attack priority and order of subtasks, which can help security teams take more targeted protection and response measures. Executing attack tasks in an orderly manner according to attack priority can improve the effectiveness of security drills and the security of the system. The present invention can evaluate the security and weaknesses of the system through simulated attack verification, helping organizations to improve protection strategies and enhance security levels. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 Schematic diagram of the process structure of the harmless attack verification and analysis method in an embodiment of the present invention; Figure 2 Schematic diagram of the composition of the harmless attack verification and analysis system in an embodiment of the present invention. DETAILED DESCRIPTION

[0015] The following embodiments are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0016] In the description of this application, it should be understood that the terms "center", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the platform or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on this application.

[0017] The terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of paths or nodes of the indicated technical feature. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0018] In the description of this application, it should be noted that, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood broadly. For example, they can refer to fixed, detachable, or integral connections; mechanical or electrical connections; direct or indirect connections through an intermediate medium; and internal communication between two components. Persons of ordinary skill in the art will understand the specific meanings of the above terms in this application based on specific circumstances.

[0019] like Figure 1 As shown, in an embodiment of the present application, a harmless attack verification and analysis method is provided, including: S100: obtaining multi-source security data, determining attack cases in the multi-source security data, and constructing an attack knowledge graph based on the attack cases in the multi-source security data; S200: constructing a scenario-based attack flowchart based on the attack knowledge graph, and formulating a harmless attack task based on the attack flowchart; S300: determining the number of paths and the number of nodes in the attack path in the harmless attack task, and decomposing the harmless attack task into multiple subtasks based on the number of paths and the number of nodes in the attack path; S400: obtaining path information of the attack path, determining the complexity of the attack path based on the path information, and determining the attack priority of the subtask based on the complexity of the attack path; S500: determining the attack order of the subtask based on the attack priority, and the subtask performs simulated attack verification on the protection boundary according to the attack order.

[0020] Furthermore, the attack knowledge graph constructed by the present invention helps to systematically organize and display attack-related information, including the relationship between attack types, attackers, victims and attack methods, helping security teams to better understand the background and patterns of attack events and improve their awareness and prevention capabilities of threats; the present invention can clearly display the attacker's attack path and behavior through a scenario-based attack flowchart, which helps to simulate and understand the attack process, formulate harmless attack tasks, help organizations conduct security drills, and identify weaknesses and loopholes in the system; the present invention decomposes the harmless attack task into subtasks, which helps to more effectively manage and execute the attack process. By evaluating the complexity of the attack path, the difficulty of the attack can be determined, and high-risk and high-complexity attack paths can be prioritized; the present invention determines the attack priority and sequence of subtasks, which can help the security team to carry out more targeted protection and response measures, and the orderly execution of attack tasks according to the attack priority can improve the effectiveness of security drills and the security of the system; the present invention can evaluate the security and weaknesses of the system through simulated attack verification, helping organizations to improve protection strategies and improve security levels.

[0021] In an embodiment of the present application, a harmless attack verification and analysis method is provided, which obtains multi-source security data, determines attack cases in the multi-source security data, and constructs an attack knowledge graph based on the attack cases in the multi-source security data, including: obtaining multi-source security data on the Internet through a web crawler, and preprocessing the multi-source security data, the preprocessing including data cleaning and data standardization; identifying attack events from the preprocessed multi-source security data, and determining attack cases in the multi-source security data based on the attack events; using a preset extraction model to extract entities involved in the attack cases, and analyzing the relationship between different entities in the attack cases based on dependency syntax; constructing an attack knowledge graph based on the relationship between entities, and regularly updating the attack knowledge graph.

[0022] Specifically, web crawler technology is used to collect multi-source security data from the Internet. These data may include security reports, vulnerability announcements, security forum discussions, malware samples, etc. Obtaining multi-source security data can help establish a comprehensive security intelligence library and provide data support for subsequent security analysis and defense; data preprocessing (data cleaning and standardization processing), data cleaning includes removing duplicate data, processing missing values, correcting erroneous data, etc. to ensure data quality, data standardization processing includes unifying data formats, unit conversion, etc. for subsequent analysis and processing. Through data preprocessing, data quality and consistency are improved, providing a clean and accurate data foundation for subsequent analysis; through data analysis and mining technology, attack events in multi-source security data are identified, and attack cases are determined. Identifying attack events helps organizations respond and deal with security threats in a timely manner. , improving security protection capabilities; using a preset extraction model to extract entities involved in the attack case, such as attackers, victims, and attack methods, and based on dependency syntax analysis to analyze the relationships between different entities in the attack case, such as the attacker's attack behavior on the victim. Through entity extraction and relationship analysis, we can deeply understand the participants and associations of the attack event, which helps to form a more comprehensive description of the attack event; constructing an attack knowledge graph based on the relationship between entities, and displaying the attack events, entities, and relationships in the form of a graph. The attack knowledge graph is regularly updated, including adding new attack events, entity information, and updating relationships to reflect the latest security threats. Building an attack knowledge graph helps to systematically organize and display attack-related information, helping security teams better understand the background and patterns of attack events, and improve their awareness and prevention capabilities of threats. In summary, this step can help organizations extract useful information from multi-source security data, build an attack knowledge graph, improve their perception and understanding of security threats, and thus strengthen security protection and response capabilities. Through systematic methods and steps, we can better analyze and respond to different types of security threats and ensure the security of information systems.

[0023] In an embodiment of the present application, a harmless attack verification and analysis method is provided, which constructs a scenario-based attack flowchart based on the attack knowledge graph, and formulates a harmless attack task based on the attack flowchart, including: determining the attack scenarios corresponding to different attack cases in the attack knowledge graph, and determining the attacker, attack target, attack method and attack path in the attack case under different attack scenarios; graphically drawing the attacker, attack target, attack method and attack path into an attack flowchart, and importing the attack flowchart into a preset harmless attack engine, and the preset harmless attack engine automatically generates a harmless attack task.

[0024] Specifically, through the information in the attack knowledge graph, the specific attack scenarios corresponding to different attack cases are determined, including the identity of the attacker, the attack target, the attack method used, and the attack path. By determining the attack scenarios and case details, we can gain an in-depth understanding of different types of security threats and help the security team prepare corresponding response strategies and protection measures; the attacker, attack target, attack method, and attack path are graphically drawn into an attack flowchart to show the overall process and correlation of the attack event. Through the graphical attack flowchart, the key elements and processes of the attack event can be intuitively presented, which helps team members understand the complexity and correlation of the attack event; the drawn attack flowchart is imported into the preset harmless attack engine. The engine can automatically generate harmless attack tasks based on the information in the diagram, simulating attack events without causing actual harm to the system. The tasks generated by the preset harmless attack engine can simulate real attack behaviors in a controlled environment, evaluate the security and weaknesses of the system, and help organizations formulate effective security protection strategies. In summary, this step can help organizations understand the details of attack cases under different attack scenarios in detail, and present the attack process in a graphical way, so as to better understand the nature and process of the attack incident. By importing the preset harmless attack engine to generate harmless attack tasks, it is possible to safely simulate real attack behaviors, evaluate the system's defense capabilities, and help organizations promptly discover and resolve potential security vulnerabilities. This step combines the technical means of attack knowledge graphs, attack flowcharts, and harmless attack engines to provide organizations with comprehensive security assessment and protection capabilities, helping to improve the overall security of the system.

[0025] In an embodiment of the present application, a harmless attack verification and analysis method is provided, which determines the number of paths and the number of nodes in the attack path in the harmless attack task, and decomposes the harmless attack task into multiple subtasks based on the number of paths and the number of nodes in the attack path, including: determining the number of paths and the number of nodes in the attack path in the harmless attack task, calculating the product of the number of paths and the number of nodes, and decomposing the harmless attack task into multiple subtasks based on the product result.

[0026] Specifically, the number of paths in an attack path refers to the total number of possible paths from the attacker to the target system, and the number of nodes refers to the total number of nodes involved in the attack path (such as the attacker, intermediate nodes, and target system). By calculating the product of the number of paths and the number of nodes, we can obtain an indicator of the complexity of the attack task. Based on the result of this multiplication, the original harmless attack task is decomposed into multiple subtasks, each covering a portion of the attack path or a specific node. Decomposing tasks can help reduce task complexity, improve execution efficiency, and better manage the task execution process. By breaking down complex attack tasks into multiple subtasks, they can be executed in parallel or in stages, improving task execution efficiency. Decomposing tasks makes the entire attack process easier to manage and monitor, allowing for clearer tracking of task execution progress and results. Decomposing tasks into subtasks makes the attack process more controllable, helps avoid unexpected situations, and better understands the direction and target of the attack. By rationally allocating and executing subtasks, computing resources and time can be more efficiently utilized, improving the efficiency and success rate of attack tasks. In summary, decomposing the neutralization attack task into multiple subtasks is an effective task management and execution strategy that can improve task execution efficiency, reduce management complexity, and optimize resource utilization. This decomposition method helps to better understand and control the complexity of attack tasks, improve the accuracy and comprehensiveness of attack assessments, and help organizations more effectively plan and implement security protection measures.

[0027] In an embodiment of the present application, a harmless attack verification and analysis method is provided, which obtains path information of the attack path and determines the complexity of the attack path based on the path information, including: obtaining the path information of the attack path, the path information includes static indicators and dynamic indicators, and analyzing the static indicators and dynamic indicators to determine the indicator values ​​corresponding to the static indicators and the dynamic indicators; converting each static indicator and each dynamic indicator into a vector, and normalizing the vectorized static indicators and dynamic indicators to obtain the weights corresponding to each static indicator and each dynamic indicator; determining the static complexity of the attack path according to the indicator value and weight of the static indicator, and determining the dynamic complexity of the attack path according to the indicator value and weight of each dynamic indicator; adding the static complexity of the attack path and the dynamic complexity of the attack path to obtain the complexity of the attack path.

[0028] Specifically, the attack path information is obtained, including static and dynamic indicators. The static and dynamic indicators are analyzed to determine the corresponding indicator values ​​for the static and dynamic indicators. Each static and dynamic indicator is converted into a vector form, normalized, and its value mapped to a standard range to ensure that the weights of different indicators can be compared and combined. The static complexity of the attack path is calculated based on the indicator values ​​and weights of the static indicators, and the dynamic complexity of the attack path is calculated based on the indicator values ​​and weights of the dynamic indicators. The static complexity and dynamic complexity are added together to obtain the overall complexity of the attack path. This step, by considering static and dynamic indicators, can more comprehensively assess the complexity of the attack path and help determine the difficulty and risk of the attack. The weights are converted into vectors and normalized to provide quantitative weights, allowing different indicators to be weighted. By analyzing the indicator values ​​and weights of different indicators, it can help optimize attack path planning and improve the efficiency and success rate of attacks. Accurately calculating the complexity of the attack path helps security teams develop more effective response strategies and strengthen the system's security protection and emergency response capabilities. In summary, by analyzing, converting, and normalizing the static and dynamic indicators of attack paths, we can more comprehensively assess the complexity of attack paths and provide security teams with quantitative indicators to guide security decisions and the formulation of countermeasures. This method helps improve the efficiency and accuracy of attack path planning, optimize the formulation of security protection strategies, and thus enhance the overall security of the system.

[0029] In an embodiment of the present application, a harmless attack verification and analysis method is provided, in which static indicators and dynamic indicators are analyzed to determine indicator values ​​corresponding to the static indicators and dynamic indicators, including: determining static indicators and dynamic indicators, static indicators including path length, vulnerability exploitation difficulty and tool maturity, dynamic indicators including protection equipment coverage, environmental context matching and attacker resource requirements, and evaluating and valuing each indicator in the static indicators and dynamic indicators respectively to obtain indicator values ​​corresponding to the static indicators and dynamic indicators.

[0030] Specifically, in determining static and dynamic indicators, static indicators include path length, vulnerability exploitation difficulty, and tool maturity; dynamic indicators include protection device coverage, environmental context matching, and attacker resource requirements; among them, path length is the number of steps involved in the attack path, and a longer path means a more complex attack process; vulnerability exploitation difficulty is the difficulty for attackers to exploit vulnerabilities to attack, such as the degree of publicity of the vulnerability and whether professional knowledge is required; tool maturity is the maturity of the tools or technologies used in the attack, including the tool's functionality, stability, and ease of use; protection device coverage is the ability of protection devices to detect and block nodes or traffic in the attack path; environmental context matching is whether the attacker's behavior matches the environmental context of the target system, such as the attacker's location, the equipment used, etc.; attacker resource requirements are the resources, skills, and time costs required for the attack, including the attacker's computing resources, network bandwidth, etc.; for each static and dynamic indicator, professional knowledge, security tools, and intelligence data can be used for evaluation to determine its value range. This step, by considering both static and dynamic indicators, allows for a comprehensive assessment of the complexity, risk, and implementation difficulty of attack paths, helping to formulate appropriate security policies. Accurately evaluating the values ​​of each indicator can provide decision support for the security team, helping them prioritize high-risk attack paths. Understanding dynamic indicators such as protective device coverage and environmental context matching can help optimize security measures and improve system security. The evaluation of dynamic indicators can help the security team detect and respond to attacks more quickly, minimizing losses. In summary, identifying static and dynamic indicators and evaluating and assigning values ​​to them helps comprehensively assess the complexity and risk of attack paths, guide security decisions, and optimize security measures. This approach can improve the security team's understanding of and response to attack paths, enhancing the overall security of the system.

[0031] In an embodiment of the present application, a harmless attack verification and analysis method is provided, wherein the static complexity of the attack path is determined according to the index value and weight of the static index, and the dynamic complexity of the attack path is determined according to the index value and weight of each dynamic index, including: calculating the static complexity of the attack path according to the index value and weight of the static index, wherein the calculation formula of the static complexity of the attack path is: , Where A is the static complexity of the attack path, qi is the weight of the i-th indicator in the static indicator, li is the indicator value of the i-th indicator in the static indicator, and n is the number of indicators in the static indicator; The dynamic complexity of the attack path is calculated based on the indicator value and weight of the dynamic indicator. The calculation formula of the dynamic complexity of the attack path is: , Among them, B is the dynamic complexity of the attack path, pi is the weight of the i-th indicator in the dynamic indicator, ji is the indicator value of the i-th indicator in the dynamic indicator, and m is the number of indicators in the dynamic indicator.

[0032] In an embodiment of the present application, a harmless attack verification and analysis method is provided, which determines the attack priority of a subtask based on the complexity of the attack path, including: pre-setting an attack priority-complexity interval correspondence, wherein the attack priority-complexity interval correspondence is associated with a corresponding attack priority for each complexity interval; obtaining the complexity of the subtask, and based on the mapping relationship between the complexity interval to which the complexity belongs within the attack priority-complexity interval correspondence, selecting the attack priority corresponding to the complexity interval as the attack priority of the subtask.

[0033] Specifically, a predefined attack priority-complexity interval mapping relationship is established, dividing different complexity levels into different intervals and assigning a corresponding attack priority to each interval. For each subtask or attack path, its complexity value is obtained using the previously established complexity assessment method. The subtask's complexity value is then matched against the predefined complexity interval to determine the complexity interval to which it belongs. Based on the complexity interval to which the subtask's complexity belongs, the corresponding attack priority is found in the attack priority-complexity interval mapping relationship. This attack priority is then selected as the subtask's attack priority, prioritizing it during security emergency response or security planning. By mapping complexity to the predefined attack priority-complexity interval mapping relationship, this step ensures that attack tasks of varying complexity are assigned appropriate priorities, facilitating the proper allocation of security resources. Determining the attack priority of subtasks helps security teams respond more quickly to high-priority attacks, reducing security risks. Prioritizing attack tasks based on their complexity helps security teams develop more effective security planning and resource allocation strategies, improving overall security. In summary, by mapping the complexity of subtasks to the attack priority-complexity interval correspondence, we can effectively determine the attack priority of subtasks, improve the emergency response efficiency of the security team, optimize security planning and resource allocation, and thus enhance the overall security of the system. This approach helps to handle and respond to attacks of different complexities in a more organized manner.

[0034] In an embodiment of the present application, a harmless attack verification and analysis method is provided, in which the attack order of subtasks is determined based on the attack priority, and the subtasks perform simulated attack verification on the protection boundary according to the attack order, including: determining the dependency relationship between each subtask, and constructing a directed acyclic graph of the subtasks according to the dependency relationship, and generating a topological sequence of the subtasks according to the directed acyclic graph; determining the attack priority of each subtask, and adjusting the topological sequence according to the attack priority of each subtask on the basis of the topological sequence to obtain the attack order of the subtasks; allocating the subtasks to different simulation nodes, and executing the corresponding subtasks of each simulation node according to the attack order to perform simulated attack verification on the protection boundary.

[0035] Specifically, the dependencies between subtasks are determined, that is, which subtasks need to be executed before other subtasks. A directed acyclic graph of subtasks is constructed based on these dependencies, where nodes represent subtasks and edges represent dependencies between subtasks. A topological sequence is generated in the directed acyclic graph to ensure that subtasks are executed in the constrained order of the dependencies to avoid circular dependencies. The topological sequence is adjusted according to the attack priority to ensure that high-priority subtasks are executed first. Each subtask is assigned to a different simulation node to ensure that different subtasks are executed in parallel. The corresponding subtasks of each simulation node are executed in the attack order to simulate the actual attack scenario to verify the protection boundary. By constructing a directed acyclic graph and determining attack priorities, this step can optimize the execution order of attack tasks, ensure that high-priority tasks are executed first, and improve security response efficiency. By executing attack tasks according to the topological sequence and attack priority, it can reduce errors and confusion during the attack process and improve attack accuracy. Assigning subtasks to different simulation nodes and executing them according to the attack order can improve simulation efficiency, accelerate the verification process, and reduce attack detection and response time. Through simulated attack verification, the security and effectiveness of the protection boundary can be comprehensively tested, potential vulnerabilities can be discovered and repaired in a timely manner, and the overall security of the system can be improved. In summary, by constructing a directed acyclic graph, generating a topological sequence, determining attack priorities and adjusting the attack order, and assigning subtasks to different simulation nodes and performing simulated attack verification, it is possible to optimize the attack execution order, reduce errors, improve simulation efficiency, and comprehensively verify the protection boundary, thereby effectively improving the security and response capabilities of the system.

[0036] like Figure 2As shown, in an embodiment of the present application, a harmless attack verification and analysis system is provided, including: a construction module for obtaining multi-source security data, determining attack cases in the multi-source security data, and constructing an attack knowledge graph based on the attack cases in the multi-source security data; a formulation module for constructing a scenario-based attack flowchart based on the attack knowledge graph, and formulating a harmless attack task based on the attack flowchart; a decomposition module for determining the number of paths and the number of nodes in the attack path in the harmless attack task, and decomposing the harmless attack task into multiple subtasks based on the number of paths and the number of nodes in the attack path; a determination module for obtaining path information of the attack path, determining the complexity of the attack path based on the path information, and determining the attack priority of the subtask based on the complexity of the attack path; a verification module for determining the attack order of the subtask based on the attack priority, and the subtask performs simulated attack verification on the protection boundary according to the attack order.

[0037] In summary, an embodiment of the present invention provides a harmless attack verification and analysis method and system, which includes: obtaining multi-source security data, determining the attack cases therein to construct an attack knowledge graph; constructing a scenario-based attack flowchart based on the attack knowledge graph, and formulating a harmless attack task based on it; determining the number of paths and the number of nodes in the attack path in the harmless attack task, and based on it, decomposing the harmless attack task into multiple subtasks; obtaining the path information of the attack path, determining the complexity of the attack path based on the path information, and determining the attack priority of the subtask based on it; determining the attack order of the subtask based on the attack priority, and having the subtask perform simulated attack verification on the protection boundary according to the attack order. The present invention determines the security and weaknesses of the protection boundary by simulating real attack behaviors to help discover and resolve potential security vulnerabilities, thereby improving the overall security of the information system and ensuring the security of the information system and data.

[0038] Finally, it should be noted that it is apparent that persons skilled in the art may make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, to the extent such modifications and variations fall within the scope of the present invention and its equivalents, the present invention is intended to include such modifications and variations.

[0039] The above description is only an example of an embodiment of the present invention, but it does not limit the scope of the present invention. Any structural changes made according to the present invention, as long as they do not lose the essence of the present invention, should be considered to fall within the scope of protection of the present invention and be subject to restrictions. Technical personnel in the relevant technical field can clearly understand that for the convenience and simplicity of description, the specific working process and related instructions of the platform described above can refer to the corresponding process in the aforementioned platform embodiment, and will not be repeated here.

[0040] The term "comprise," "comprising," or any other similar term is intended to cover a non-exclusive inclusion such that a process, platform, article, or apparatus / platform that comprises a list of elements includes not only those elements but also other elements not expressly listed or inherent to such process, platform, article, or apparatus / platform.

[0041] Thus far, the technical solutions of the present invention have been described in conjunction with the further embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art may make equivalent changes or substitutions to closely related technical features, and the technical solutions after such changes or substitutions will fall within the scope of protection of the present invention.

[0042] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention.

Claims

1. A harmless attack verification and analysis method, characterized in that: include: Acquire multi-source security data, identify attack cases in the multi-source security data, and construct an attack knowledge graph based on the attack cases in the multi-source security data; Build a scenario-based attack flowchart based on the attack knowledge graph, and formulate harmless attack tasks based on the attack flowchart; Determine the number of paths and nodes in the attack path of the harmless attack task, and decompose the harmless attack task into multiple subtasks based on the number of paths and nodes in the attack path; Obtaining path information of the attack path, determining the complexity of the attack path based on the path information, and determining the attack priority of the subtask based on the complexity of the attack path; The attack order of the subtasks is determined based on the attack priority, and the subtasks perform simulated attack verification on the protection boundary according to the attack order.

2. A harmless attack verification and analysis method according to claim 1, characterized in that: The acquiring of multi-source security data, determining attack cases in the multi-source security data, and constructing an attack knowledge graph based on the attack cases in the multi-source security data include: Acquire multi-source security data on the Internet through web crawlers and pre-process the multi-source security data, including data cleaning and data standardization; Identify attack events from pre-processed multi-source security data, and determine attack cases in the multi-source security data based on the attack events; Use the preset extraction model to extract the entities involved in the attack case, and analyze the relationship between different entities in the attack case based on dependency syntax; An attack knowledge graph is constructed based on the relationships between entities and entities, and the attack knowledge graph is updated regularly.

3. A harmless attack verification and analysis method according to claim 2, characterized in that: The attack knowledge graph is used to construct a scenario-based attack flowchart, and harmless attack tasks are formulated based on the attack flowchart, including: Determine the attack scenarios corresponding to different attack cases in the attack knowledge graph, and determine the attackers, attack targets, attack methods, and attack paths in attack cases under different attack scenarios; The attacker, attack target, attack method and attack path are graphically drawn into an attack flowchart, and the attack flowchart is imported into a preset harmless attack engine, which automatically generates a harmless attack task.

4. A harmless attack verification and analysis method according to claim 3, characterized in that: The determining of the number of paths and the number of nodes in the attack path in the harmless attack task, and decomposing the harmless attack task into a plurality of subtasks based on the number of paths and the number of nodes in the attack path, includes: The number of paths and the number of nodes in the attack path in the harmless attack task are determined, the product of the number of paths and the number of nodes is calculated, and the harmless attack task is decomposed into multiple subtasks according to the product result.

5. A harmless attack verification and analysis method according to claim 4, characterized in that: The obtaining path information of the attack path and determining the complexity of the attack path based on the path information includes: Obtaining path information of the attack path, which includes static indicators and dynamic indicators, and analyzing the static indicators and dynamic indicators to determine the indicator values ​​corresponding to the static indicators and the dynamic indicators; Each static indicator and each dynamic indicator is converted into a vector respectively, and the vectorized static indicators and dynamic indicators are normalized to obtain the weights corresponding to each static indicator and each dynamic indicator respectively; The static complexity of the attack path is determined based on the indicator values ​​and weights of the static indicators, and the dynamic complexity of the attack path is determined based on the indicator values ​​and weights of each dynamic indicator; The static complexity of the attack path and the dynamic complexity of the attack path are added together to obtain the complexity of the attack path.

6. A harmless attack verification and analysis method according to claim 5, characterized in that: The analyzing of the static indicators and the dynamic indicators to determine the indicator values ​​corresponding to the static indicators and the dynamic indicators includes: Determine static indicators and dynamic indicators. Static indicators include path length, vulnerability exploitation difficulty, and tool maturity. Dynamic indicators include protection equipment coverage, environmental context matching, and attacker resource requirements. Evaluate and value each indicator in the static indicators and dynamic indicators separately to obtain the indicator values ​​corresponding to the static indicators and dynamic indicators.

7. A harmless attack verification and analysis method according to claim 5, characterized in that: Determining the static complexity of the attack path based on the indicator values ​​and weights of the static indicators, and determining the dynamic complexity of the attack path based on the indicator values ​​and weights of the dynamic indicators, includes: The static complexity of the attack path is calculated based on the index value and weight of the static index. The calculation formula of the static complexity of the attack path is: ， Where A is the static complexity of the attack path, qi is the weight of the i-th indicator in the static indicator, li is the indicator value of the i-th indicator in the static indicator, and n is the number of indicators in the static indicator; The dynamic complexity of the attack path is calculated based on the indicator value and weight of the dynamic indicator. The calculation formula of the dynamic complexity of the attack path is: ， Among them, B is the dynamic complexity of the attack path, pi is the weight of the i-th indicator in the dynamic indicator, ji is the indicator value of the i-th indicator in the dynamic indicator, and m is the number of indicators in the dynamic indicator.

8. A harmless attack verification and analysis method according to claim 5, characterized in that: Determining the attack priority of the subtask based on the complexity of the attack path includes: A correspondence between attack priority and complexity interval is pre-set, wherein the correspondence between attack priority and complexity interval is associated with a corresponding attack priority for each complexity interval; The complexity of the subtask is obtained, and based on the mapping relationship between the complexity interval to which the complexity belongs and the attack priority-complexity interval correspondence, the attack priority corresponding to the complexity interval is selected as the attack priority of the subtask.

9. A harmless attack verification and analysis method according to claim 8, characterized in that: The attack sequence of the subtasks is determined based on the attack priority, and the subtasks perform simulated attack verification on the protection boundary according to the attack sequence, including: Determine the dependencies between subtasks, build a directed acyclic graph of subtasks based on the dependencies, and generate a topological sequence of subtasks based on the directed acyclic graph; Determine the attack priority of each subtask, and adjust the topological sequence according to the attack priority of each subtask on the basis of the topological sequence to obtain the attack order of the subtasks; Assign subtasks to different simulation nodes, and execute the corresponding subtasks of each simulation node in the attack order to verify the protection boundary through simulation attacks.

10. A harmless attack verification and analysis system, characterized in that: include: A construction module for acquiring multi-source security data, identifying attack cases in the multi-source security data, and constructing an attack knowledge graph based on the attack cases in the multi-source security data; A development module is used to build a scenario-based attack flowchart based on the attack knowledge graph and formulate harmless attack tasks based on the attack flowchart; a decomposition module, configured to determine the number of paths and the number of nodes in the attack path in the harmless attack task, and decompose the harmless attack task into a plurality of subtasks based on the number of paths and the number of nodes in the attack path; a determination module, configured to obtain path information of an attack path, determine the complexity of the attack path based on the path information, and determine the attack priority of a subtask based on the complexity of the attack path; The verification module is used to determine the attack order of subtasks based on the attack priority, and the subtasks perform simulated attack verification on the protection boundary according to the attack order.

Images