Host risk assessment method, electronic equipment and storage medium

Abstract

The invention discloses a host risk assessment method, electronic equipment and a storage medium, and belongs to the field of network security. The method comprises the steps that a Bayesian attack graph is constructed, nodes of the Bayesian attack graph represent the authority state of an attacker, and directed edges of the Bayesian attack graph represent vulnerability utilization paths between hosts; the atomic attack success probability of each edge is calculated in combination with vulnerability availability and time attributes, and vulnerability influence values are quantified based on the influence of vulnerabilities on confidentiality, integrity and availability; determining probability distribution of occupied nodes through a Bayesian conditional probability rule, traversing attack paths to integrate attack probabilities and influence values, and calculating the maximum risk value of each node; and accumulating the risk value of each permission node of the target host to obtain a host comprehensive risk, calculating a key coefficient through the risk variation of the associated node after host reinforcement, and identifying a network key host. According to the method, the vulnerability quantitative evaluation and the Bayesian attack graph are creatively fused, the actual threat of the vulnerability to the host is accurately reflected, and priority decision support is provided for network security protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a host risk assessment method, an electronic device and a storage medium. BACKGROUND

[0002] With the rapid development and wide application of information technology, network systems play a crucial role in various industries. However, the accompanying network security threats are also increasing, and network attack methods are becoming increasingly diversified and complex, seriously threatening the security and stability of network systems. Therefore, how to effectively identify and assess security risks in network systems has become one of the core problems of network security.

[0003] In network system security risk assessment, discovering and identifying key hosts and conducting comprehensive risk assessment on them are key means to ensure system security. Key hosts usually carry important data and services, and once attacked, may cause serious security incidents and economic losses. Therefore, a scientific and systematic risk assessment method is of great significance to improve the defense and response capabilities of network systems.

[0004] Currently, attack graph-based host risk assessment methods are widely used in the field of network security. This method starts from the perspective of attackers, uses directed graphs to describe the relationship and interaction between various security elements in the network system, and visually displays the vulnerabilities and stepping stones that attackers may exploit through attack paths. Attack graphs can clearly reveal potential attack paths and key vulnerabilities, helping security analysts more effectively identify and assess the risk status of hosts.

[0005] However, traditional attack graph-based risk assessment methods usually focus on a single attack path, such as the path with the highest attack probability or the highest risk. This method can reflect the security risks of the system to some extent, but due to the neglect of the actual situation that attackers may use multiple path combinations to penetrate the network, the risk assessment results are one-sided and incomplete, and cannot fully reflect the real risk status of the network system.

[0006] In order to solve the above problems, the Bayesian attack graph-based method has emerged. The Bayesian attack graph introduces a Bayesian probability model based on the traditional attack graph, which can more comprehensively consider the combination probability of multiple attack paths, enhancing the scientificity and accuracy of risk assessment. However, the existing Bayesian attack graph-based risk assessment method still has some shortcomings, mainly manifested in the inability to effectively quantify the degree of actual impact of vulnerabilities on hosts. For example, the damage degree of vulnerabilities to host confidentiality, integrity and availability is not fully considered, resulting in risk assessment results relying only on probability data, lacking of actual damage measurement dimension, and easily leading to deviation of assessment results from actual risk status.

[0007] Therefore, how to further introduce quantitative evaluation of the influence degree of the vulnerability on the basis of the Bayesian attack graph, and comprehensively reflect the actual threat of the vulnerability to the security of the host, has become a technical problem to be solved. SUMMARY

[0008] The main purpose of the present application is to provide a host risk assessment method, electronic equipment and storage medium, which aims to further introduce quantitative evaluation of the influence degree of the vulnerability on the basis of the Bayesian attack graph, and comprehensively reflect the actual threat of the vulnerability to the security of the host.

[0009] In order to achieve the above-mentioned purpose, the present application provides a host risk assessment method, comprising the following steps: According to the host vulnerability information, the host access matrix and the attack template, a Bayesian attack graph is generated, the Bayesian attack graph is composed of an attribute node set, a directed edge set and a node and edge relationship set, the attribute node represents the access permission state of the attacker to the host, and the directed edge represents the vulnerability utilization path between the hosts; Based on the vulnerability exploitability and the time exploitability of the vulnerability, the atomic attack success probability corresponding to each directed edge in the Bayesian attack graph is calculated; According to the atomic attack success probability and the node and edge relationship set in the Bayesian attack graph, the conditional probability of each node being occupied is calculated; According to the influence of the vulnerability on the confidentiality, integrity and availability of the host, the vulnerability influence value corresponding to each directed edge is quantified; By traversing all possible attack paths, the atomic attack success probability and the vulnerability influence value are combined to calculate the maximum risk value of each attribute node; The risk values of different permission attribute nodes of the target host are accumulated to obtain the maximum risk of the host. According to the change amount of the risk values of the host and its descendant nodes before and after being protected, the key coefficient of the host is calculated, which is used to determine the key host in the network.

[0010] In an embodiment of the present application, when the Bayesian attack graph is generated, the unique identifier of the vulnerability in the attack template is assigned as an array by merging the vulnerabilities with logical AND relationship, and the logical relationship in the relationship set is unified as logical OR.

[0011] In an embodiment of the present application, the calculation of the atomic attack success probability comprises: The vulnerability exploitability is calculated based on the attack complexity and user interaction in the vulnerability CVSS attribute; The time exploitability is calculated by obtaining the vulnerability disclosure time; The time exploitability and the vulnerability exploitability are multiplied to obtain the atomic attack success probability.

[0012] In an embodiment of the present application, the calculation formula of the conditional probability occupied by each node is:

[0013] wherein, denotes the target attribute node; denotes the parent node set of the state of the th parent node in the parent node set; denotes the directed edge from the parent node to the target node denotes the atomic attack success probability of the edge

[0014] In an embodiment of the present application, the calculation of the key coefficient satisfies:

[0015] wherein, denotes the key coefficient of the host denotes the unique identifier of the target host; denotes the corresponding attribute node of the host in the Bayesian attack graph; denotes the set of the corresponding attribute node of the host and all its descendant nodes; denotes the risk value of the node

[0016] In an embodiment of the present application, the calculation of the vulnerability impact value satisfies the following formula:

[0017] wherein, C, I, A are the confidentiality, integrity and availability impact values of the vulnerability respectively.

[0018] In an embodiment of the present application, the time availability calculation satisfies:

[0019] wherein, denotes the scale parameter of the Pareto distribution, = 0.05029; denotes the shape parameter of the Pareto distribution, = 0.552, is the number of days from the vulnerability release date to the calculation date.

[0020] ​​​​​The application also discloses an electronic device, one or more processors, a memory, and one or more computer programs; wherein the one or more computer programs are stored on the memory and, when the computer programs are executed by the one or more processors, cause the electronic device to perform the host risk assessment method according to any one of the above.

[0021] The application also discloses a computer readable storage medium comprising a computer program, which, when running on an electronic device, causes the electronic device to perform the host risk assessment method according to any one of the above.

[0022] By using the technical scheme, the risk of each host in the network can be comprehensively evaluated through the Bayesian attack graph. By considering the influence of all attack paths and vulnerabilities, more accurate risk assessment is provided, and the limitation of single attack path calculation is avoided. Meanwhile, the method can combine atomic attack success probability, vulnerability influence value, conditional probability and other factors to quantify the maximum risk faced by the host, and identify the key hosts in the network through a key coefficient. By protecting these key hosts, the overall security risk of the network can be significantly reduced, and the network protection strategy can be optimized. BRIEF DESCRIPTION OF DRAWINGS

[0023] The application will be described in detail below with reference to specific embodiments and drawings, in which: Figure 1 FIG. 1 is a structural schematic diagram of the first embodiment of the application; Figure 2 FIG. 2 is a network topology diagram of an experimental environment; Figure 3 FIG. 3 is a Bayesian attack graph of the experimental environment; Figure 4 FIG. 4 is a Bayesian attack graph. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical scheme and advantages of the application more clear, the application will be described in detail below with reference to the drawings and embodiments. It should be understood that the following specific embodiments are only used to explain the application and do not limit the application.

[0025] As shown in FIG. 1, in order to achieve the above purpose, the application proposes a host risk assessment method, which comprises the following steps: Figure 1 According to the host vulnerability information, the host access matrix and the attack template, a Bayesian attack graph is generated, the Bayesian attack graph is composed of an attribute node set, a directed edge set and a node and edge relationship set, the attribute node represents the access permission state of the attacker to the host, and the directed edge represents the vulnerability utilization path between the hosts. ​Based on the vulnerability-based vulnerability exploitability and time exploitability, the atomic attack success probability corresponding to each directed edge in the Bayesian attack graph is calculated; According to the atomic attack success probability and the relationship set of the nodes and the incoming edges in the Bayesian attack graph, the conditional probability of each node being occupied is calculated; According to the influence of the vulnerability on the confidentiality, integrity and availability of the host, the vulnerability influence value corresponding to each directed edge is quantified; By traversing all possible attack paths, the maximum risk value of each attribute node is calculated by combining the atomic attack success probability and the vulnerability influence value; The risk values of different permission attribute nodes of the target host are accumulated to obtain the maximum risk of the host; According to the change amount of the risk values of the host and its descendant nodes before and after the host is protected, the critical coefficient of the host is calculated, which is used to determine the critical host in the network.

[0026] By using the above technical scheme, the attack path is modeled by the Bayesian attack graph, the time exploitability (such as vulnerability disclosure time) of the vulnerability is combined, the change of the attack probability with time is dynamically reflected, and the lag of the traditional static vulnerability scoring is avoided. The attack success probability (atomic attack probability) of the vulnerability and the actual damage value (confidentiality, integrity, availability influence) are combined to calculate the risk, considering the attack feasibility and destructiveness. The critical coefficient (risk difference before and after the host is protected) is used to quantify the contribution of the host to the overall network security, and the critical node with the greatest impact on the global risk is identified. Based on the breadth-first search (BFS), the Bayesian attack graph is automatically generated, and the automation of risk assessment is realized by using graph theory and probability calculation. By traversing all possible attack paths and assuming that the attacker adopts the optimal strategy (such as preferentially using high-impact-value vulnerabilities), the maximum risk value of the host is calculated. The output results include host risk value sorting, critical coefficient list and other structured data, and the network vulnerabilities are intuitively displayed.

[0027] In an embodiment of the present application, when the Bayesian attack graph is generated, the unique identifiers of the vulnerabilities in the attack template are assigned as arrays by merging the vulnerabilities with logical "and" relationship, and the logical relationship in the relationship set is unified as logical "or".

[0028] By using the above technical scheme, the complex attack path originally requiring multiple successful vulnerabilities (AND relationship) is combined into a single logical unit, reducing the number of nodes and edges in the graph. The incoming edges of all nodes are unified as "OR", avoiding the joint probability calculation required for processing "AND" relationship.

[0029] In an embodiment of the present application, the calculation of the atomic attack success probability includes: Based on the attack complexity and user interaction in the vulnerability CVSS attribute, the vulnerability exploitability is calculated; Obtain the vulnerability disclosure time and calculate its exploitability. Multiply the time availability and the vulnerability availability to obtain the probability of a successful atomic attack.

[0030] By employing the above technical solution, and combining CVSS technical indicators with a time-evolution model, the actual exploitation difficulty faced by attackers is quantified, avoiding the subjective bias of traditional CVSS scoring. This reflects risk changes throughout the vulnerability lifecycle and supports real-time risk monitoring.

[0031] In one embodiment of this application, the formula for calculating the conditional probability of each node being occupied is as follows:

[0032] in, Represents the target attribute node; express The set of parent nodes; The first in the parent node set The state of each parent node; Indicates the distance from the parent node to the target node. The directed edges; Representing an edge The probability of a successful atomic attack.

[0033] By adopting the above technical solution, the OR logical relationship is calculated using the complement of the product form, which simplifies the complex joint probability calculation into a single-level algebraic operation and improves the computational efficiency.

[0034] In one embodiment of this application, the calculation of the key coefficients satisfies:

[0035] in, Indicates host Key coefficients; A unique identifier representing the target host; Indicates host The corresponding attribute node in the Bayesian attack graph; Indicates host Corresponding attribute nodes The set of all its descendant nodes; Represents a node The risk value.

[0036] Adopting the technical scheme, the key coefficient of the host can be accurately calculated, the change of the risk value of the descendant node before and after protection of the host is evaluated, and the importance of the host in network security is determined. The host with a larger key coefficient has a greater impact on network security, and thus can be preferentially protected to reduce the overall network risk. This method can help the network administrator to concentrate on protecting the host with the greatest impact on the overall network security under limited resources, optimize the network security protection strategy, and improve the protection efficiency.

[0037] In an embodiment of the present application, the calculation of the vulnerability impact value satisfies the following formula:

[0038] Wherein, C, I, and A are the confidentiality, integrity, and availability impact values of the vulnerability.

[0039] Adopting the technical scheme, the confidentiality, integrity, and availability impact values can be fused into a comprehensive score of a unified dimension by the normalization formula, overcoming the limitations of traditional methods that rely on only a single index or simple weighting; the CVSS standard is used to ensure the objectivity and industry acceptance of the values of C, I, and A, and the compatibility of the results with the general score is achieved through the 10.41 coefficient, facilitating direct comparison of the vulnerability threat levels; the combined effect of CIA is dynamically reflected, the actual harm of the vulnerability to the host is more accurately quantified, and multi-dimensional data support is provided for risk assessment.

[0040] In an embodiment of the present application, the time availability calculation satisfies:

[0041] Wherein, represents the scale parameter of the Pareto distribution, = 0.05029; represents the shape parameter of the Pareto distribution, = 0.552, is the number of days from the publication date of the vulnerability to the calculation date.

[0042] Adopting the technical scheme, the atomic attack success probability of the vulnerability can be comprehensively calculated. By combining the attack complexity and user interaction in the CVSS score to calculate the exploitability of the vulnerability and combining the Pareto distribution of the vulnerability disclosure time to calculate the time availability of the vulnerability, the behavior of the attacker when exploiting the vulnerability can be more accurately simulated. By comprehensively considering the exploitability and time availability of the vulnerability, a more accurate attack success probability can be provided for risk assessment in the Bayesian attack graph, which helps to accurately evaluate the potential security risks in the network system and improve the effectiveness of network protection.

[0043] The application also discloses an electronic device, one or more processors, a memory, and one or more computer programs; wherein the one or more computer programs are stored in the memory, and when the computer programs are executed by the one or more processors, the electronic device performs the host risk assessment method according to any one of the above.

[0044] The application also discloses a computer readable storage medium, comprising a computer program, when the computer program runs on an electronic device, the electronic device performs the host risk assessment method according to any one of the above.

[0045] Bayesian attack graph definition: An attack graph is a directed graph composed of system states and attack behaviors, which describes the system vulnerabilities and their relationships. Common attack graph types include state attack graph, attribute attack graph, and attribute-dependent attack graph. The Bayesian attack graph (BAG) is generated based on the attribute-dependent attack graph and the Bayesian network, and can be represented as a triple, i.e. , and the specific definition is as follows: is a set of attribute nodes, wherein represents an attacker host. Any attribute node is described using a binary tuple , wherein is the unique identifier of the host; is the access permission of the attacker host to the host , which is divided into three types: administrator permission root, normal user permission user, and unauthorized null. , wherein 1 indicates that the attacker has occupied the node, and 0 indicates that the attacker has not occupied the node.

[0046] is a set of directed edges in the Bayesian attack graph, representing a specific vulnerability exploitation between two hosts. Using the Common Vulnerability Scoring System (CVSS), any edge is described using a ten-tuple , wherein: and are the unique identifiers of the attack host attribute node and the attacked host attribute node, respectively; is the unique identifier of the vulnerability used by the attack; and the last seven are the CVSS attributes of the corresponding vulnerability, representing the attack path, attack complexity, permission requirement, user interaction, confidentiality impact, integrity impact, and availability impact, respectively.

[0047] is the set of relations of the property node with its incoming edges, determined according to the dependency between each vulnerability. For any , use the two-tuple , to describe, where is the property node, is the relation of the property node with its incoming edges. , represents that all the attacks represented by the incoming edges of have succeeded, and the attacker can occupy ; represents that one of the attacks represented by the incoming edges of has succeeded, and the attacker can occupy . Bayesian attack graph generation defines the attack template , where: is the unique identifier of the vulnerability exploited by the attack; represents the prerequisite for the attack to occur; represents the consequence of the attack. and use the two-tuple to describe, i.e., the attacker needs to access the service of the target host and the attacker's permission to the target host. and can be obtained by querying the attack pattern library. In order to determine the set in the Bayesian attack graph, it is necessary to first traverse the vulnerabilities existing in each host, merge the vulnerabilities with existing relations according to the attack pattern, assign in the attack template to an array, and take the maximum value of the two, so that the value of later only .

[0048] In most cases, the improvement of the attacker's attack ability can be attributed to the improvement of the permission. When the attacker obtains the attack permission of a host, he obtains the ability to attack other hosts connected to the host. Therefore, based on the breadth-first traversal in graph theory, the Bayesian attack graph is generated starting from the permission improvement. First, the topology detection and vulnerability scanning of the target network are performed to obtain the host vulnerability information , including the set of vulnerability numbers existing in each host; the host access matrix HTH, including the set of services servs that can be accessed between hosts; the attack template The attack pattern library can be obtained. Then, the initial attribute node is added and the hosts accessible by the attacker host are stacked, the stack and the attack graph are initialized. Finally, breadth-first traversal is performed, the stack is popped when the stack is not empty, the vulnerability set on the target host is traversed, it is judged whether the prerequisite of the attack template is met, if yes, the attribute node is added and the directed edge is generated. After the vulnerability traversal, the hosts accessible by the target host are stacked, and finally the elements in R are assigned as OR.

[0049] The time complexity of the algorithm is , where N is the number of hosts in the network, E is the number of edges in the network topology graph, i.e. the number of elements that are not empty in HTH, and V is the maximum number of vulnerabilities existing in the host.

[0050] After generating the Bayesian attack graph, the ancestor nodes and descendant nodes of each attribute node can be obtained, on the basis of which the maximum risk faced by the host can be evaluated. In order to calculate the maximum risk of the host, it is necessary to evaluate the maximum risk of the attribute node corresponding to the host, and to quantify the atomic attack success probability, the conditional probability and the vulnerability impact value.

[0051] Vulnerability exploitability: Vulnerability exploitability (VE) represents the difficulty of exploiting a vulnerability, which is only related to the vulnerability itself and can be quantified using CVSS. The calculation method of VE is shown in formula (1).

[0052] (1) AV and PR are both static and isolated measures of vulnerability danger, and as part of the atomic attack success probability, the calculation of vulnerability exploitability should not include them, otherwise it will reduce the atomic attack success probability. Therefore, only the attack complexity and user interaction are used to calculate the vulnerability exploitability.

[0053] 2.1.2 Vulnerability temporal exploitability From the perspective of time, the longer the vulnerability has been disclosed, the more in-depth the attacker's research will be, and the greater the possibility of obtaining attack code and tools will be. The vulnerability temporal exploitability before and after disclosure is best matched with the Pareto distribution, as shown in formula (2).

[0054] (2) wherein and are the parameters of the Pareto distribution, which are 0.05029 and 0.552 respectively, represents the number of days from the vulnerability release date to the calculation date.

[0055] For The atomic attack represented by the atomic attack success probability calculation method as formula (3).

[0056] (3) wherein, and respectively represent the scores of the vulnerability in the two dimensions of vulnerability exploitability and vulnerability temporal exploitability.

[0057] 2.2 Conditional probability Let be the parent node set of the attribute node , denoted as , and let be the directed edge set between the attribute node and its parent nodes, denoted as . In order to facilitate the calculation of conditional probability and based on the assumption that the attacker will not use multiple vulnerabilities to attack the target host on the same attack host, take the maximum vulnerability in the atomic attack success probability of the exploitable vulnerability between the two attribute nodes. According to the above, may represent a "vulnerability" obtained by combining multiple vulnerabilities that exist in an AND relationship, and its atomic attack success probability is the product of the atomic attack success probabilities of each vulnerability. When the vulnerabilities that exist in an AND relationship are combined, the value of only has one OR case.

[0058] The parent node set n has two cases, representing the case where the parent node is occupied. represents the conditional probability of being occupied, i.e., the probability of being occupied under the condition that the parent node is occupied, since the value of is OR, the conditional probability calculation method is as formula (4).

[0059] (4) 2.3 Impact of vulnerability on host According to CVSS, the impact value of a single vulnerability on the target host is calculated as formula (5).

[0060] (5) 2.4 Maximum risk of attribute node In the evaluation of host risk, the host attack graph-based evaluation method often looks for the maximum probability attack path or the maximum risk attack path to evaluate the risk of the host, and the attacker's attack strategy is to take one attack path. The Bayesian attack graph-based evaluation method often calculates the reachable probability of the host, considering all attack paths, and the attacker's attack strategy is to try all attack paths, and before occupying each attribute node, it will first try to occupy all parent nodes of the target node. The second attack strategy maximizes the probability of node occupation, making it easier to evaluate the maximum risk faced by the host. Therefore, assuming that the attacker adopts the second attack strategy, the maximum risk faced by the host is evaluated while considering the vulnerability impact value. Let the node have n ancestor nodes, denoted as , then , the prior reachable probability of is calculated as formula (6).

[0061] (6) There are multiple cases for the values of the parent nodes of the target attribute node of the target host. Considering multiple parent nodes being occupied: assuming that the attacker will not repeatedly occupy the target host, the attacker will adopt different strategies when attacking the target host, i.e., different attack sequences. First, consider the case where only two parent nodes are occupied, taking Figure 4 as an example.

[0062] Assuming that the parent nodes of the target attribute node have atomic attack success probabilities and vulnerability impact values of and , respectively, and the parent node has atomic attack success probabilities and vulnerability impact values of and , respectively. According to the above assumptions, the conditional risk of the attribute node caused by the attack sequence (1, 2) is as formula (7).

[0063] (7) The conditional risk of the attribute node caused by the attack sequence (2, 1) is as formula (8).

[0064] (8) The difference between the two is as formula (9).

[0065] (9) It can be found that when the target attribute node has only two occupied parent nodes, the attacker first uses the vulnerability with a greater impact value to cause greater risk. Then consider the case where there are ​ The occupied parent node case, the same reason is not difficult to prove: for a specific attack sequence, take any two adjacent attack sequence, first use the impact of the larger value of the vulnerability corresponding attack sequence caused greater risk, therefore, using a similar bubble sort strategy, can make the attack sequence risk increases, eventually get the risk of the attack sequence is , and the corresponding vulnerability impact value descending order.

[0066] According to the definition of formula 6, the maximum risk of attribute node is as formula (10).

[0067] (10) Assume that the occupied node in t, denoted as , the parent node into the edge is denoted as , and the impact value of the parent node into the edge is arranged in descending order, that is, the elements in the attack sequence are arranged in descending order, and the corresponding atomic attack probability is denoted as . Similar to formula 7, the conditional risk of attribute node is as formula (11).

[0068] (11) 2.5 Maximum risk of host The attacker can obtain the target host's permission has and root two cases, in which the root permission may be directly promoted to root permission by some vulnerabilities from null permission, or the user permission is promoted to root permission, that is, local privilege escalation. According to the attack strategy analyzed above, the attacker will try to obtain the root permission of the host, and the maximum risk of the host should be the sum of the risks of all attribute nodes of the host, as formula (12).

[0069] (12) 2.6 Key coefficient There are some key hosts in the network, and the security of these hosts greatly affects the security of the whole network. Therefore, determining the key hosts in the network and taking relevant security measures to improve security is also a hot issue of current concern.

[0070] The key host is a host that has a greater impact on the security of the network system. From the perspective of whether the host is protected, its descendant nodes are difficult to be attacked after the host is protected, resulting in a decrease in the risk of the descendant nodes. The key coefficient is defined to quantify the criticality of the host, and the host The key coefficient of the target host is the difference between the sum of the risks of the target host and its descendant nodes before and after being protected. Assuming that the target host corresponds to an attribute node and its descendant nodes have b, denoted as The key coefficient calculation method is shown in formula (13).

[0071] (13) The greater the key coefficient of the host, the greater the benefit of protecting it for the network manager, so the key coefficient can be used as an important reference for the network manager to protect the host security. The network manager can focus on protecting the key host, which can greatly reduce the workload while ensuring the security of the network system.

[0072] The following is an example: A laboratory is constructed as shown in Figure 2 .

[0073] Among them, the hosts H4 and H5 use the Win10 operating system, and the rest of the hosts use the CentOS7 operating system; the DMZ domain is used to provide Web services (Nginx), FTP services (zFTPServer), and mail services (Apache Commons Mail); the D1 domain is the internal office network of the enterprise, the D2 domain is the system business area of the enterprise, and the D3 domain is the data storage area (PostgreSQL). The network area is divided by installing a firewall, and the inter-subnet communication rules are formulated, so that external access cannot reach the internal network area, i.e., the D1, D2, and D3 domains. The connection relationship of the hosts is shown in Table 1.

[0074] Table 1 Host connection relationship table (1 represents connection, and blank represents no connection)

[0075] Nessus is used to perform vulnerability scanning on the experimental network, and the host vulnerability information is shown in Table 2.

[0076] Table 2 Host vulnerability information

[0077] A Bayesian attack graph is generated based on the Bayesian attack graph generation algorithm, as shown in Figure 3 .

[0078] The atomic attack success probability and the vulnerability impact value corresponding to the directed edges in the Bayesian attack graph are calculated, and the results are shown in Table 3.

[0079] Table 3 Atomic attack success probability and vulnerability impact value

[0080] The attribute node risk of each host is calculated using formula 13, and the result is shown in Table 5.

[0081] Table 4 Attribute node risk

[0082] The critical coefficient of each host is calculated using formula 13, and the result is shown in Table 5.

[0083] Table 5 Critical coefficient of host

[0084] The above merely describes the preferred embodiments of the present application, and is not intended to limit the patent scope of the present application. Any equivalent structural transformation, direct / indirect application in other related technical fields, or the like, made under the inventive concept of the present application, using the content of the present application specification and drawings, is included in the patent protection scope of the present application.

Claims

1. A host risk assessment method, characterized in that, Includes the following steps: Based on host vulnerability information, host access matrix and attack template, a Bayesian attack graph is generated. The Bayesian attack graph consists of a set of attribute nodes, a set of directed edges and a set of relationships between nodes and incoming edges. Attribute nodes represent the attacker's access permission status to the host, and directed edges represent the vulnerability exploitation path between hosts. Based on the vulnerability exploitability and time exploitability, calculate the probability of successful atomic attack corresponding to each directed edge in the Bayesian attack graph. Based on the success probability of an atomic attack and the set of relationships between nodes and incoming edges in the Bayesian attack graph, calculate the conditional probability of each node being occupied. Based on the impact of vulnerabilities on the confidentiality, integrity, and availability of the host, the vulnerability impact value corresponding to each directed edge is quantified. By traversing all possible attack paths, and combining the success probability of atomic attacks and the impact value of vulnerabilities, the maximum risk value of each attribute node is calculated. The risk values ​​of nodes with different permission attributes on the target host are summed to obtain the maximum risk of the host. Based on the changes in the risk values ​​of the host itself and its descendant nodes before and after protection, the criticality coefficient of the host is calculated to identify critical hosts in the network.

2. The host risk assessment method as described in claim 1, characterized in that, When generating the Bayesian attack graph, vulnerabilities with logical "AND" relationships are merged, the unique identifier of the vulnerability in the attack template is assigned to an array, and the logical relationships in the relationship set are unified into logical "OR".

3. The host risk assessment method as described in claim 1, characterized in that, The calculation of the probability of success of the atomic attack includes: The exploitability of vulnerabilities is calculated based on the attack complexity and user interaction in the vulnerability's CVSS attributes. Obtain the vulnerability disclosure time and calculate its exploitability. Multiply the time availability and the vulnerability availability to obtain the probability of a successful atomic attack.

4. The host risk assessment method as described in claim 1, characterized in that, The formula for calculating the conditional probability of each node being occupied is: in, Represents the target attribute node; express The set of parent nodes; The first in the parent node set The state of each parent node; Indicates the distance from the parent node to the target node. The directed edges; Representing an edge The probability of a successful atomic attack.

5. The host risk assessment method as described in claim 1, characterized in that, The calculation of the key coefficients satisfies: in, Indicates host Key coefficients; A unique identifier representing the target host; Indicates host The corresponding attribute node in the Bayesian attack graph; Indicates host Corresponding attribute nodes The set of all its descendant nodes; Represents a node The risk value.

6. The host risk assessment method as described in claim 1, characterized in that, The impact value of the vulnerability is calculated according to the following formula: Wherein, C, I, and A represent the impact values ​​of the vulnerability on confidentiality, integrity, and availability, respectively.

7. The host risk assessment method as described in claim 3, characterized in that, The time availability calculation satisfies: in, The scale parameter of the Pareto distribution is represented. =0.05029; This represents the shape parameter of the Pareto distribution. =0.552, This represents the number of days from the vulnerability release date to the calculation date.

8. An electronic device, characterized in that, One or more processors, a memory, and one or more computer programs; wherein the one or more computer programs are stored in the memory and, when executed by the one or more processors, cause the electronic device to perform the host risk assessment method as described in any one of claims 1 to 7.

9. A computer-readable storage medium comprising a computer program, characterized in that, When the computer program is run on an electronic device, it causes the electronic device to perform the host risk assessment method as described in any one of claims 1 to 7.

Images