A method and system for evaluating the security posture

Abstract

The application discloses a kind of equal protection evaluation method and system, belong to network security evaluation technical field, its method specifically includes: the relevant data of target system is collected, including: virtualization architecture, network topology, application deployment, vulnerability database and historical security event data, the relevant data collected is preprocessed, constructs initial vulnerability and system isolation attribute data set, establishes the virtualization isolation intensity quantization model based on vulnerability chain propagation, generates multi-hop attack chain to attack, the security isolation index of target system is calculated using the propagation probability between nodes, while defining isolation failure boundary and redundancy protection coefficient, build isolation intensity quantization evaluation model, adaptive evaluation is carried out using machine learning algorithm, and comprehensive evaluation report is generated according to machine learning algorithm output result;The application improves the equal protection evaluation efficiency and accuracy by multi-hop attack chain, especially suitable for cloud native complex environment.

Description

Technical Field

[0001] This invention belongs to the field of network security evaluation technology, specifically a method and system for information security compliance evaluation. Background Technology

[0002] Information security level protection refers to the graded security protection of information systems (network devices) that store, transmit, and process important national information, proprietary information of legal persons and other organizations and citizens, and publicly available information. It also involves graded management of information security products used in these systems and graded response and handling of information security incidents occurring within them. Information security level protection assessment (referred to as "level protection assessment") is an activity conducted by level assessment agencies, based on national information security level protection regulations and in accordance with relevant management standards and technical standards, to inspect and evaluate the security level protection status of information systems that do not involve state secrets.

[0003] Traditional information security level protection assessment methods rely on manual labor, which is inefficient and the assessment results are greatly affected by subjectivity. They require a lot of time and manpower to conduct the assessment and are difficult to dynamically adapt to newly emerging vulnerabilities and attack methods.

[0004] AI technology's advantages in pattern recognition, automated reasoning, and big data analysis provide new methods for information security compliance assessment. However, in cloud-native environments, there is a risk of multi-tenant isolation failure. Relying on static configuration makes it difficult to deal with dynamic attack chains such as container escape, host privilege escalation, and control plane penetration.

[0005] For example, Chinese Patent CN113657849B discloses a method, apparatus, and system for processing information related to information security compliance assessment. The method includes the following steps: obtaining information about a triggered target information security compliance assessment matter and its corresponding target contact information; establishing a group contact object corresponding to the information security compliance assessment matter in an instant messaging tool, obtaining the element components contained in the aforementioned information security compliance assessment matter, adding the element components as contact objects to the group of the aforementioned group contact object to form group members, setting an associated contact for each group member, sending the component content of the element components corresponding to each group member to the aforementioned associated contact for compliance assessment; analyzing the compliance assessment results of each component of the target information security compliance assessment matter and generating an information security compliance assessment report, which is then sent to the aforementioned target contact. This invention simplifies the information security compliance assessment interaction process and improves the efficiency of information security compliance assessment.

[0006] The problems with the aforementioned existing technologies are: difficulty in adapting to environmental changes and new threats, insufficient response to dynamic attack chains, and low accuracy in information security assessments. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention proposes a security protection assessment method and system. By constructing a vulnerability association map, it enables dynamic, quantitative, and intelligent assessment of the security protection capabilities of each isolation level in a virtualized environment.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] A method for information security compliance assessment, comprising:

[0010] Collect relevant data from the target system;

[0011] Based on the collected data related to the target system, a vulnerability association graph is established. A multi-hop attack chain is generated based on the vulnerability association graph to attack the target system. The multi-hop attack chain is generated by the vulnerability association graph and multi-hop path splicing is performed on the generated attack chain. The multi-hop path splicing is performed by jumping splicing according to the edge relationship between vulnerabilities.

[0012] Adaptive compliance assessment is performed using machine learning algorithms, and a compliance assessment report is generated based on the adaptive compliance assessment output.

[0013] Specifically, the step of establishing a vulnerability association graph based on collected target system-related data, generating a multi-hop attack chain based on the vulnerability association graph, and attacking the target system includes:

[0014] Based on the collected data related to the target system, the relationship between container escape vulnerabilities and host machine vulnerabilities is analyzed, and a vulnerability association map is constructed.

[0015] The vulnerability association graph is analyzed to generate multi-hop attack chains, which are then verified and attacked.

[0016] The security isolation index of the target system is calculated using the propagation probability between nodes, while the isolation failure boundary and redundancy protection coefficient are defined.

[0017] Specifically, the process of analyzing the relationship between container escape vulnerabilities and host machine vulnerabilities based on collected target system-related data and constructing a vulnerability association graph includes:

[0018] Integrate CVE and CNVD vulnerability databases to extract metadata about container escape vulnerabilities, host kernel vulnerabilities, and control plane vulnerabilities;

[0019] Establish the relationships between vulnerabilities, including: causal relationships, privileged dependencies, and propagation paths;

[0020] By treating vulnerability metadata as nodes, a vulnerability association graph is constructed.

[0021] Specifically, the process of analyzing the virtualization isolation strength quantification model based on vulnerability chain propagation, generating a multi-hop attack chain, and verifying and attacking it includes:

[0022] Starting with container escape vulnerabilities, we traverse the causal relationships, privileged dependencies, and propagation paths in the vulnerability association graph;

[0023] Monitor the data transmitted from the container process to the host machine, mark privileged operations as key nodes in the attack chain, simulate the control flow transfer for vulnerability exploitation, determine whether the attack path is reachable, analyze the mechanism that triggers the host machine kernel vulnerability when an escape vulnerability occurs, and generate variant payloads targeting the isolation boundary between the container and the host machine.

[0024] Generate an attack chain and perform multi-hop path concatenation on the generated attack chain;

[0025] Verify the assembled attack chain and execute the attack.

[0026] Specifically, the generation of the attack chain and the multi-hop path concatenation of the generated attack chain include:

[0027] Configure the container environment and set the host machine state, and generate an attack chain based on the edge relationships between vulnerabilities;

[0028] By breaking through namespace isolation, gaining ordinary user privileges on the host machine, and analyzing the host machine resources accessed after the escape;

[0029] Match the privileges after escape with the host kernel vulnerability, simulate the use of the host kernel vulnerability to obtain root privileges, and analyze the control capabilities over the host machine;

[0030] By utilizing the propagation path from the host machine to the control plane, we can test whether a control plane vulnerability can take over cluster-level privileges.

[0031] Verify privileged dependencies and propagation paths, and verify whether the network or file system channels between the container, the host machine, and the control plane are open. If the verification is successful, the multi-hop path concatenation is successful; otherwise, the multi-hop path concatenation fails.

[0032] Specifically, the causal relationship includes:

[0033] Analyze the preconditions for vulnerability triggering and verify the causal chain of vulnerability exploitation through static code analysis or dynamic debugging;

[0034] Identify the vulnerability's position in the attack chain;

[0035] Analyze the impact of successful exploitation of the vulnerability on subsequent stages.

[0036] Specifically, the privileged dependencies include:

[0037] Build a three-level permission model for containers, host machines, and the control plane;

[0038] Identify the privileged conditions required for exploiting vulnerabilities;

[0039] Verify the dependency on privileged conditions.

[0040] Specifically, the propagation path includes:

[0041] Identify the communication channels between components of the target system;

[0042] Use taint tracking technology to monitor the transmission path of sensitive data;

[0043] Based on network configuration and service exposure, determine the attack propagation method.

[0044] Specifically, the construction of the isolation strength quantitative assessment model, the use of machine learning algorithms for adaptive evaluation, and the generation of a comprehensive evaluation report based on the output results of the machine learning algorithms include:

[0045] Extract features from the preprocessed target system data, including: spatial isolation, time latency, resource consumption, and historical attack data;

[0046] A quantitative assessment model for isolation strength is constructed using machine learning algorithms and trained. The model is then adaptively updated hourly using newly collected data.

[0047] The features of the preprocessed target system data are input into the trained isolation strength quantification evaluation model, which outputs the isolation strength index and security level of the target system and automatically generates a comprehensive evaluation report.

[0048] A cybersecurity compliance assessment system for implementing the aforementioned cybersecurity compliance assessment method includes: a data processing module, an attack and quantification module, and an evaluation module.

[0049] The data processing module is used to collect relevant data from the target system;

[0050] The attack and quantification module is used to establish a vulnerability association graph based on the collected target system-related data, generate a multi-hop attack chain based on the vulnerability association graph, attack the target system, calculate the security isolation index of the target system using the propagation probability between nodes, and define the isolation failure boundary and redundancy protection coefficient.

[0051] The evaluation module is used to perform adaptive compliance assessment using machine learning algorithms, and generate a compliance assessment report based on the adaptive compliance assessment output.

[0052] Compared with the prior art, the beneficial effects of the present invention are:

[0053] 1. This invention proposes a method for information security compliance assessment, which can significantly improve assessment efficiency and reduce human intervention and subjective bias. In cloud-native environments, this method can dynamically assess complex and dynamic multi-hop attack chains such as multi-tenant isolation, container escape, host privilege escalation, and control plane penetration, effectively making up for the dependence of traditional methods on static configuration and their insufficient adaptability to dynamic security threats, thereby improving the overall information security protection capability. Attached Figure Description

[0054] Figure 1 This invention provides a flowchart of a method for information security level protection assessment.

[0055] Figure 2 A flowchart of a privilege escalation attack chain based on a container environment is provided for this invention.

[0056] Figure 3 The flowchart for generating multi-hop attack chains provided by this invention;

[0057] Figure 4 This is a schematic diagram of a multi-hop attack chain provided by the present invention;

[0058] Figure 5 This invention provides an architecture diagram of a cybersecurity compliance assessment system. Detailed Implementation

[0059] The present application will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present application, but do not limit the present application in any way. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present application. These all fall within the protection scope of the present application.

[0060] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0061] It should be noted that, unless there is a conflict, the various features in the embodiments of this application can be combined with each other, all of which are within the protection scope of this application. Furthermore, although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than the module division in the device or the order in the flowchart. In addition, the terms "first," "second," and "third" used in this application do not limit the data or execution order, but only distinguish identical or similar items with essentially the same function and effect.

[0062] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The term "and / or" as used in this specification includes any and all combinations of one or more of the associated listed items.

[0063] Example 1

[0064] Please see Figures 1-4 The present invention provides an embodiment of a cybersecurity level protection assessment method, comprising the following specific steps:

[0065] Step S1: Collect relevant data about the target system, including: virtualization architecture, network topology, application deployment, vulnerability database, and historical security incident data.

[0066] In this embodiment, the virtualization architecture data of the target system includes: virtualization platform configuration data, such as underlying hardware configuration data, virtual machine monitor version data, etc.; isolation unit data, such as configuration parameter data of each virtual machine, container, virtual network, and storage virtualization scheme; network topology data, including network architecture diagrams, such as internal virtual network topology diagrams, subnet division topology diagrams, and external network topology diagrams, etc.; traffic log data, such as connection log data and traffic monitoring data; application deployment data, such as application and service list data; configuration file data, such as configuration file data of operating system, database, middleware, and security protection devices; vulnerability database and historical security event data, such as known vulnerability information data; and historical security event record data, such as internal security log data, intrusion detection system alarm record data, and security operation and maintenance system alarm data, etc.

[0067] Data acquisition tools include: automated scanning tools, log aggregation tools, and API interface acquisition.

[0068] It should be noted that the collected data has problems such as inconsistent format, redundant noise, and missing values. The preprocessing of this application can adopt existing methods, such as: standardizing the data format and performing standardization processing on data from different sources; cleaning noisy data to filter out irrelevant information and redundant data; and handling missing data by using interpolation, mean filling, nearest neighbor filling and other methods to fill in missing items.

[0069] Step S2: Based on the collected data related to the target system, establish a vulnerability association graph, generate a multi-hop attack chain based on the vulnerability association graph, and attack the target system.

[0070] The specific steps of step S2 are as follows:

[0071] Step S201: Based on the collected target system-related data, analyze the relationship between container escape vulnerabilities and host machine vulnerabilities, and construct a vulnerability association map.

[0072] The specific steps of step S201 are as follows:

[0073] Step S2011: Integrate vulnerability databases such as CVE and CNVD, and extract metadata of container escape vulnerabilities, host kernel vulnerabilities, and control plane vulnerabilities.

[0074] In this embodiment, CVE, Common Vulnerabilities and Exposures, is a publicly available vulnerability database, and CNVD, China National Vulnerability Database, is an information security vulnerability sharing platform. The metadata extraction logic is as follows: structured data extraction, extracting key fields from the vulnerability database, such as vulnerability ID, release time, vulnerability score, affected components, vulnerability type, and patch.

[0075] Step S2012: Establish the edge relationships between vulnerabilities, including: causal relationships, privileged dependencies, and propagation paths.

[0076] The causal relationship of the vulnerabilities in step S2012 refers to the direct causal link between vulnerabilities, including:

[0077] Step S20121-1: Analyze the preconditions for vulnerability triggering and verify the causal chain of vulnerability exploitation through static code analysis or dynamic debugging.

[0078] The preconditions for vulnerability triggering are analyzed using two methods: static code analysis and dynamic debugging. Static code analysis identifies potential vulnerabilities at the code level, while dynamic debugging tracks the program execution process during actual runtime to verify whether the vulnerability triggers the expected causal chain.

[0079] Step S20121-2: Identify the vulnerability's position in the attack chain.

[0080] In this embodiment, the vulnerability's role and attack path are analyzed based on the characteristics of the vulnerability and the associated attack stages to determine the vulnerability's position in the attack chain.

[0081] Step S20121-3: Analyze the impact of successful vulnerability exploitation on subsequent stages.

[0082] In this embodiment, the impact of subsequent stages includes: privilege escalation effect, attack scope expansion, defense mechanism bypass, and data pollution and destruction; privilege escalation effect: if the vulnerability belongs to privilege escalation, successful exploitation will break through the current permission level; attack scope expansion: the components affected by the vulnerability determine the direction of attack spread, and new attack surfaces are exposed after the vulnerability is exploited; defense mechanism bypass: after the container escape vulnerability breaks the isolation measures, the threshold for exploiting the host kernel vulnerability is lowered, allowing direct access to sensitive resources.

[0083] By analyzing the causal relationships between vulnerabilities, we can understand the triggering conditions of the vulnerabilities, their position in the attack chain, and the impact of successful exploitation on subsequent stages, thus providing precise vulnerability remediation strategies.

[0084] The privileged dependencies of the vulnerability in step S2012 include:

[0085] Step S20122-1: Construct a three-level permission model for containers, host machines, and control planes.

[0086] In this embodiment, a three-tiered permission model is constructed using a hierarchical design, downward control, upward isolation, and the principle of least privilege. In this model, containers are at the first tier, hosts are at the second tier, and the control plane is at the third tier. Containers can only access and operate their internal resources; hosts can manage and monitor all containers; and the control plane has full permissions for the entire cluster, including containers, hosts, and other cluster resources. This hierarchical permission model enables access control at different levels.

[0087] Step S20122-2: Identify the privileged conditions required for exploitation.

[0088] Specifically, the exploitation of each vulnerability depends on a specific privilege level and system configuration. By analyzing the characteristics of the vulnerability itself or the composition of the attack chain, and through static code analysis or dynamic debugging, the specific privilege requirements needed for vulnerability exploitation can be identified. The privilege dependencies of vulnerability exploitation include: user permissions, system capabilities, and kernel module loading.

[0089] Step S20122-3: Verify the dependency on privileged conditions.

[0090] In this embodiment, the verification dimensions of privilege conditions include: static configuration verification, checking whether the system / application is actually configured with the privileges required for vulnerability exploitation; dynamic behavior verification, testing whether the privilege conditions actually exist and can be exploited by simulating attack scenarios; and permission boundary verification, confirming whether the three-level permission model of container-host machine-control plane effectively isolates privileges.

[0091] Verification methods include: using tools for automated scanning, penetration testing, runtime monitoring, and configuration comparison analysis; the benefits are: verifying whether privileged conditions actually exist, avoiding defense failure due to configuration errors; identifying privileged dependencies before vulnerabilities are exposed, reducing the attack surface; and prioritizing the handling of high-risk privileged conditions by combining verification results with vulnerability exploitation probability.

[0092] By analyzing privileged dependencies, the risk of being attacked can be effectively reduced through layered access control, vulnerability identification, and dependency verification, thus meeting the requirements of information security level assessment.

[0093] The propagation path of the vulnerability in step S2012 includes:

[0094] Step S20123-1: Identify the communication channels between target system components.

[0095] In this embodiment, communication between target system components relies on a variety of protocols and mechanisms. The communication channels between target system components are identified through static analysis, dynamic monitoring, log analysis, traffic monitoring, and attack surface analysis.

[0096] Step S20123-2: Monitor the transmission path of sensitive data using taint tracking technology.

[0097] Specifically, sensitive data is marked by embedding taint tags at the source of the data, indicating that the data contains sensitive information. When the data is transmitted in memory, files, or over the network, the taint tags are automatically passed along with the data flow. By finding the taint tags and their flow, the transmission path of sensitive data can be monitored.

[0098] Step S20123-3: Determine the attack propagation method based on network configuration and service exposure.

[0099] In this embodiment, firstly, network configuration analysis is used to identify the connection methods of different subnets, devices and services, and to determine restrictions such as firewalls, routers and access control policies; secondly, the exposed services and ports are analyzed through service exposure, and their potential attack surface is assessed to determine how attackers can use network paths and exposed services to extend the attack chain, such as accessing other nodes or services from infected nodes through open ports.

[0100] By analyzing the propagation path, we can comprehensively assess security protection and potential risks, predict how attackers will exploit system weaknesses to spread attacks, and ensure compliance requirements are met in the information security assessment.

[0101] Step S2013: Treat vulnerability metadata as nodes and construct a vulnerability association graph.

[0102] Step S202: Analyze the vulnerability association graph, generate a multi-hop attack chain, and perform verification and attack.

[0103] The specific steps of step S202 are as follows:

[0104] Step S2021: Starting from the container escape vulnerability, traverse the causal relationships, privileged dependencies, and propagation paths in the vulnerability association graph.

[0105] Step S2022: Monitor the container process to transmit sensitive data to the host machine, mark privileged operations as key nodes in the attack chain, simulate the control flow transfer of vulnerability exploitation, determine whether the attack path is reachable, analyze the mechanism that triggers the host machine kernel vulnerability when an escape vulnerability occurs, and generate a variant payload targeting the isolation boundary between the container and the host machine.

[0106] In this embodiment, sensitive data flow and potential vulnerability trigger points are first identified by monitoring the data transfer between the container and the host machine. Then, privileged operations are marked to identify key links that attackers can exploit. By simulating the control flow transfer of the vulnerability, the feasibility of the attack path is verified by analyzing how the attacker can enter the kernel space of the host machine through privileged operations or kernel vulnerabilities after the container escapes. Finally, a variant payload is generated to provide a customized attack payload for the isolation boundary between the container and the host machine, and to test the protection capabilities of the target system.

[0107] Simulated control flow transfer is when an attacker redirects the operations performed after the container escapes to a vulnerability in the host kernel.

[0108] Method for generating mutated payloads: Generate mutated inputs at the isolation boundary between the container and the host machine, identify potential vulnerabilities, and generate attack payloads based on vulnerability characteristics.

[0109] like Figure 3 As shown, step S2023: Generate an attack chain and perform multi-hop path splicing on the generated attack chain.

[0110] The specific steps of step S2023 are as follows:

[0111] Step S20231: Configure the container environment and set the host machine state, and generate an attack chain based on the edge relationships between vulnerabilities;

[0112] Specifically, by configuring the network, permissions, and resource access of the container and the host machine, potential vulnerability paths are simulated. Based on the configuration status of the container environment and the host machine, and combined with the edge relationships between vulnerabilities, a complete attack chain is generated.

[0113] Step S20232: Break through namespace isolation, obtain ordinary user privileges on the host machine, and analyze the host machine resources that can be accessed after escape, such as process lists and file systems.

[0114] In this embodiment, namespace isolation is a form of encapsulation and isolation of global resources. By breaking through namespace isolation and exploiting vulnerabilities in container or virtualization environments, attackers can gain ordinary user privileges on the host machine. First, the attacker bypasses the isolation mechanism of the container or virtual machine to escape from the container. Then, after gaining ordinary user privileges on the host machine, the attacker analyzes the host machine resources that can be accessed, including process lists, file systems, etc.

[0115] Step S20233: Match the escaped privileges with the host kernel vulnerability, simulate the use of the host kernel vulnerability to obtain root privileges, and analyze the control capabilities over the host machine.

[0116] In this embodiment, after gaining ordinary user privileges on the host machine, the attacker uses these privileges to analyze the host machine's kernel vulnerabilities, identifies vulnerabilities that can be escalated through privilege escalation, and then simulates the exploitation of these kernel vulnerabilities. The attacker then uses precise attack methods to escalate to root privileges, gaining complete control over the host machine. After successfully obtaining root privileges, the attacker analyzes their control capabilities over the host machine, including modifying system configurations, accessing sensitive data, and executing arbitrary code.

[0117] Step S20234: Utilize the propagation path from the host machine to the control plane to test whether the control plane vulnerability can take over cluster-level privileges.

[0118] In this embodiment, after successfully exploiting a host kernel vulnerability, the attacker gains complete control of the host machine and identifies the communication path with the control plane. The attacker then explores controllable plane vulnerabilities through this path, simulating attacks on control plane components to see if they can be exploited to gain cluster-level privileges. If the control plane vulnerability is successfully exploited, the attacker can gain management privileges for the entire cluster.

[0119] Step S20235: Verify privileged dependencies and propagation paths. Verify whether the network or file system channel between the container, the host machine, and the control plane is open. If the verification is successful, the multi-hop path concatenation is successful; otherwise, the multi-hop path concatenation fails.

[0120] Specifically, the privileged dependencies of container escape, host machine vulnerabilities, and control plane vulnerabilities are analyzed. Based on the propagation path, the interaction between various components is evaluated to determine if there are feasible exploit paths. Then, by verifying whether the network or file system channels are open, it is confirmed whether it is possible to successfully propagate from one level to another, such as from the host machine to the control plane. If the verification is successful, the attacker can connect the vulnerability chain through multi-hop paths and piece together a complete attack path; otherwise, if the path verification fails, the attack chain cannot be successfully pieced together.

[0121] like Figure 4As shown, step S2024: Verify the assembled attack chain and execute the attack.

[0122] In this embodiment, the assembled attack chain is verified using a dynamic sandbox. First, an isolated environment is deployed; then, automated testing is performed, using exploit tools to execute the attack chain, and monitoring tools record key operations in the attack path; finally, the control plane is checked to see if it has been compromised.

[0123] like Figure 4 As shown, the attack execution phase includes: 1) Container escape phase, breaking through container isolation and obtaining host machine access permissions;

[0124] 2) During the host machine privilege escalation phase, if there are some common vulnerabilities among multiple host machines, select a host machine to break through based on the attack difficulty of the host machine, and escalate from ordinary user privileges to root privileges on the host machine;

[0125] Optionally, if there are certain common vulnerabilities among multiple host machines, a host machine is selected for breach based on the attack cost of the host machine, and the privileges are escalated from ordinary user to root on the host machine;

[0126] Optionally, if there are certain common vulnerabilities among multiple host machines, multiple host machines can be compromised to escalate from ordinary user privileges to root privileges on the host machine.

[0127] 3) Control plane penetration phase: Invade the control plane and obtain cluster management privileges. The control plane penetration phase is similar to the host machine privilege escalation phase, and it is possible to obtain privileges for one or more control planes in a skip-step manner.

[0128] like Figure 4 As shown, the multi-hop attack chain allows for the selection of one or more optional host sets and control plane sets for attack breakthroughs. Traditional attacks can only break through using fixed attack paths. For example, consider a file management system with three host machines: a file host, a service host, and a database host. If these three host machines share a common vulnerability, the traditional attack method involves bypassing container isolation to gain access to the host machine. The attack is based on the specific host machine written in the code, and it is not possible to selectively breach one host machine while simultaneously breaching another, such as attacking the database host machine. This application, when breaching container isolation, can simultaneously breach all three host machines through multi-hop attacks, allowing for host machine privilege escalation according to actual needs.

[0129] The advantages of this approach are: the generated multi-hop attack chain is dynamically variable, capable of simulating and identifying cross-level vulnerability exploitation paths. Attackers can extend their attacks from the container to the host machine and control plane through different stages, unlike traditional static fixed-pattern attacks.

[0130] Step S203: Calculate the security isolation index of the target system using the propagation probability between nodes, and define the isolation failure boundary and redundancy protection coefficient.

[0131] In this embodiment, the security isolation index aims to measure the target system's resistance to the propagation of vulnerability chains. The core idea is to calculate the overall risk of a vulnerability spreading from the source node to the target node based on the propagation probability between nodes. The calculation method is as follows: the security isolation index is the sum of the cumulative propagation probabilities from the starting point to the ending point in all possible vulnerability propagation paths P.

[0132] The isolation failure boundary refers to the critical point where the risk of vulnerability propagation increases significantly when a certain isolation unit of the target system fails. It reflects the critical vulnerabilities on certain specific paths. Once exploited, the isolation system may be completely breached. The isolation failure impact factor is the sum of all incoming propagation probabilities received by the node. When the isolation failure impact factor exceeds a certain threshold, it indicates that the isolation capability of the node is close to failure.

[0133] The redundancy protection coefficient reflects the ability of a target system to block the spread of attacks even after a critical vulnerability point fails. It measures the security redundancy of the target system, that is, whether there are other paths that can effectively block attacks if the main isolation strategy fails. The calculation method is: the maximum probability of an attack succeeding after removing redundant protection paths.

[0134] The smaller the security isolation index, the higher the overall security of the target system and the more effective the isolation strategy; the higher the isolation failure boundary, the more likely there are security vulnerabilities in critical nodes, requiring enhanced protection; the lower the redundancy protection coefficient, the more difficult it is to stop attacks after the main protection fails, requiring additional redundant security measures.

[0135] like Figure 2 The diagram illustrates a privilege escalation attack chain based on a container environment. The specific process is as follows: 1) Attack Trigger: The container process sends a malicious system call to the host kernel, which is the initial action of the attack; 2) Vulnerability Exploitation: The host kernel has a vulnerability numbered CVE-2024-21237, which is triggered by a malicious syscall; 3) Privilege Escalation: The vulnerable module uses the kernel vulnerability to execute attack logic, ultimately achieving successful privilege escalation, breaking through the original privilege restrictions of the container, and gaining further control over the host kernel. Figure 2 It fully presents the attack chain from the container process to triggering the host kernel vulnerability, and then to using the vulnerability to complete privilege escalation. It shows the technical path of attackers to break through container isolation and obtain higher privileges by exploiting kernel vulnerabilities.

[0136] It should be noted that CVE-2024-21237 is a vulnerability in Oracle MySQL server products. Successfully exploiting this vulnerability would give attackers unauthorized capabilities, resulting in denial of some services to the MySQL server.

[0137] Step S3: Use machine learning algorithms to perform adaptive compliance assessment, and generate a compliance assessment report based on the adaptive compliance assessment output.

[0138] The specific steps of step S3 are as follows:

[0139] Step S301: Extract the features of the preprocessed target system-related data, including: spatial isolation, time delay, resource consumption, and historical attack data.

[0140] In this embodiment, spatial isolation is evaluated by analyzing the isolation mechanisms of different components in the target system to assess their isolation strength. For example, it checks whether containers are enabled to run as non-root users and whether virtual machines have shared directory vulnerabilities, thus quantifying the effectiveness of the isolation boundaries between components.

[0141] Time delay is the response time of the monitoring system to security-related operations. Abnormal delays may indicate resource contention, malicious code execution, or covert channel attacks. Time series analysis can be used to locate system anomalies.

[0142] Resource consumption data is collected in real-time / historical form, including CPU, memory, and network bandwidth. Abnormal resource usage reflects vulnerability exploitation and is used to identify resource abuse.

[0143] Historical attack data integrates records of attacks suffered by the target system and uses correlation analysis to uncover attack patterns. For example, it can statistically analyze the historical trigger frequency of a certain type of vulnerability to predict future risks.

[0144] Step S302: Build a quantitative assessment model for isolation strength using machine learning algorithms and train it. Update the quantitative assessment model for isolation strength adaptively every hour using newly collected data.

[0145] Machine learning algorithms, such as random forests, gradient boosting machines, and neural networks, essentially train models by iteratively optimizing algorithms to minimize the error between predicted and actual values, thus fitting the underlying patterns in the data. After collecting new data hourly, incremental learning or retraining mechanisms allow the model to adapt to changes in the target system environment and update the logic for evaluating isolation strength.

[0146] Step S303: Input the features of the preprocessed target system data into the trained isolation strength quantification evaluation model, output the isolation strength index and security level of the target system, and automatically generate a comprehensive evaluation report.

[0147] Example 2

[0148] Please see Figure 5 Another embodiment of the present invention provides: a cybersecurity compliance assessment system, comprising: a data processing module, an attack and quantification module, and an evaluation module;

[0149] The data processing module is used to collect relevant data from the target system;

[0150] The attack and quantification module is used to establish a vulnerability association graph based on the collected target system-related data, generate a multi-hop attack chain based on the vulnerability association graph, attack the target system, calculate the security isolation index of the target system using the propagation probability between nodes, and define the isolation failure boundary and redundancy protection coefficient.

[0151] The evaluation module is used to perform adaptive compliance assessment using machine learning algorithms, and generate a compliance assessment report based on the adaptive compliance assessment output.

[0152] In addition, the parts of the technical solutions provided in the embodiments of this application that are consistent with the implementation principles of the corresponding technical solutions in the prior art have not been described in detail, so as to avoid excessive elaboration.

[0153] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for assessing information security compliance, characterized in that, include: Collect relevant data about the target system, including: virtualization architecture, network topology, application deployment, vulnerability database and historical security incident data. Preprocess the collected data to build an initial dataset of vulnerabilities and system isolation attributes. A virtualization isolation strength quantification model based on vulnerability chain propagation is established to generate multi-hop attack chains for attack. The security isolation index of the target system is calculated by using the propagation probability between nodes. At the same time, the isolation failure boundary and redundancy protection coefficient are defined. The multi-hop attack chain is generated by the virtualization isolation strength quantification model based on vulnerability chain propagation, and the generated attack chain is spliced ​​with multi-hop paths. Construct a quantitative assessment model for isolation strength, use machine learning algorithms for adaptive evaluation, and generate a comprehensive evaluation report based on the output of the machine learning algorithms; The aforementioned virtualization isolation strength quantification model is established based on vulnerability chain propagation. Multi-hop attack chains are generated for attack, and the security isolation index of the target system is calculated using the propagation probability between nodes. Simultaneously, isolation failure boundaries and redundancy protection coefficients are defined, including: Based on vulnerability databases and security event logs, the relationship between container escape vulnerabilities and host machine vulnerabilities is analyzed, and a vulnerability association graph is constructed. The vulnerability association graph is analyzed to generate multi-hop attack chains, which are then verified and attacked. The security isolation index of the target system is calculated using the propagation probability between nodes, while the isolation failure boundary and redundancy protection coefficient are defined. The process of parsing the vulnerability association graph, generating a multi-hop attack chain, and then verifying and attacking it includes: Starting with container escape vulnerabilities, we traverse the causal relationships, privileged dependencies, and propagation paths in the vulnerability association graph to identify key nodes, including key nodes related to host kernel vulnerabilities and control plane component vulnerabilities. Monitor the transmission of sensitive data from container processes to the host machine, mark privileged operations as key nodes in the attack chain, simulate control flow transfers for vulnerability exploitation, determine whether the attack path is reachable, analyze the mechanism that triggers host machine kernel vulnerabilities when an escape vulnerability occurs, and generate variant payloads targeting the isolation boundary between the container and the host machine. Generate an attack chain and perform multi-hop path concatenation on the generated attack chain; Verify the assembled attack chain and execute the attack; The process of generating an attack chain and concatenating multiple paths within the generated attack chain includes: Configure the container environment and set the host machine state; Bypassing Nmaespace isolation, gaining ordinary user privileges on the host machine, and analyzing the host machine resources accessed after the escape; Match the privileges after escape with the host kernel vulnerability, simulate the use of the host kernel vulnerability to obtain root privileges, and analyze the control capabilities over the host machine; By utilizing the propagation path from the host machine to the control plane, we can test whether a control plane vulnerability can take over cluster-level privileges. Verify privileged dependencies and propagation paths, and verify whether the network or file system channel between the container, the host machine, and the control plane is open. If the verification is successful, the multi-hop path concatenation is successful; otherwise, the multi-hop path concatenation fails.

2. The information security level protection assessment method as described in claim 1, characterized in that, The method involves analyzing the relationship between container escape vulnerabilities and host machine vulnerabilities based on vulnerability databases and security event logs, and constructing a vulnerability association graph, including: Integrate CVE and CNVD vulnerability databases to extract metadata about container escape vulnerabilities, host kernel vulnerabilities, and Kubernetes control plane vulnerabilities; Establish the relationships between vulnerabilities, including: causal relationships, privileged dependencies, and propagation paths; By treating vulnerability metadata as nodes, a vulnerability association graph is constructed.

3. The information security level assessment method as described in claim 2, characterized in that, The causal relationship includes: Analyze the preconditions for vulnerability triggering and verify the causal chain of vulnerability exploitation through static code analysis or dynamic debugging; Identify the vulnerability's position in the attack chain; Analyze the impact of successful exploitation of the vulnerability on subsequent stages.

4. The information security level assessment method as described in claim 2, characterized in that, The privileged dependencies include: Construct a three-level permission model: container-host machine-control plane; Identify the privileged conditions for exploiting vulnerabilities; Verify the dependency on privileged conditions.

5. The information security level assessment method as described in claim 2, characterized in that, The propagation path includes: Identify the communication channels between components of the target system; Use taint tracking technology to monitor the transmission path of sensitive data; Based on network configuration and service exposure, determine the attack propagation method.

6. The information security level assessment method as described in claim 1, characterized in that, A quantitative assessment model for isolation strength is constructed, adaptive evaluation is performed using machine learning algorithms, and a comprehensive evaluation report is generated based on the output of the machine learning algorithms, including: Extract features from the preprocessed target system data, including: spatial isolation, time latency, resource consumption, and historical attack data; A quantitative assessment model for isolation strength is constructed using machine learning algorithms and trained. The model is then adaptively updated hourly using newly collected data. The features of the preprocessed target system data are input into the trained isolation strength quantification evaluation model, which outputs the isolation strength index and security level of the target system and automatically generates a comprehensive evaluation report.

7. A cybersecurity compliance assessment system, used to implement the cybersecurity compliance assessment method according to any one of claims 1-6, characterized in that, include: Data processing module, attack and quantification module, and evaluation module; The data processing module is used to collect relevant data of the target system, including: virtualization architecture, network topology, application deployment, vulnerability database and historical security event data, and to preprocess the collected relevant data to construct an initial vulnerability and system isolation attribute dataset. The attack and quantification module is used to establish a virtualization isolation strength quantification model based on vulnerability chain propagation, generate multi-hop attack chains for attack, calculate the security isolation index of the target system using the propagation probability between nodes, and define the isolation failure boundary and redundancy protection coefficient. The multi-hop attack chain is generated by the virtualization isolation strength quantification model based on vulnerability chain propagation, and the generated attack chain is spliced ​​with multi-hop paths. The evaluation module is used to construct a quantitative evaluation model for isolation strength, use machine learning algorithms for adaptive evaluation, and generate a comprehensive evaluation report based on the output results of the machine learning algorithms.

Images