ATTCK-based complex information system network attack modeling system and method

Abstract

The invention relates to a method based on ATTamp; the invention discloses a CK complex information system network attack modeling system and method, and belongs to the technical field of network security. The modeling system provided by the invention comprises the following modules: a target system asset characterization and vulnerability identification module, a CVE and an ATTamp; a CK tactical technology mapping module; an attack mode making and technology filtering module; and a network threat attack path generation and evaluation module. According to the method, an attack scene can be systematically constructed, behaviors of an attacker can be simulated, a potential attack path can be predicted, and subjectivity in a modeling process can be reduced. According to the method, the asset condition and vulnerability of a target system are comprehensively considered from ATTamp; the ability category of the attacker is obtained in the CK framework, quantitative evaluation of the attack path risk level is achieved, and the security situation awareness ability and the defense strategy optimization ability of a complex information system are effectively improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a complex information system network attack modeling system and method based on ATT&CK. BACKGROUND

[0002] A network attack model is a systematic abstract description of the behavior of an attacker, an attack path, technical means and target intention, aiming to simulate attack behavior, predict potential attack paths and guide the design of defense strategies. Generally, the complexity of the target system itself, the diversified behavior of the attacker and the setting of the attack mode will all affect the accuracy of the threat model, so various elements need to be considered comprehensively in the construction process. How to detect the asset status and vulnerability of the target system, how to construct a reasonable attack scenario with the help of the tactics and techniques in the ATT&CK framework, and how to quantify the risk level of the attack path, etc., are all core problems that need to be solved in the construction of an efficient and accurate threat model.

[0003] Attack tree, attack graph and attack kill chain are three common methods in threat model construction. Attack tree intuitively displays possible attack paths by decomposing attack targets into hierarchical attack steps; attack graph focuses on revealing the association between components in the system and their potential attack links; and attack kill chain divides the attack process into stages and proposes specific defense strategies for each link. However, these methods have certain limitations when facing complex information systems. The linear structure of attack tree limits the depiction of concurrent attacks and multi-path attacks, and it is difficult to dynamically update and lacks tactical and technical analysis. Attack graph can express the relationship between attack paths, but as the system size increases, its construction and calculation complexity increases dramatically, and it is difficult to integrate real-world threat intelligence. The fixed stage division of attack kill chain cannot cope with the nonlinear and multi-stage staggered attack methods of modern attackers, and it lacks fine-grained technical analysis capabilities.

[0004] In contrast, the ATT&CK framework is more suitable for threat modeling of complex information systems. Based on real-world attack cases worldwide, it can dynamically update the latest attack tactics, techniques and procedures (TTPs) to meet the dynamic defense needs of complex systems. At the same time, ATT&CK supports nonlinear attack modeling, can accurately describe the multiple paths that modern attackers may take at different stages, and provides fine-grained tactical and technical mapping to help security teams accurately assess the defense capabilities of the system. SUMMARY

[0005] (I) Technical problems to be solved

[0006] The technical problem to be solved by the present application is how to provide an ATT&CK-based complex information system network attack modeling system and method to efficiently and accurately construct a threat model for a complex information system, specifically including how to detect the asset status and vulnerability of the target system, accurately identify the key components of the system and potential security risks, how to use the tactics and techniques in the ATT&CK framework to simulate the strategies and technical means that attackers may take to construct a reasonable attack scenario and improve the authenticity and pertinence of threat modeling, and how to quantify the risk level of the attack path and evaluate the impact of different attack paths to design a security protection strategy.

[0007] (II) Technical solution

[0008] To solve the above technical problems, the present application provides an ATT&CK-based complex information system network attack modeling system, which includes the following modules: a target system asset representation and vulnerability identification module, a CVE and ATT&CK tactics and technology mapping module, an attack mode formulation and technology filtering module, and a network threat attack path generation and evaluation module.

[0009] The target system asset representation and vulnerability identification module is used to complete the asset topology construction and component vulnerability identification of the target system through automated scanning and data analysis.

[0010] The CVE and ATT&CK tactics and technology mapping module is used to associate vulnerabilities and attack techniques to determine the range of attack techniques applicable to assets.

[0011] The attack mode formulation and technology filtering module is used to analyze the tactics, techniques, and procedures that potential attackers may take based on the ATT&CK framework, specify a set of attack modes, and filter attack techniques suitable for specific system environments.

[0012] The network threat path generation and evaluation module is used to automatically generate possible attack paths based on the identified asset information and attack modes, and quantitatively evaluate the impact score of different paths on tasks.

[0013] The ATT&CK-based complex information system network attack modeling system according to claim 1, wherein the target system asset representation and vulnerability identification module includes:

[0014] The asset representation module is used to construct a hierarchical task capability set of functions, systems, and components, and to construct a network topology graph based on the location information and connection between components, which will be used by attack threats to identify potential attack paths and entry points.

[0015] A vulnerability identification module is configured to divide the vulnerabilities of the target system components into hardware vulnerabilities and software vulnerabilities, utilize the manufacturer, device model and type information of the components in the target system assets to perform keyword search and matching with the CVE vulnerability library of previous years to obtain the hardware vulnerabilities of the components, and utilize Nmap to scan the target system components to obtain port services and version information and perform matching with the CVE vulnerability library of previous years to obtain the software vulnerabilities of the components.

[0016] The application further provides a complex information system network attack modeling method based on ATT&CK, which comprises the following steps:

[0017] S1, an asset characterization module: actively detecting asset data of the complex information system, constructing a hierarchical structure of the assets, and generating a topology graph based on the connection relationship between the assets;

[0018] S2, a vulnerability identification module: matching the asset data with the CVE vulnerability library to identify hardware vulnerabilities and software vulnerabilities of the components, and evaluating the vulnerability of the components;

[0019] S3, a CVE and ATT&CK tactic and technology mapping module: utilizing the mapping relationship between the vulnerabilities and the ATT&CK technologies to construct a list of available tactic and technology of the components, and explicitly indicating the technical means that can be utilized by the attacker;

[0020] S4, an attack mode formulation module: formulating an attack mode set according to the general threat framework, mapping the tactic behaviors of the attacker in different stages, and constructing a systematic attack scheme;

[0021] S5, a technology filter module: designing a four-layer technology filtering mechanism, screening the most threatening attack technologies suitable for the enemy for the components on the attack path;

[0022] S6, an attack path generation module: constructing an attack scene based on the attacker identity, the attack mode, the attack entry point and the target, traversing and generating a feasible attack path by using a breadth-first search algorithm in combination with the asset topology relationship, and matching the appropriate ATT&CK technologies for the components on the path according to the attack mode, the technology filter and the available technology list of the components;

[0023] S7, an attack path evaluation module: utilizing a hierarchical attack path evaluation method to calculate the component with the highest threat impact score in the path and taking the component as the final impact score of the path to identify the weakest security link and provide a basis for accurate defense.

[0024] (Three) beneficial effects

[0025] The application provides an ATT&CK-based complex information system network attack modeling system and method, which can systematically construct an attack scene, simulate the behavior of an attacker, and predict potential attack paths, thereby reducing subjectivity in the modeling process. BRIEF DESCRIPTION OF DRAWINGS

[0026] Figure 1 FIG. 1 is a schematic diagram of an overall architecture of an ATT&CK-based complex information system network attack modeling system according to the application. DETAILED DESCRIPTION

[0027] To make the objectives, contents and advantages of the application clearer, the specific embodiments of the application are described in further detail below with reference to the accompanying drawings and examples.

[0028] The application relates to the technical field of network security, and particularly relates to an ATT&CK-based complex information system network attack model, which is used for automatically generating attack paths, quantitatively evaluating risks, and formulating defense strategies.

[0029] The application provides an ATT&CK-based complex information system network attack modeling system, as shown in FIG. 1, which comprises the following modules: a target system asset representation and vulnerability identification module, a CVE and ATT&CK tactic and technology mapping module, an attack mode formulation and technology filtering module, and a network threat attack path generation and evaluation module. Figure 1

[0030] The target system asset representation and vulnerability identification module is used for completing asset topology construction and component vulnerability identification of a target system through automatic scanning and data analysis.

[0031] The CVE and ATT&CK tactic and technology mapping module is used for associating vulnerabilities and attack technologies to determine the range of attack technologies applicable to assets.

[0032] The attack mode formulation and technology filtering module is used for analyzing tactics, technologies and procedures (TTPs) that may be taken by potential attackers based on the ATT&CK framework, and specifying an attack mode set and screening attack technologies applicable to specific system environments.

[0033] The network threat path generation and evaluation module is used for automatically generating possible attack paths according to the identified asset information and attack modes, and quantitatively evaluating the impact scores of different paths on tasks.

[0034] I. The target system asset representation and vulnerability identification module is specifically implemented in the following manner:​

[0035] (1)Asset characterization module, for building hierarchical task capability set of functions, systems, components. Relying on the position information and connection between components to build network topology map, the attacker will identify potential attack paths and entry points accordingly.

[0036] (2) Vulnerability identification module. This module divides the vulnerabilities of target system components into hardware vulnerabilities and software vulnerabilities. By using the manufacturer, device model and type information of the components in the target system assets, keyword search and matching are performed with the CVE vulnerability database over the years to obtain the hardware vulnerabilities of the components; by using Nmap to scan the target system components, the port services and version information are obtained, and matching is performed with the CVE vulnerability database over the years to obtain the software vulnerabilities of the components.

[0037] II. The specific implementation method of the CVE and ATT&CK tactic-technology mapping module is:

[0038] Build CVE-CWE-CAPEC-ATT&CK technology link, associate and map the contents of the four network security knowledge bases, form a complete analysis chain from vulnerability to actual attack technology. After completing asset characterization and vulnerability identification, the CVE vulnerabilities corresponding to the assets can be identified, and the tactics and technologies suitable for the assets can be determined based on the mapping relationship.

[0039] (1) CVE-CWE

[0040] CVE is a public vulnerability identification system that assigns a unique number and brief description to each known vulnerability. CWE provides a classification system for common weaknesses in software and systems, describing the root causes and design flaws that lead to vulnerabilities. By mapping specific vulnerabilities in CVE to CWE, the weaknesses and their causes behind the vulnerabilities can be identified.

[0041] (2) CWE-CAPEC

[0042] CAPEC defines specific attack patterns that attackers may use. It describes attack behavior from the perspective of attack methods and exploitation processes, helping to understand how attackers exploit weaknesses (defined by CWE) in systems to carry out attacks. By mapping CWE to CAPEC, it can be clear which weaknesses are easy targets for attackers to exploit and the specific attack strategies they may take.

[0043] (3) CAPEC-ATT&CK

[0044] There is a direct link between the attack patterns described in CAPEC and actual attack behavior, which is further refined and classified in the ATT&CK framework. By mapping attack patterns in CAPEC to the ATT&CK framework, the theoretical model of vulnerability exploitation can be connected with the tactics and technologies of attackers in the real world.

[0045] Three, the specific implementation method of the attack mode formulation and technology filtering module is:

[0046] (1) Attack mode formulation module

[0047] This module is based on a general network threat framework, combined with actual attack cases, and divides the attacker's behavior along the life cycle time sequence into three stages of "participation, existence, and influence", and sets different tasks and targets. In the "participation" stage, the attacker breaks through the target system defense line through unauthorized access, corresponding to the task target of the "entry component" in the attack path; in the "existence" stage, the attacker establishes and maintains persistent access and control environment to the victim system, corresponding to the task target of the "intermediate component" in the attack path; in the "influence" stage, the attacker performs the final malicious operation (such as data theft / system destruction), corresponding to the task target of the "target component" in the attack path. Map the three-stage target to ATT&CK tactics, build multiple types of attack modes (tactical sequences), and completely deduce the attack path of the threat actor from the boundary breakthrough to the attack intention.

[0048] (2) Technology filtering module

[0049] By constructing an attack technology filter, the most likely high-threat attack technology used by the enemy is screened for each component in the attack path, narrowing the attack range. This module is based on a four-layer progressive filtering mechanism: first according to the attacker's identity, then combined with the target operating system environment, then locking the ATT&CK tactic type, and finally selecting the technology through threat scoring, to provide the most threatening technology prediction scheme for each component in the attack path in a specific combat scene, improving the relevance and prediction reliability of the attack model modeling.

[0050] Four, the specific implementation method of the network threat path generation and evaluation module is:

[0051] (1) Attack path generation module.

[0052] The network topology graph formed by the asset representation module according to the connection relationship between components is the basis for the attack path generation module to perform attack routing. The attack path generation module uses a breadth-first search algorithm to traverse from the entry component to the target component layer by layer, enumerating all potential attack paths. The attack mode formulation module provides a tactical sequence for all components on the attack path, and the technology filtering module refines the tactics to specific attack technologies. In addition, the attack path generation module adds attack path feasibility verification, which compares whether the tactical technology set formed by each component in the path through the CVE and ATT&CK tactic technology mapping module supports and meets the tactical sequence in the attack mode formulation module, and filters out the feasible attack path, improving the accuracy of attack prediction.

[0053] (2) attack path evaluation module

[0054] The application proposes an attack path evaluation method based on a hierarchical structure, and constructs a task-oriented threat impact quantification system. Based on the results of the asset representation module, the mapping from the task target to the technical implementation is divided into four levels: the capability layer, the function layer, the system layer, and the component layer. Each level is divided into three categories according to the impact of asset failure on the continuity of the task: task-required type (directly leading to task interruption), task-critical type (maintaining business through backup solutions), and task-supporting type (not affecting the main business function). The component overall impact score calculation adopts a four-layer three-type weighted accumulation model: a fixed impact value is assigned to each level (component layer, system layer, function layer, and capability layer) of the three types of assets (required type / critical type / supporting type), and the calculation is performed by the following formula:

[0055] Component impact score = self-component layer impact score * component layer weight + its own system layer impact score * system layer weight + its supporting function layer impact score * function layer weight + its service capability layer impact score * capability layer weight

[0056] In attack path analysis, the component with the highest impact score is selected as the final impact score of the path to highlight the weakest and critical security link, and the potential threat determines the risk level of the entire path, thereby providing a scientific basis for precise defense strategies.

[0057] The application provides a complex information system network attack modeling method based on ATT&CK, including the following steps:

[0058] S1, asset representation module: actively probe the asset data of the complex information system, construct a hierarchical structure of assets, and generate a topology graph based on the connection relationship between assets;

[0059] S2, vulnerability identification module: match asset data with CVE vulnerability library to identify hardware vulnerabilities and software vulnerabilities of components, and evaluate the vulnerability of components;

[0060] S3, CVE and ATT&CK tactic technology mapping module: use the mapping relationship between vulnerabilities and ATT&CK technologies to construct a list of available tactic technologies for components, and clearly define the technical means that attackers may use;

[0061] S4, attack mode development module: develop an attack mode set based on the general threat framework, map the tactical behavior of attackers at different stages (participation, existence, and impact), and construct a systematic attack plan;

[0062] S5, technical filter module: design four-layer technical filtering mechanism (attacker identity, operating system type, tactical category, technical score), screen the most threatening attack technology suitable for the enemy on the components on the attack path;

[0063] S6, attack path generation module: based on the attacker identity, attack mode, attack entry point and target, build an attack scene. Combined with the asset topology relationship, the breadth-first search algorithm is used to traverse and generate feasible attack paths. According to the attack mode, the technical filter and the component available technology list, the appropriate ATT&CK technology is matched for each component on the path.

[0064] S7, attack path evaluation module: using the hierarchical attack path evaluation method, calculate the component with the highest threat impact score in the path, and take it as the final impact score of the path to identify the weakest security link and provide the basis for accurate defense.

[0065] The specific implementation method of each step is as described above.

[0066] The application proposes a complex information system threat modeling method based on the ATT&CK framework, which can systematically build an attack scene, simulate the behavior of attackers, predict potential attack paths, and reduce subjectivity in the modeling process. The application comprehensively considers the asset condition and vulnerability of the target system, obtains the attacker's ability category from the ATT&CK framework, realizes the quantitative evaluation of the attack path risk level, and effectively improves the security situation awareness ability and defense strategy optimization ability of the complex information system.

[0067] The above is only the preferred embodiment of the application, it should be pointed out that, for those skilled in the technical field, without departing from the technical principles of the application, a number of improvements and modifications can be made, these improvements and modifications should also be regarded as the protection scope of the application.

Claims

1. A network attack modeling system for complex information systems based on ATT&CK, characterized in that, The modeling system includes the following modules: target system asset characterization and vulnerability identification module, CVE and ATT&CK tactical and technical mapping module, attack pattern formulation and technical filtering module, and network threat attack path generation and evaluation module; The target system asset characterization and vulnerability identification module is used to complete the asset topology construction and component vulnerability identification of the target system through automated scanning and data analysis. The CVE and ATT&CK tactical technique mapping module is used to associate vulnerabilities with attack techniques to determine the scope of attack techniques applicable to an asset. The attack pattern formulation and technology filtering module is used to analyze the tactics, techniques and procedures that potential attackers may adopt based on the ATT&CK framework, and to formulate attack pattern sets and technology filters to screen attack techniques suitable for specific system environments. The network threat path generation and assessment module is used to automatically generate possible attack paths based on identified asset information and attack patterns, and to quantitatively assess the impact score of different paths on the task.

2. The complex information system network attack modeling system based on ATT&CK as described in claim 1, characterized in that, The target system asset characterization and vulnerability identification module includes: The asset representation module is used to build a hierarchical set of task capabilities for functions, systems, and components; it constructs a network topology map based on the location information and connectivity between components, which attackers can use to identify potential attack paths and entry points. The vulnerability identification module categorizes vulnerabilities in target system components into hardware and software vulnerabilities. It uses the manufacturer, device model, and type information of components in the target system assets to perform keyword searches and matches with the CVE vulnerability database over the years to identify hardware vulnerabilities. It also uses Nmap to scan the target system components, obtain port services and version information, and matches this information with the CVE vulnerability database over the years to identify software vulnerabilities.

3. The complex information system network attack modeling system based on ATT&CK as described in claim 2, characterized in that, The CVE and ATT&CK tactical technology mapping module constructs a CVE-CWE-CAPEC-ATT&CK technical link, which associates and maps the content of the four network security knowledge bases to form a complete analysis chain from vulnerability to actual attack technology. After completing asset characterization and vulnerability identification, it identifies the CVE vulnerabilities corresponding to the assets and determines the tactics and technologies applicable to the assets based on the mapping relationship.

4. The complex information system network attack modeling system based on ATT&CK as described in claim 3, characterized in that, CVE is a publicly available vulnerability identification system that assigns a unique number and brief description to each known vulnerability; CWE provides a classification system for common weaknesses in software and systems, describing the root causes and design flaws that lead to vulnerabilities. By mapping specific vulnerabilities in CVE to CWE, the weaknesses behind the vulnerabilities and their causes can be identified. CAPEC defines the specific attack patterns that attackers may employ, describing attack behavior from the perspective of attack methods and exploitation processes, helping to understand how attackers exploit vulnerabilities in a system to carry out attacks; by mapping CWE to CAPEC, it clarifies which vulnerabilities are likely to be targeted by attackers, and the specific attack strategies they may adopt. There is a direct link between the attack patterns described in CAPEC and actual attack behaviors, which are further refined and classified in the ATT&CK framework. By mapping the attack patterns in CAPEC to the ATT&CK framework, the theoretical model of vulnerability exploitation is connected with the tactics and techniques of attackers in the real world.

5. The complex information system network attack modeling system based on ATT&CK as described in claim 3, characterized in that, The attack pattern formulation and technical filtering module includes: an attack pattern formulation module and a technical filtering module; The attack pattern formulation module, based on a general network threat framework and combined with real-world attack cases, divides attacker behavior into three stages along the lifecycle: "participation, presence, and influence," and sets different tasks and objectives for each stage. The objectives of the three stages are mapped to ATT&CK tactics to construct various types of attack patterns and fully deduce the attack path of threat actors from boundary breach to achieving their attack intentions. The technology filtering module is used to filter the most likely high-threat attack technologies used by the adversary for each component of the attack path by constructing attack technology filters, thereby narrowing the attack scope. It is based on a four-layer progressive filtering mechanism: first, it is based on the attacker's identity; second, it is combined with the target operating system environment; then, it locks the ATT&CK tactical type; and finally, it selects the best technology through threat scoring, so as to provide the most threatening technology prediction scheme for each component in the attack path under specific combat scenarios.

6. The complex information system network attack modeling system based on ATT&CK as described in claim 5, characterized in that, In the "Participation" phase, the attacker breaches the target system's defenses through unauthorized access, corresponding to the task objective of the "entry point component" in the attack path; in the "Presence" phase, the attacker establishes and maintains a persistent access to and control environment over the victim system, corresponding to the task objective of the "intermediate component" in the attack path; in the "Influence" phase, the attacker executes the final malicious operation, corresponding to the task objective of the "target component" in the attack path.

7. The complex information system network attack modeling system based on ATT&CK as described in claim 5, characterized in that, The network threat path generation and evaluation module includes: an attack path generation module and an attack path evaluation module; The attack path generation module uses a breadth-first search algorithm to traverse from the entry component to the target component layer by layer, exhaustively listing all potential attack paths; it also includes an attack path feasibility verification module, which compares whether the tactical technology set formed by the CVE and ATT&CK tactical technology mapping module for each component in the path supports and satisfies the tactical sequence in the attack mode formulation module, and selects feasible attack paths. The attack path assessment module is used to construct a mission-oriented threat impact quantification system. Based on the results of the asset characterization module, its mapping from mission objectives to technical implementation is divided into four layers: capability layer, functional layer, system layer, and component layer. Each layer is further divided into three categories according to the impact of asset failure on mission continuity: mission-necessary, mission-critical, and mission-supporting. The overall component impact score is calculated using a four-layer, three-type weighted cumulative model: fixed impact values ​​are pre-assigned to the three types of assets at each layer, and the component impact score is calculated. In the attack path analysis, the component with the highest impact score is selected as the final impact score of the path to highlight the weakest and most critical security links, whose potential threats determine the risk level of the entire path.

8. The complex information system network attack modeling system based on ATT&CK as described in claim 7, characterized in that, The asset representation module forms a network topology based on the connections between components, which serves as the basis for the attack path generation module to perform attack pathfinding. The attack mode formulation module provides tactical sequences for all components on the attack path, and the technology filtering module refines the tactics into specific attack techniques.

9. The complex information system network attack modeling system based on ATT&CK as described in claim 7, characterized in that, The component's impact on the score is calculated using the following formula: Component impact score = its own component layer impact score * component layer weight + its system layer impact score * system layer weight + its supporting function layer impact score * function layer weight + its service capability layer impact score * capability layer weight.

10. A method for modeling network attacks on complex information systems based on ATT&CK, using the modeling system described in any one of claims 7-9, characterized in that, The method includes the following steps: S1, Asset Representation Module: Actively probes asset data of complex information systems, constructs the hierarchical structure of assets, and generates a topology graph based on the connection relationships between assets; S2, Vulnerability Identification Module: Matches asset data with the CVE vulnerability database to identify hardware and software vulnerabilities in components, thereby assessing the vulnerability of the components; S3, CVE and ATT&CK Tactical Technique Mapping Module: Utilizes the mapping relationship between vulnerabilities and ATT&CK techniques to construct a list of available tactical techniques for the component, and identifies the technical means that attackers may use; S4. Attack Pattern Development Module: Based on the general threat framework, develop a set of attack patterns, map the attacker's tactical behavior at different stages, and build a systematic attack plan. S5, Technical Filter Module: Designed with a four-layer technical filtering mechanism to filter the most threatening attack techniques applicable to the adversary for components along the attack path; S6. Attack Path Generation Module: Based on the attacker's identity, attack mode, attack entry point, and target, construct the attack scenario; combine the asset topology relationship and use a breadth-first search algorithm to traverse and generate feasible attack paths; match appropriate ATT&CK technologies for each component on the path according to the attack mode, technology filter, and list of available technologies for the components. S7 Attack Path Assessment Module: Utilizing a hierarchical attack path assessment method, this module calculates the component with the highest threat impact score in the path and uses it as the final impact score of the path to identify the weakest security links, providing a basis for precise defense.

Images