A system and method for modeling network attacks on complex information systems based on ATT&CK

Abstract

The application relates to an ATT&CK-based complex information system network attack modeling system and method, and belongs to the technical field of network security. The modeling system comprises the following modules: a target system asset characterization and vulnerability identification module, a CVE and ATT&CK tactic technology mapping module, an attack mode formulation and technology filtering module and a network threat attack path generation and evaluation module. The application can systematically construct an attack scene, simulate the behavior of an attacker, predict a potential attack path and reduce subjectivity in the modeling process. The application comprehensively considers the asset condition and vulnerability of a target system, obtains the attacker capability category from the ATT&CK framework and realizes quantitative evaluation of the risk level of an attack path, so that the security situation awareness capability and defense strategy optimization capability of a complex information system are effectively improved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a complex information system network attack modeling system and method based on ATT&CK. Background Technology

[0002] A cyberattack model is a systematic abstract description of attacker behavior, attack paths, technical means, and target intent. It aims to simulate attack behavior, predict potential attack paths, and guide defense strategy design. Typically, the complexity of the target system, the diversity of attacker behavior, and the setting of attack patterns all affect the accuracy of the threat model. Therefore, various factors need to be comprehensively considered during the construction process. How to detect the asset status and vulnerabilities of the target system, how to construct reasonable attack scenarios using tactics and techniques in the ATT&CK framework, and how to quantify the risk level of attack paths are all core issues that urgently need to be addressed in building efficient and accurate threat models.

[0003] Attack trees, attack graphs, and kill chains are three common methods in threat modeling. Attack trees visually represent possible attack paths by breaking down the target into hierarchical attack steps; attack graphs focus on revealing the relationships between components in the system and their potential attack chains; and kill chains divide the attack process according to different stages, proposing specific defense strategies for each stage. However, these methods have limitations when dealing with complex information systems. The linear structure of attack trees limits the characterization of concurrent and multi-path attacks, and it is difficult to update dynamically, lacking tactical and technical analysis. While attack graphs can express the relationships between attack paths, their construction and computational complexity increase dramatically with system size, and they struggle to integrate real-world threat intelligence. The fixed-stage division of kill chains is ill-suited to the non-linear, multi-stage, and interwoven attack methods of modern attackers, and it lacks fine-grained technical analysis capabilities.

[0004] In contrast, the ATT&CK framework is better suited for threat modeling of complex information systems. Based on real-world attack cases worldwide, it can dynamically update the latest attack tactics, techniques, and procedures (TTPs) to meet the dynamic defense needs of complex systems. Furthermore, ATT&CK supports non-linear attack modeling, accurately describing the various paths modern attackers might take at different stages, and providing fine-grained tactical and technical mappings to help security teams accurately assess a system's defense capabilities. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] The technical problem this invention aims to solve is how to provide a network attack modeling system and method for complex information systems based on ATT&CK, in order to efficiently and accurately construct threat models for complex information systems. Specifically, this includes: how to detect the asset status and vulnerabilities of the target system, accurately identify key system components and potential security risks; how to use the tactics and techniques in the ATT&CK framework to simulate the strategies and techniques that attackers may adopt, in order to construct reasonable attack scenarios and improve the realism and targeting of threat modeling; and how to quantify the risk level of attack paths, assess the impact of different attack paths, and thus design security protection strategies.

[0007] (II) Technical Solution

[0008] To address the aforementioned technical problems, this invention proposes a complex information system network attack modeling system based on ATT&CK. This modeling system includes the following modules: target system asset characterization and vulnerability identification module, CVE and ATT&CK tactical and technical mapping module, attack pattern formulation and technical filtering module, and network threat attack path generation and evaluation module.

[0009] The target system asset characterization and vulnerability identification module is used to complete the asset topology construction and component vulnerability identification of the target system through automated scanning and data analysis.

[0010] The CVE and ATT&CK tactical technique mapping module is used to associate vulnerabilities with attack techniques to determine the scope of attack techniques applicable to an asset.

[0011] The attack pattern formulation and technology filtering module is used to analyze the tactics, techniques and procedures that potential attackers may adopt based on the ATT&CK framework, and to specify the attack pattern set and filter attack techniques suitable for specific system environments.

[0012] The network threat path generation and assessment module is used to automatically generate possible attack paths based on identified asset information and attack patterns, and to quantitatively assess the impact score of different paths on the task.

[0013] A network attack modeling system for complex information systems based on ATT&CK, characterized in that the target system asset characterization and vulnerability identification module includes:

[0014] The asset representation module is used to build a hierarchical set of task capabilities for functions, systems, and components; it constructs a network topology map based on the location information and connectivity between components, which attackers can use to identify potential attack paths and entry points.

[0015] The vulnerability identification module categorizes vulnerabilities in target system components into hardware and software vulnerabilities. It uses the manufacturer, device model, and type information of components in the target system assets to perform keyword searches and matches with the CVE vulnerability database over the years to identify hardware vulnerabilities. It also uses Nmap to scan the target system components, obtain port services and version information, and matches this information with the CVE vulnerability database over the years to identify software vulnerabilities.

[0016] This invention also provides a method for modeling network attacks on complex information systems based on ATT&CK, the method comprising the following steps:

[0017] S1, Asset Representation Module: Actively probes asset data of complex information systems, constructs the hierarchical structure of assets, and generates a topology graph based on the connection relationships between assets;

[0018] S2, Vulnerability Identification Module: Matches asset data with the CVE vulnerability database to identify hardware and software vulnerabilities in components, thereby assessing the vulnerability of the components;

[0019] S3, CVE and ATT&CK Tactical Technique Mapping Module: Utilizes the mapping relationship between vulnerabilities and ATT&CK techniques to construct a list of available tactical techniques for the component, and identifies the technical means that attackers may use;

[0020] S4. Attack Pattern Development Module: Based on the general threat framework, develop a set of attack patterns, map the attacker's tactical behavior at different stages, and build a systematic attack plan.

[0021] S5, Technical Filter Module: Designed with a four-layer technical filtering mechanism to filter the most threatening attack techniques applicable to the adversary for components along the attack path;

[0022] S6. Attack Path Generation Module: Based on the attacker's identity, attack mode, attack entry point, and target, construct the attack scenario; combine the asset topology relationship and use a breadth-first search algorithm to traverse and generate feasible attack paths; match appropriate ATT&CK technologies for each component on the path according to the attack mode, technology filter, and list of available technologies for the components.

[0023] S7 Attack Path Assessment Module: Utilizing a hierarchical attack path assessment method, this module calculates the component with the highest threat impact score in the path and uses it as the final impact score of the path to identify the weakest security links, providing a basis for precise defense.

[0024] (III) Beneficial Effects

[0025] This invention proposes a network attack modeling system and method for complex information systems based on ATT&CK. This invention can systematically construct attack scenarios, simulate attacker behavior, predict potential attack paths, and reduce subjectivity in the modeling process. By comprehensively considering the target system's asset status and vulnerabilities, and obtaining the attacker's capability scope from the ATT&CK framework, this invention achieves a quantitative assessment of the attack path risk level, effectively improving the security situation awareness and defense strategy optimization capabilities of complex information systems. Attached Figure Description

[0026] Figure 1 This is a diagram illustrating the overall architecture of the complex information system network attack modeling based on ATT&CK in this invention. Detailed Implementation

[0027] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0028] This invention relates to the field of network security technology, specifically to the design and implementation of a complex information system network attack model based on ATT&CK, which is used to automatically generate attack paths, quantify risk assessments, and formulate defense strategies.

[0029] This invention provides a network attack modeling system for complex information systems based on ATT&CK, such as... Figure 1 As shown, the modeling system includes the following modules: target system asset characterization and vulnerability identification module, CVE and ATT&CK tactical and technical mapping module, attack pattern formulation and technical filtering module, and network threat attack path generation and evaluation module.

[0030] The target system asset characterization and vulnerability identification module is used to complete the asset topology construction and component vulnerability identification of the target system through automated scanning and data analysis.

[0031] The CVE and ATT&CK tactical technique mapping module is used to associate vulnerabilities with attack techniques to determine the scope of attack techniques applicable to an asset.

[0032] The attack pattern formulation and technology filtering module is used to analyze the tactics, techniques and procedures (TTPs) that potential attackers may adopt based on the ATT&CK framework, specify the attack pattern set, and filter attack techniques suitable for specific system environments.

[0033] The network threat path generation and assessment module is used to automatically generate possible attack paths based on identified asset information and attack patterns, and to quantitatively assess the impact score of different paths on the task.

[0034] I. The specific implementation method of the target system asset characterization and vulnerability identification module is as follows:

[0035] (1) Asset Representation Module: This module is used to construct a hierarchical set of task capabilities for functions, systems, and components. Based on the location information and connectivity between components, a network topology map is constructed, which attackers can use to identify potential attack paths and entry points.

[0036] (2) Vulnerability Identification Module. This module categorizes vulnerabilities in target system components into hardware vulnerabilities and software vulnerabilities. It uses the manufacturer, device model, and type information of components in the target system assets to perform keyword searches and matching with historical CVE vulnerability databases to identify hardware vulnerabilities. It also uses Nmap to scan target system components, obtain port service and version information, and matches this information with historical CVE vulnerability databases to identify software vulnerabilities.

[0037] II. The specific implementation method of the CVE and ATT&CK tactical technology mapping module is as follows:

[0038] A technical link is constructed between CVE, CWE, CAPEC, and ATT&CK, associating and mapping the content of four cybersecurity knowledge bases to form a complete analysis chain from vulnerability to actual attack techniques. After completing asset characterization and vulnerability identification, the corresponding CVE vulnerabilities of the assets can be identified, and tactics and techniques applicable to the assets can be determined based on the mapping relationship.

[0039] (1) CVE—CWE

[0040] CVE is a publicly available vulnerability identification system that assigns a unique number and brief description to each known vulnerability. CWE provides a classification system of common weaknesses in software and systems, describing the root causes and design flaws that lead to vulnerabilities. By mapping specific vulnerabilities in CVEs to CWEs, it is possible to identify the weaknesses behind the vulnerabilities and their causes.

[0041] (2) CWE—CAPEC

[0042] CAPEC defines the specific attack patterns that attackers might employ. It describes attack behavior from the perspective of attack methods and exploitation processes, helping to understand how attackers exploit vulnerabilities in a system (defined by CWE) to carry out attacks. By mapping CWE to CAPEC, it becomes clear which vulnerabilities are likely to be targeted by attackers and the specific attack strategies they might employ.

[0043] (3) CAPEC—ATT&CK

[0044] There is a direct link between the attack patterns described in CAPEC and actual attack behaviors, which are further refined and categorized in the ATT&CK framework. By mapping the attack patterns in CAPEC to the ATT&CK framework, the theoretical model of vulnerability exploitation can be aligned with the tactics and techniques of attackers in the real world.

[0045] III. The specific implementation method of the attack mode formulation and technical filtering module is as follows:

[0046] (1) Attack mode formulation module

[0047] This module, based on a general network threat framework and incorporating real-world attack cases, divides attacker behavior into three phases along its lifecycle: "Participation," "Presence," and "Impact," with distinct tasks and objectives for each phase. In the "Participation" phase, attackers breach the target system's defenses through unauthorized access, corresponding to the "entry point component" objective in the attack path. In the "Presence" phase, attackers establish and maintain persistent access to and control over the victim system, corresponding to the "intermediate component" objective in the attack path. In the "Impact" phase, attackers execute the final malicious operation (such as data theft / system destruction), corresponding to the "target component" objective in the attack path. These three phase objectives are mapped to ATT&CK tactics, constructing various attack patterns (tactical sequences) and comprehensively simulating the attack path from boundary breach to achieving the attacker's intent.

[0048] (2) Technology Filtering Module

[0049] By constructing an attack technology filter, the module identifies the most likely high-threat attack technologies employed by the adversary for each component of the attack path, thus narrowing the attack scope. This module is based on a four-layer progressive filtering mechanism: first, it considers the attacker's identity; second, it considers the target operating system environment; third, it identifies the ATT&CK tactical type; and finally, it optimizes the technology selection through threat scoring. This allows the module to provide the most threatening technology prediction solutions for each component of the attack path in specific operational scenarios, improving the targeting and predictive reliability of the attack model.

[0050] IV. The specific implementation method of the network threat path generation and assessment module is as follows:

[0051] (1) Attack path generation module.

[0052] The asset representation module, based on the network topology diagram formed by the connections between components, serves as the basis for the attack path generation module to perform attack pathfinding. The attack path generation module employs a breadth-first search algorithm, traversing layer by layer from the entry component to the target component, exhaustively listing all potential attack paths. The attack pattern formulation module provides tactical sequences for all components on the attack path, and the technology filtering module refines the tactics to specific attack techniques. Furthermore, the attack path generation module incorporates attack path feasibility verification. By comparing whether the tactical technology set formed by the CVE and ATT&CK tactical technology mapping module for each component in the path supports and satisfies the tactical sequences in the attack pattern formulation module, feasible attack paths are selected, improving the accuracy of attack prediction.

[0053] (2) Attack path assessment module

[0054] This invention proposes a hierarchical attack path assessment method, constructing a task-oriented threat impact quantification system. Based on the asset characterization module results, the mapping from task objectives to technical implementation is divided into four layers: capability layer, functional layer, system layer, and component layer. Each layer is further divided into three categories based on the impact of asset failure on task continuity: task-essential (directly causing task interruption), task-critical (business can be maintained through backup plans), and task-supporting (does not affect main business functions). The overall component impact score is calculated using a four-layer, three-type weighted cumulative model: fixed impact values ​​are pre-assigned to the three asset types (essential / critical / supporting) at each layer (component layer, system layer, functional layer, and capability layer), and calculated using the following formula:

[0055] Component Influence Score = Influence Score of its own component layer * Component layer weight + Influence Score of its system layer * System layer weight + Influence Score of its supporting functional layer * Functional layer weight + Influence Score of its service capability layer * Capability layer weight

[0056] In attack path analysis, the component with the highest impact score is selected as the final impact score of the path to highlight the weakest and most critical security links. The potential threat of these links determines the risk level of the entire path, thus providing a scientific basis for precise defense strategies.

[0057] This invention provides a method for modeling network attacks on complex information systems based on ATT&CK, comprising the following steps:

[0058] S1, Asset Representation Module: Actively probes asset data of complex information systems, constructs the hierarchical structure of assets, and generates a topology graph based on the connection relationships between assets;

[0059] S2, Vulnerability Identification Module: Matches asset data with the CVE vulnerability database to identify hardware and software vulnerabilities in components, thereby assessing the vulnerability of the components;

[0060] S3, CVE and ATT&CK Tactical Technique Mapping Module: Utilizes the mapping relationship between vulnerabilities and ATT&CK techniques to construct a list of available tactical techniques for the component, and identifies the technical means that attackers may use;

[0061] S4. Attack Pattern Formulation Module: Based on the general threat framework, formulate a set of attack patterns, map the tactical behaviors of attackers at different stages (participation, presence, influence), and construct a systematic attack plan.

[0062] S5, Technical Filter Module: Designs a four-layer technical filtering mechanism (attacker identity, operating system type, tactical category, technical score) to filter the most threatening attack techniques applicable to the adversary for components along the attack path;

[0063] S6. Attack Path Generation Module: Constructs attack scenarios based on attacker identity, attack pattern, attack entry point, and target. Combining asset topology relationships, it uses a breadth-first search algorithm to traverse and generate feasible attack paths. Based on attack patterns, technology filters, and a list of available technologies for components, it matches appropriate ATT&CK technologies to each component along the path.

[0064] S7 Attack Path Assessment Module: Utilizing a hierarchical attack path assessment method, this module calculates the component with the highest threat impact score in the path and uses it as the final impact score of the path to identify the weakest security links, providing a basis for precise defense.

[0065] The specific implementation methods for each step are as described in the specific implementation methods of each module of the system above.

[0066] This invention proposes a threat modeling method for complex information systems based on the ATT&CK framework. This method systematically constructs attack scenarios, simulates attacker behavior, predicts potential attack paths, and reduces subjectivity in the modeling process. By comprehensively considering the target system's asset status and vulnerabilities, and obtaining the attacker's capability scope from the ATT&CK framework, this invention achieves a quantitative assessment of the attack path risk level, effectively improving the security situation awareness and defense strategy optimization capabilities of complex information systems.

[0067] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A network attack modeling system for complex information systems based on ATT&CK, characterized in that, The modeling system includes the following modules: target system asset characterization and vulnerability identification module, CVE and ATT&CK tactical and technical mapping module, attack pattern formulation and technical filtering module, and network threat attack path generation and evaluation module; The target system asset characterization and vulnerability identification module is used to complete the asset topology construction and component vulnerability identification of the target system through automated scanning and data analysis. The CVE and ATT&CK tactical technique mapping module is used to associate vulnerabilities with attack techniques to determine the scope of attack techniques applicable to an asset. The attack pattern formulation and technology filtering module is used to analyze the tactics, techniques and procedures that potential attackers may adopt based on the ATT&CK framework, and to formulate attack pattern sets and technology filters to screen attack techniques suitable for specific system environments. The network threat path generation and assessment module is used to automatically generate possible attack paths based on identified asset information and attack patterns, and to quantitatively assess the impact score of different paths on the task. in, The network threat path generation and evaluation module includes: an attack path generation module and an attack path evaluation module; The attack path generation module uses a breadth-first search algorithm to traverse from the entry component to the target component layer by layer, exhaustively listing all potential attack paths; it also includes an attack path feasibility verification module, which compares whether the tactical technology set formed by the CVE and ATT&CK tactical technology mapping module for each component in the path supports and satisfies the tactical sequence in the attack mode formulation module, and selects feasible attack paths. The attack path assessment module is used to construct a mission-oriented threat impact quantification system. Based on the results of the asset characterization module, its mapping from mission objectives to technical implementation is divided into four layers: capability layer, functional layer, system layer, and component layer. Each layer is further divided into three categories according to the impact of asset failure on mission continuity: mission-necessary, mission-critical, and mission-supporting. The overall component impact score is calculated using a four-layer, three-type weighted cumulative model: fixed impact values ​​are pre-assigned to the three types of assets at each layer, and the component impact score is calculated. In the attack path analysis, the component with the highest impact score is selected as the final impact score of the path to highlight the weakest and most critical security links, whose potential threats determine the risk level of the entire path.

2. The complex information system network attack modeling system based on ATT&CK as described in claim 1, characterized in that, The target system asset characterization and vulnerability identification module includes: The asset representation module is used to build a hierarchical set of task capabilities for functions, systems, and components; it constructs a network topology map based on the location information and connectivity between components, which attackers can use to identify potential attack paths and entry points. The vulnerability identification module categorizes vulnerabilities in target system components into hardware and software vulnerabilities. It uses the manufacturer, device model, and type information of components in the target system assets to perform keyword searches and matches with the CVE vulnerability database over the years to identify hardware vulnerabilities. It also uses Nmap to scan the target system components, obtain port services and version information, and matches this information with the CVE vulnerability database over the years to identify software vulnerabilities.

3. The complex information system network attack modeling system based on ATT&CK as described in claim 2, characterized in that, The CVE and ATT&CK tactical technology mapping module constructs a CVE-CWE-CAPEC-ATT&CK technical link, which associates and maps the content of the four network security knowledge bases to form a complete analysis chain from vulnerability to actual attack technology. After completing asset characterization and vulnerability identification, it identifies the CVE vulnerabilities corresponding to the assets and determines the tactics and technologies applicable to the assets based on the mapping relationship.

4. The complex information system network attack modeling system based on ATT&CK as described in claim 3, characterized in that, CVE is a publicly available vulnerability identification system that assigns a unique number and brief description to each known vulnerability; CWE provides a classification system for common weaknesses in software and systems, describing the root causes and design flaws that lead to vulnerabilities. By mapping specific vulnerabilities in CVE to CWE, the weaknesses behind the vulnerabilities and their causes can be identified. CAPEC defines the specific attack patterns that attackers may employ, describing attack behavior from the perspective of attack methods and exploitation processes, helping to understand how attackers exploit vulnerabilities in a system to carry out attacks; by mapping CWE to CAPEC, it clarifies which vulnerabilities are likely to be targeted by attackers, and the specific attack strategies they may adopt. There is a direct link between the attack patterns described in CAPEC and actual attack behaviors, which are further refined and classified in the ATT&CK framework. By mapping the attack patterns in CAPEC to the ATT&CK framework, the theoretical model of vulnerability exploitation is connected with the tactics and techniques of attackers in the real world.

5. The complex information system network attack modeling system based on ATT&CK as described in claim 3, characterized in that, The attack pattern formulation and technical filtering module includes: an attack pattern formulation module and a technical filtering module; The attack pattern formulation module, based on a general network threat framework and combined with real-world attack cases, divides attacker behavior into three stages along the lifecycle: "participation, presence, and influence," and sets different tasks and objectives for each stage. The objectives of the three stages are mapped to ATT&CK tactics to construct various types of attack patterns and fully deduce the attack path of threat actors from boundary breach to achieving their attack intentions. The technology filtering module is used to filter the most likely high-threat attack technologies used by the adversary for each component of the attack path by constructing attack technology filters, thereby narrowing the attack scope. It is based on a four-layer progressive filtering mechanism: first, it is based on the attacker's identity; second, it is combined with the target operating system environment; then, it locks the ATT&CK tactical type; and finally, it selects the best technology through threat scoring, so as to provide the most threatening technology prediction scheme for each component in the attack path under specific combat scenarios.

6. The complex information system network attack modeling system based on ATT&CK as described in claim 5, characterized in that, In the "Participation" phase, the attacker breaches the target system's defenses through unauthorized access, corresponding to the task objective of the "entry point component" in the attack path; in the "Presence" phase, the attacker establishes and maintains a persistent access to and control environment over the victim system, corresponding to the task objective of the "intermediate component" in the attack path; in the "Influence" phase, the attacker executes the final malicious operation, corresponding to the task objective of the "target component" in the attack path.

7. The complex information system network attack modeling system based on ATT&CK as described in claim 5, characterized in that, The asset representation module forms a network topology based on the connections between components, which serves as the basis for the attack path generation module to perform attack pathfinding. The attack mode formulation module provides tactical sequences for all components on the attack path, and the technology filtering module refines the tactics into specific attack techniques.

8. The complex information system network attack modeling system based on ATT&CK as described in claim 5, characterized in that, The component's impact on the score is calculated using the following formula: Component impact score = Impact score of its own component layer Component layer weight + influence score of its system layer System layer weight + its supporting functional layer influence score Functional layer weight + its service capability layer influence score Capability layer weights.

9. A method for modeling network attacks on complex information systems based on ATT&CK, using the modeling system described in any one of claims 7-8, characterized in that, The method includes the following steps: S1, Asset Representation Module: Actively probes asset data of complex information systems, constructs the hierarchical structure of assets, and generates a topology graph based on the connection relationships between assets; S2, Vulnerability Identification Module: Matches asset data with the CVE vulnerability database to identify hardware and software vulnerabilities in components, thereby assessing the vulnerability of the components; S3, CVE and ATT&CK Tactical Technique Mapping Module: Utilizes the mapping relationship between vulnerabilities and ATT&CK techniques to construct a list of available tactical techniques for the component, and identifies the technical means that attackers may use; S4. Attack Pattern Development Module: Based on the general threat framework, develop a set of attack patterns, map the attacker's tactical behavior at different stages, and build a systematic attack plan. S5. Technical Filtering Module: Designs a four-layer technical filtering mechanism to filter the most threatening attack techniques applicable to the adversary for components along the attack path; S6. Attack Path Generation Module: Based on the attacker's identity, attack mode, attack entry point, and target, construct the attack scenario; combine the asset topology relationship and use a breadth-first search algorithm to traverse and generate feasible attack paths; match appropriate ATT&CK technologies for each component on the path according to the attack mode, technology filter, and list of available technologies for the components. S7 Attack Path Assessment Module: Utilizing a hierarchical attack path assessment method, this module calculates the component with the highest threat impact score in the path and uses it as the final impact score of the path to identify the weakest security links, providing a basis for precise defense.

Images