Network risk quantitative evaluation method and system based on attack chain deduction
By constructing a Bayesian attack graph and calculating the risk quantification value of the attack path based on attack chain deduction, the problem of insufficient correlation analysis in traditional risk assessment is solved, and a more accurate risk assessment is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-25
- Publication Date
- 2026-03-13
AI Technical Summary
Traditional cyber risk assessment methods lack in-depth analysis of the correlation between attack threats and asset vulnerabilities in the attack chain, resulting in inaccurate risk assessment results.
By constructing a Bayesian attack graph (BAG) and extrapolating the attack chain, the probability of attack success, cost, and potential loss of the attack path are calculated. Combined with asset value and the degree of risk impact, the risk value is quantified.
It improves the accuracy of risk assessment, covers node information related to network attacks, improves the incomplete coverage of risk quantification methods, and avoids the problem of attack path combination explosion in traditional solutions.
Smart Images
Figure CN121664483A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method and system for quantitative assessment of network risks based on attack chain deduction. Background Technology
[0002] With the rapid development of smart grids and the energy internet, power systems increasingly rely on information and communication technologies to achieve efficient operation, but this also makes them a prime target for cyberattacks. As a critical national information infrastructure, the safe and stable operation of the power system is directly related to the national economy and public safety. Advanced Persistent Threats (APTs) employ a multi-stage, multi-carrier composite attack model, combining precise social engineering techniques with zero-day vulnerability exploitation to construct highly concealed lateral movement attack chains.
[0003] Risk assessment can systematically analyze the relationship between threats, vulnerabilities, and asset value in a power system, avoiding one-size-fits-all approaches or unclear priorities. It can also quantify asset value, the severity of vulnerabilities, and the probability of threats to arrive at a clear risk level, allowing companies to prioritize their limited security resources for high-risk areas.
[0004] However, traditional methods often separate attack threats and asset vulnerabilities for independent assessment, lacking in-depth analysis of the correlation between the two, resulting in inaccurate risk assessment results.
[0005] Therefore, a method and system for quantitative assessment of network risks based on attack chain deduction is needed. Summary of the Invention
[0006] To address the issue of inaccurate risk assessment in existing technologies, this invention provides a method and system for quantitative network risk assessment based on attack chain deduction, which can improve the accuracy of risk assessment. The specific technical solution is as follows: In a first aspect, embodiments of this application provide a method for quantitatively assessing network risks based on attack chain deduction, including: Acquire network attack data and target system data; construct a Bayesian Attack Graph (BAG) based on the network attack data and target system data. The BAG includes nodes, edges, and a conditional probability table. Each node represents an attack event or system state change event in the network attack data, each edge represents a causal relationship or state transition relationship between nodes, and the conditional probability table includes the conditional probability that a corresponding node is true given the states of all parent nodes. A node being true means that the corresponding attack event or system state change event has occurred. Based on the BAG, calculate the attack success probability of each attack path in the BAG; calculate the attack cost and potential loss of each attack path based on the network attack data and target system data; and calculate a risk quantification value based on the attack success probability, attack cost, and potential loss.
[0007] Preferably, the node includes a head node without a parent node, and the conditional probability table includes the initial attack success probability of the head node. The calculation process of the initial attack success probability includes: obtaining the exploitability score and impact score of the vulnerability corresponding to the head node from the vulnerability scoring system, and calculating the vulnerability baseline score based on the exploitability score and the impact score; calculating the time decay factor of the vulnerability corresponding to the head node through the vulnerability code exploitability time function and the patch improvement level time function, the time decay factor is used to indicate the change of the threat of the vulnerability corresponding to the head node over time; calculating the time decayed vulnerability dynamic score based on the vulnerability baseline score and the time decay factor; calculating the connection weight of the node in the network based on the network topology in the target system data using the PageRank algorithm; and performing a weighted calculation based on the vulnerability dynamic score and the connection weight to obtain the initial attack success probability.
[0008] Preferably, the network attack data includes an attack chain; the conditional probability is calculated based on the attack chain and the initial attack success probability.
[0009] Preferably, the attack chain includes a reconnaissance and tracking phase, a weapon construction phase, a payload delivery phase, a vulnerability exploitation phase, an installation and implantation phase, a command and control phase, and a target action phase.
[0010] Preferably, the formula for calculating the risk quantification value includes: ; Where L represents the potential loss, P represents the probability of a successful attack, and C represents the cost of the attack.
[0011] Preferably, the calculation factors for the potential loss include asset value and risk impact level. The asset value is obtained based on the confidentiality, integrity, and availability of the corresponding assets in the target system data. The risk impact level is obtained based on the scope of data leakage, system downtime, and recovery difficulty after the attack path is successful.
[0012] Preferably, the cost of the attack includes technical costs, resource costs, economic costs, and risk costs.
[0013] Secondly, embodiments of this application provide a network risk quantification assessment system based on attack chain deduction, applied to the method described in the first aspect, the system comprising: The acquisition module is used to acquire network attack data and target system data; The construction module is used to build a Bayesian Attack Graph (BAG) based on the network attack data and the target system data. The BAG includes nodes, edges, and a conditional probability table. The node is an attack event or system state change event in the network attack data. The edge is the causal relationship or state transition relationship between the nodes. The conditional probability table includes the conditional probability that the corresponding node is true given the states of all parent nodes. The state of a node is true when the corresponding attack event or system state change event is achieved. The calculation module is used to calculate the success probability of an attack for each attack path in the BAG based on the BAG. The calculation module is also used to calculate the attack cost and potential losses of the attack path based on the network attack data and the target system data; The calculation module is also used to calculate a risk quantification value based on the probability of the attack's success, the cost of the attack, and the potential loss.
[0014] Thirdly, embodiments of this application provide a computing device, including: a memory for storing a program; and a processor for loading the program to execute the method as described in the first aspect.
[0015] Fourthly, embodiments of this application provide a computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform the method described in the first aspect.
[0016] Compared with existing technologies, the beneficial effects of this invention are as follows: By constructing a BAG and generating a conditional probability table according to the relationship between a node and its parent node, it can cover all node information related to network attacks, effectively improving the problem of incomplete coverage in risk quantification methods. Furthermore, by incorporating the logical dependencies between multiple steps in the attack chain and the attacker's actual cost-benefit trade-offs into the risk quantification calculation, the accuracy of the risk quantification assessment results is further improved. Attached Figure Description
[0017] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.
[0018] Figure 1 A flowchart illustrating a network risk quantification assessment method based on attack chain deduction provided in this application embodiment; Figure 2 A schematic diagram of the structure of a network risk quantification assessment system based on attack chain deduction provided in this application embodiment; Figure 3 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation
[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0020] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.
[0021] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.
[0022] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.
[0023] To address the issue of inaccurate risk assessment in traditional methods, this invention provides a network risk quantification assessment method and system based on attack chain deduction, which can improve the accuracy of risk assessment.
[0024] Please see Figure 1 , Figure 1 This application provides a flowchart illustrating a method for quantitatively assessing network risks based on attack chain deduction, applicable to computing devices. Figure 1 As shown, the method includes: Step 101: The computing device acquires network attack data and target system data.
[0025] The target system is the system whose cybersecurity risks are to be assessed. Specifically, it can be a data-intensive system, a public service system, a critical business support system, an external interaction system, a basic equipment-related system, or any other system that requires a security assessment.
[0026] The computing device is a server or terminal, specifically a server or terminal within the target system, which can communicate with devices or subsystems within the target system to obtain data from the target system.
[0027] The cyberattack data includes attack chains and threat intelligence.
[0028] Preferably, the computing device can pre-establish an attack chain model, decomposing network attack behavior into multiple stages. This attack chain includes the reconnaissance and tracking stage, weapon construction stage, payload delivery stage, vulnerability exploitation stage, installation and implantation stage, command and control stage, and target action stage.
[0029] Reconnaissance is the stage where attackers collect information about a target, such as through WHOIS queries, network scanning (e.g., NMAP scanning of IP segments and open ports), search engines, and even social media.
[0030] Weaponization is the stage where attackers create malicious payloads based on reconnaissance information, such as creating Office documents with malicious macros or PDF files bundled with exploits.
[0031] Payload delivery is the stage of delivering weaponized payloads to a target. Common methods include phishing emails, malicious website access, or physical media (such as USB drop attacks).
[0032] Exploitation is the stage in which a vulnerability on a target system is triggered to execute malicious code, such as exploiting a zero-day vulnerability in Office software or a browser.
[0033] Installation is the stage of establishing a persistent access channel on the target system, such as installing a web shell, setting up a registry startup item, or attempting to reside in memory.
[0034] Command and Control (C2) is the stage where the compromised system establishes a communication channel with the server controlled by the attacker, which may employ covert communication methods such as DNS tunneling, HTTP reverse proxy, or Tor connection.
[0035] Actions on Objectives are the phases in which attackers carry out their ultimate goals, such as data theft, system sabotage, ransomware encryption, or lateral movement within an internal network to expand their control.
[0036] The division into stages can effectively establish the relationship between the attack process and the final risk quantification value, and can represent the risk quantification value in an easy-to-understand way.
[0037] Threat intelligence comprises structured information about current and potential cyber threats sourced from external channels such as security vendor monitoring data, industry sharing platforms, underground cybercrime monitoring, and warnings from international security organizations. Specifically, this threat intelligence includes hacker attack methods, characteristics of new malware, exploit tools, target preferences, and cybercrime attack trends.
[0038] The target system data includes the target system's network topology, asset information, security vulnerability data, and historical protection data.
[0039] The security vulnerability data comes from vulnerability scanning tool detection results, penetration test reports, vendor vulnerability announcements, and security team manual investigation records. Specifically, it includes vulnerability number, vulnerability type, risk level, scope of impact, and whether there are readily available exploit tools.
[0040] Among them, historical protection data is the target system's past security protection records, including historical attack event records (attack type, occurrence time, and impact), security device interception logs (firewall and intrusion detection system logs), patch repair records, and emergency response results.
[0041] Step 102: The computing device constructs a Bayesian Attack Graph (BAG) based on the network attack data and the target system data.
[0042] The BAG includes node N, edge E, parent node set M, and conditional probability table CPT, and its expression is BAG = (N, E, M, CPT).
[0043] Specifically, this node represents an attack event or system state change event within the network attack data. Attack events can be obtained from the network attack data, while system state change events can be obtained by combining asset information from the target system data to identify system state changes that will occur when various assets are attacked. Nodes include attack initiation nodes, corresponding to the initial stage of the attack chain; attack intermediate nodes, corresponding to the intermediate stages of the attack chain; and attack target nodes, corresponding to the final target of the attack chain.
[0044] Here, each edge represents a causal or state transition relationship between nodes. The attack chain defines the natural order of attack progression. This directly guides the creation of the edge set E. For example, an edge pointing from a node in the "reconnaissance and tracking" phase to a node in the "weaponization" phase is logical, while a reverse edge is meaningless. This ensures that BAG is logically consistent with the actual attack flow.
[0045] In this approach, a node's parent node comes from an earlier stage in the attack chain. This limits the complexity of CPT and ensures the plausibility of causal relationships.
[0046] The conditional probability table includes the conditional probability of a node being true given the states of all parent nodes; a true state of a node means that the corresponding attack event or system state change event has occurred.
[0047] Preferably, the node includes a head node without a parent node, and the conditional probability table includes the initial attack success probability of the head node. The calculation process of the initial attack success probability includes: obtaining the exploitability score and impact score of the vulnerability corresponding to the head node from the vulnerability scoring system, and calculating the vulnerability baseline score based on the exploitability score and the impact score; calculating the time decay factor of the vulnerability corresponding to the head node through the vulnerability code exploitability time function and the patch improvement level time function, the time decay factor is used to indicate the change of the threat of the vulnerability corresponding to the head node over time; calculating the time decayed vulnerability dynamic score based on the vulnerability baseline score and the time decay factor; calculating the connection weight of the node in the network based on the network topology in the target system data using the PageRank algorithm; and performing a weighted calculation based on the vulnerability dynamic score and the connection weight to obtain the initial attack success probability.
[0048] It can be understood that the first node without a parent node in the BAG is the attack initiation node, and its initial attack success probability is the attack success probability calculated based on prior knowledge; when the computing device detects that the event corresponding to the attack initiation node has been achieved, the computing device can set the attack success probability of the first node to 1.
[0049] The initial attack success probability can be calculated by fusing prior data from multiple sources: 1. The computing device can first acquire data from the Common Vulnerability Scoring System (CVSS) adapted for use in Industrial Control System (ICS) scenarios, and calculate the vulnerability baseline score. The calculation formula is as follows: = ; Among them, Exploit is the availability score. The impact score takes into account the characteristics of industrial control systems. Specifically, Exploit measures the ease with which an attacker can exploit a target ICS vulnerability, that is, the threshold for transforming a theoretical flaw into an actual attack for a vulnerability in the first node. Used to assess the extent to which a target ICS vulnerability, once exploited, would damage the core objectives of the ICS.
[0050] Among them, the availability score and the impact score are... All of these can be obtained from CVSS.
[0051] 2. Then, the computing device can incorporate the exploitability time function em(t) and the patch completion level time function rl(t) to calculate the time decay factor of the vulnerability corresponding to the first node, and then calculate the dynamic vulnerability score. : ; As exploit code becomes more publicly available and popular, the value of em(t) will increase.
[0052] When a vulnerability is first disclosed, there is no available exploit, and the em(t) value is low, which can be set to 0.1~0.3; when proof-of-concept (PoC) code appears, the em(t) value increases, which can be set to 0.4~0.7; when weaponized exploits or large-scale in-the-wild exploits appear, the em(t) value can be set to 0.8~1.0.
[0053] With the release and widespread installation of official patches, The value will decrease.
[0054] When a vulnerability is first disclosed and no patch is released, rl(t) = 1 (risk does not decay); after the official patch is released, rl(t) begins to decrease and can be set to 0.5~0.9; the wider the patch is deployed, the lower the rl(t) value (indicating that the risk is decaying), and can be set to 0.0~0.4.
[0055] 3. Then, the computing device can use the PageRank algorithm to calculate the weight value of a node based on its importance in the network topology. The iterative calculation formula for the PageRank algorithm's page ranking value (PR) is: ; Where T is the initial probability matrix, with all probabilities being equal by default; p is the weighting coefficient, set to 0.85; and e is the normalized eigenvector, set to 2.718. This is the PR from the previous iteration. The initial PR is 1 / N, where N is the number of nodes.
[0056] By iterating continuously, the PageRank value of each node converges to a stable state. Then, the stable PageRank value is normalized and summed. The weight of each node, which is the proportion of its PageRank value to the total, is obtained as the weight value W1.
[0057] 4. Then, the computing device can calculate the probability of success of this initial attack. : ; Where α and β are the weights of each factor, and γ is the calibration coefficient, which needs to be optimized based on historical data and the actual environment.
[0058] Through the above process, the initial attack success probability of the first node can be obtained. For a general node with a parent node, its attack success probability is determined by the state of its parent node.
[0059] Preferably, the computing device can calculate the conditional probability based on the attack chain and the initial attack success probability.
[0060] In this context, a node's CPT needs to encompass a combination of the states of all its parent nodes (each parent node is currently either true or false). The CPT can be constructed based on logical relationships, weighted fusion, or data learning.
[0061] Specifically, the computing device can determine the dependencies between attack steps based on the attack chain, that is, determine the parent-child relationships between nodes; then, based on this parent-child relationship and the initial attack success probability of the first node of the corresponding attack chain, it calculates the conditional probability. For example: If node The condition is true only if all parent nodes are true; therefore, in CPT, the condition is true only if all parent nodes are true. =1, otherwise 0. At this point, the node... The conditional probability is the probability that all parent nodes are true.
[0062] The node will be triggered if any parent node is true. In CPT, if at least one parent node is true... =1. At this time, the node... The conditional probability is 1 - the probability that all parent nodes are false.
[0063] Specifically, if the parent node is related to the node The effects of different factors can be combined using weights. For example, weights can be assigned based on the initial probability of the parent node or expert knowledge.
[0064] The computing device can start from the child nodes of each first node in the BAG and calculate the conditional probability of each node layer by layer.
[0065] Specifically, computing devices can also use machine learning methods (such as Bayesian learning) to estimate CPT from data.
[0066] Step 103: The computing device calculates the probability of success of each attack path in the BAG based on the BAG.
[0067] After obtaining BAG, the computing device can calculate the probability of success of each attack path to comprehensively assess the current security risks of the system.
[0068] The computing device can determine the specific attack path from the BAG based on the attack chain, and then calculate the current attack success probability of the final node in each attack path as the attack success probability of the corresponding attack path.
[0069] Step 104: The computing device calculates the attack cost and potential loss of the attack path based on the network attack data and the target system data.
[0070] Potential loss is a measure of the negative impact of a successful attack. The computing device can calculate this based on expert assessment experience, business impact analysis, or historical event loss data, representing the business impact and economic losses caused by a successful attack. Specifically, the computing device can comprehensively assess asset value and vulnerability severity, using a multidimensional scoring method to calculate the potential loss.
[0071] Preferably, the calculation factors for the potential loss include asset value and risk impact level. The asset value is obtained based on the confidentiality, integrity, and availability of the corresponding assets in the target system data. The risk impact level is obtained based on the scope of data leakage, system downtime, and recovery difficulty after the attack path is successful.
[0072] The value of computing devices can be assigned based on three dimensions: confidentiality, integrity, and availability, with each value ranging from 1 to 10. The average or maximum value of these three dimensions is then used as the potential loss.
[0073] Specifically, confidentiality refers to the importance of assets not being accessed or leaked by unauthorized personnel / systems. For example, core corporate technical documents and user privacy data, if leaked, would cause business losses or compliance risks, so these assets are assigned a high confidentiality value; while publicly available product manuals are assigned a low confidentiality value.
[0074] Integrity refers to the importance of preventing unauthorized tampering or damage to asset data / functions. For example, financial transaction data or the operating parameters of industrial control systems, if tampered with, could lead to economic losses or equipment failures, so integrity is assigned a high value; while temporary drafts, even if modified, have a smaller impact, so integrity is assigned a low value.
[0075] Availability is the importance of an asset being accessible and usable when needed. For example, a hospital's emergency medical system or an e-commerce platform's payment function would have a high availability rating if its use was interrupted, as this would directly impact business operations or cause serious consequences. In contrast, historical data backups that are used only occasionally have a relatively low availability rating.
[0076] The computing device assigns a value to the degree of risk based on factors such as the potential scope of data leakage, system downtime, and recovery difficulty caused by the vulnerability. Each factor has a value range of 1 to 10.
[0077] This includes the cost that attackers must pay to carry out an attack.
[0078] Preferably, the cost of the attack includes technical costs, resource costs, economic costs, and risk costs.
[0079] The technical costs include the difficulty of developing or acquiring exploit tools and bypassing the target system's defense mechanisms; the resource costs are the computing resources, network bandwidth, and time required to carry out the attack; the economic costs are the expenses for purchasing zero-day vulnerabilities, renting botnets, and hiring personnel; and the risk costs are the legal risks of being tracked, located, and captured after the attack. Each of these factors is rated from 1 to 10.
[0080] The above factors are normalized using a positive index normalization algorithm; higher costs result in larger values. ; Where x is the factor value, x' is the normalized factor value, and min and max are the maximum and minimum values among all factor values, respectively; then, the attack cost C is calculated based on the factor values of all factors: ; The ROUND() function is the floor function. ~xn The normalized value is for n factors.
[0081] Step 105: The computing device calculates a risk quantification value based on the probability of the attack's success, the cost of the attack, and the potential loss.
[0082] The formula for calculating this risk quantification value includes: ; Where L represents the potential loss, P represents the probability of a successful attack, and C represents the cost of the attack.
[0083] Among them, the exponential term in the formula This reflects the negative impact of attack cost on risk (the higher the cost, the lower the risk). This is a modeling assumption based on cybersecurity practices and economic principles (attackers have limited resources and are rational), which enables the model to better distinguish between high-risk (high-reward - low-cost) and low-risk attack paths.
[0084] In this embodiment, by constructing a conditional probability table using BAG (Blockchain Architecture) based on the relationship between nodes and their parent nodes, all node information related to network attacks can be covered, effectively improving the incomplete coverage of existing risk quantification methods. Furthermore, by incorporating the logical dependencies between multiple steps in the attack chain and the attacker's actual cost-benefit trade-offs into the calculation, the accuracy of the risk quantification assessment results is further improved.
[0085] Meanwhile, using a Bayesian attack graph model can avoid the combinatorial explosion problem of attack paths faced when using linear model estimation in traditional solutions, and can cover the blind spots of risk assessment.
[0086] The method provided in the embodiments of this application has been described above. The system provided in the embodiments of this application will be described below.
[0087] Please see Figure 2 , Figure 2 A schematic diagram of a network risk quantification assessment system based on attack chain deduction provided in this application embodiment is shown below. Figure 2 As shown, the system 20 includes: Acquisition module 201 is used to acquire network attack data and target system data; Module 202 is used to construct a Bayesian Attack Graph (BAG) based on the network attack data and the target system data. The BAG includes nodes, edges, and a conditional probability table. The node is an attack event or system state change event in the network attack data. The edge is the causal relationship or state transition relationship between the nodes. The conditional probability table includes the conditional probability that the corresponding node is true given the states of all parent nodes. The state of the node is true when the corresponding attack event or system state change event is achieved. The calculation module 203 is used to calculate the success probability of an attack for each attack path in the BAG based on the BAG. The calculation module 203 is also used to calculate the attack cost and potential loss of the attack path based on the network attack data and the target system data; The calculation module 203 is also used to calculate a risk quantification value based on the probability of success of the attack, the cost of the attack, and the potential loss.
[0088] Preferably, the node includes a head node without a parent node, and the conditional probability table includes the initial attack success probability of the head node. The calculation process of the initial attack success probability includes: obtaining the exploitability score and impact score of the vulnerability corresponding to the head node from the vulnerability scoring system, and calculating the vulnerability baseline score based on the exploitability score and the impact score; calculating the time decay factor of the vulnerability corresponding to the head node through the vulnerability code exploitability time function and the patch improvement level time function, the time decay factor is used to indicate the change of the threat of the vulnerability corresponding to the head node over time; calculating the time decayed vulnerability dynamic score based on the vulnerability baseline score and the time decay factor; calculating the connection weight of the node in the network based on the network topology in the target system data using the PageRank algorithm; and performing a weighted calculation based on the vulnerability dynamic score and the connection weight to obtain the initial attack success probability.
[0089] Preferably, the network attack data includes an attack chain; the conditional probability is calculated based on the attack chain and the initial attack success probability.
[0090] Preferably, the attack chain includes a reconnaissance and tracking phase, a weapon construction phase, a payload delivery phase, a vulnerability exploitation phase, an installation and implantation phase, a command and control phase, and a target action phase.
[0091] Preferably, the formula for calculating the risk quantification value includes: ; Where L represents the potential loss, P represents the probability of a successful attack, and C represents the cost of the attack.
[0092] Preferably, the calculation factors for the potential loss include asset value and risk impact level. The asset value is obtained based on the confidentiality, integrity, and availability of the corresponding assets in the target system data. The risk impact level is obtained based on the scope of data leakage, system downtime, and recovery difficulty after the attack path is successful.
[0093] Preferably, the cost of the attack includes technical costs, resource costs, economic costs, and risk costs.
[0094] The network risk quantification assessment system based on attack chain deduction provided in this application embodiment can be understood by referring to the relevant content in the foregoing method embodiment section, and will not be repeated here.
[0095] like Figure 3 As shown, Figure 3 This is a schematic diagram of a possible logical structure of a computing device provided in an embodiment of this application. The computing device 30 includes a processor 301, a communication interface 302, a memory 303, and a bus 304. The processor 301, the communication interface 302, and the memory 303 are interconnected via the bus 304. In an embodiment of this application, the processor 301 is used to control and manage the operation of the computing device 30. For example, the processor 301 is used to execute... Figure 1 The steps in the embodiments and / or other processes used in the techniques described herein. Communication interface 302 is used to support communication by computing device 30. Memory 303 is used to store program code and data of computing device 30.
[0096] The processor 301 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, etc. The bus 304 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.
[0097] In another embodiment of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the above-described... Figure 1 The method described in the embodiments.
[0098] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.
[0099] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0100] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.
[0101] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0102] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0103] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.
[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.
Claims
1. A method for quantitatively assessing network risk based on attack chain deduction, characterized in that, The method includes: Obtain network attack data and target system data; A Bayesian Attack Graph (BAG) is constructed based on the network attack data and the target system data. The BAG includes nodes, edges, and a conditional probability table. The nodes are attack events or system state change events in the network attack data. The edges are causal relationships or state transition relationships between the nodes. The conditional probability table includes the conditional probability that a corresponding node is true given the states of all parent nodes. A node being true means that the corresponding attack event or system state change event has occurred. Based on the BAG, calculate the attack success probability of each attack path in the BAG; Based on the network attack data and the target system data, calculate the attack cost and potential losses of the attack path; A risk quantification value is calculated based on the attack success probability, the attack cost, and the potential loss.
2. The method according to claim 1, characterized in that, The node includes a head node without a parent node, and the conditional probability table includes the initial attack success probability of the head node; the calculation process for the initial attack success probability includes: The exploitability score and impact score of the vulnerability corresponding to the first node are obtained from the vulnerability scoring system, and the vulnerability baseline score is calculated based on the exploitability score and the impact score. The time decay factor of the vulnerability corresponding to the first node is calculated by using the exploitability time function and the patch improvement level time function. The time decay factor is used to indicate how the threat of the vulnerability corresponding to the first node changes over time. Based on the vulnerability baseline score and the time decay factor, the dynamic vulnerability score after time decay is calculated; The PageRank algorithm is used to calculate the connection weight of the node in the network based on the network topology in the target system data. The initial attack success probability is obtained by weighting the vulnerability dynamic score and the connection weight.
3. The method according to claim 2, characterized in that, The network attack data includes attack chains; the conditional probability is calculated based on the attack chains and the initial attack success probability.
4. The method according to claim 3, characterized in that, The attack chain includes the reconnaissance and tracking phase, weapon construction phase, payload delivery phase, vulnerability exploitation phase, installation and implantation phase, command and control phase, and target action phase.
5. The method according to any one of claims 1-4, characterized in that, The formula for calculating the risk quantification value includes: ； Where L represents the potential loss, P represents the probability of a successful attack, and C represents the cost of the attack.
6. The method according to claim 5, characterized in that, The calculation factors for the potential loss include asset value and risk impact. The asset value is obtained based on the confidentiality, integrity, and availability of the corresponding assets in the target system data. The risk impact is obtained based on the scope of data leakage, system downtime, and recovery difficulty after the attack path is successfully attacked.
7. The method according to claim 5, characterized in that, The cost of the attack includes technical costs, resource costs, economic costs, and risk costs.
8. A network risk quantitative assessment system based on attack chain deduction, characterized in that, The system, applied to the method of any one of claims 1-7, comprises: The acquisition module is used to acquire network attack data and target system data; A construction module is used to construct a Bayesian attack graph (BAG) based on the network attack data and the target system data. The BAG includes nodes, edges, and a conditional probability table. The nodes are attack events or system state change events in the network attack data. The edges are causal relationships or state transition relationships between the nodes. The conditional probability table includes the conditional probability that a corresponding node is true given the states of all parent nodes. A node being true means that the corresponding attack event or system state change event has occurred. The calculation module is used to calculate the success probability of an attack for each attack path in the BAG based on the BAG. The calculation module is also used to calculate the attack cost and potential loss of the attack path based on the network attack data and the target system data; The calculation module is also used to calculate a risk quantification value based on the attack success probability, the attack cost, and the potential loss.
9. A computing device, characterized in that, include: Memory, used to store programs; A processor for loading the program to perform the method as described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method of any one of claims 1-7.