Network security situation quantitative evaluation prediction method based on attack chain context awareness

Abstract

The invention relates to the technical field of network security, and discloses a network security situation quantitative evaluation prediction method based on attack chain context awareness, which comprises the following steps: collecting heterogeneous security data and mapping the heterogeneous security data to a preset attack chain framework to obtain standardized event data; constructing a dynamic attribute graph, and clustering the data based on a preset association factor to generate an attack story line describing a complete attack activity; calculating a risk value of a story line from three dimensions of attack progress depth, transverse influence breadth and defensive measure effectiveness, and generating a network security situation score; and determining a high-risk story line as a starting point based on the situation score, constructing a potential attack graph in combination with network topology, traversing and searching feasible paths pointing to key assets, sorting based on risk values, and generating a prediction result containing the situation score and a high-risk path. According to the method, the graph association of the alarm data, the multi-dimensional quantitative evaluation of the risk and the accurate prediction of the attack path are realized, and the active defense capability of the network security is effectively improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method for quantitative assessment and prediction of network security situation based on attack chain context awareness. Background Technology

[0002] Currently, as cyberattacks become increasingly covert and organized, traditional single-point defense devices are no longer sufficient to cope with advanced persistent threats, making security situation awareness technology the core of the defense system. To systematically understand attack behavior, the industry has widely adopted attack chain models (such as the MITRE ATT&CK framework, a widely used knowledge base framework for attack tactics and techniques), deconstructing the network intrusion process into tactics, techniques, and processes. This aims to provide a unified descriptive language for massive amounts of security data, assisting Security Operations Centers (SOCs) in understanding the full picture of threats.

[0003] For the application of the aforementioned attack chain model, existing technologies primarily rely on log collection and feature matching. Specifically, security systems collect network traffic, system processes, and user operation records in real time, mapping captured abnormal behaviors to pre-defined attack chain technology IDs. Analysts then manually analyze the relationships between alerts based on these mappings and information from the asset management database, and determine the vulnerability level of affected systems based on vulnerability scanning results, thereby formulating corresponding emergency response measures. This approach essentially involves static indexing of known features and manual assessment.

[0004] However, existing attack chain-based situational assessment methods still have shortcomings. First, traditional alert data is often discrete and lacks multi-dimensional correlation analysis based on graph structures, making it difficult to reconstruct fragmented clues into a complete attack storyline with spatiotemporal logic, easily getting lost in a sea of ​​false alarms. Second, the risk assessment process relies too heavily on static indicators and fails to combine dynamic quantitative calculations of attack chain depth, lateral impact breadth, and defense effectiveness, making the assessment results unable to truly reflect the real-time situation of offensive and defensive confrontation. In addition, existing technologies generally lack forward-looking predictive capabilities, unable to construct potential attack graphs based on the current high-risk state and deduce subsequent paths, leaving the defender in a passive tracing situation, unable to proactively block attacks before core assets are damaged.

[0005] Therefore, this invention provides a method for quantitative assessment and prediction of network security situation based on attack chain context awareness, in order to address the shortcomings of existing technologies. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a method for quantitative assessment and prediction of network security situation based on attack chain context awareness. This method solves the problems in existing network security technologies, such as the difficulty in reconstructing a complete attack story from isolated alarm data, the inability of static assessment to quantify dynamic risks, and the lack of forward-looking prediction capabilities for subsequent attack paths.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a network security situation quantitative assessment and prediction method based on attack chain context awareness, comprising the following steps:

[0008] S1. Collect heterogeneous security data in the network environment and perform normalization processing. Use a preset rule base and model to map the normalized security events to the technical identifiers in the preset attack chain framework to obtain standardized event data with technical identifiers.

[0009] S2. Construct a dynamic attribute graph based on the standardized event data with technical identifiers, instantiate the standardized event data into entity nodes and interaction behavior edges in the dynamic attribute graph, and cluster and associate the entity nodes and interaction behavior edges based on preset association factors to generate an attack storyline describing the attack activities.

[0010] S3. Receive the attack storyline, calculate the attack progress depth value of the attack storyline on the preset attack chain framework, the lateral impact breadth value of the attack storyline on the affected assets, and the defense measure effectiveness coefficient of the defense measures deployed against the attack technology involved in the attack storyline, and calculate the risk value of the attack storyline based on the attack progress depth value, the lateral impact breadth value and the defense measure effectiveness coefficient.

[0011] S4. Determine the high-risk attack storyline to be predicted based on the risk value of the attack storyline, or determine the high-risk attack storyline to be predicted based on the network security situation score generated by the risk value of the attack storyline; take the current state of the high-risk attack storyline as the prediction starting point, construct a potential attack graph in combination with network topology and vulnerability information, traverse and search all feasible paths from the prediction starting point to the preset critical assets in the potential attack graph, and prioritize the feasible paths based on the path risk value to generate an evaluation prediction result containing a list of high-risk attack paths.

[0012] By adopting the above technical solutions, attack storylines are constructed using graph clustering, and multi-dimensional quantitative assessments are performed by combining depth, breadth, and defense effectiveness. Path prediction is then based on high-risk states. These solutions address the issues of fragmented alerts and a lack of quantitative basis for assessments, enabling full lifecycle monitoring of threats and enhancing proactive defense capabilities.

[0013] Preferably, in step S1, the behavioral characteristics of the security event are identified, matched with the tactics and techniques of the preset attack chain framework, and marked with a technical identifier ID indicating the type of attack technique.

[0014] By adopting the above technical solutions, the semantics of heterogeneous data are unified, and the intent of attack techniques is clarified.

[0015] Preferably, in step S2, entities such as hosts and processes are instantiated as graph nodes, behaviors such as network connections are instantiated as directed edges, and timestamps and asset tags are added.

[0016] By adopting the above technical solutions, flat logs are transformed into a graph structure, providing a foundation for structured analysis.

[0017] Preferably, in step S2, correlation factors such as time and parent-child relationship are selected, and a community discovery algorithm is used to identify the node set and aggregate it to generate an attack storyline.

[0018] By adopting the above technical solutions, complex attack behaviors can be effectively identified by mining the intrinsic connections based on multi-dimensional factors.

[0019] Preferably, in step S3, a basic risk weight is preset that increases non-linearly with the tactical stage, and the highest weight reached by the attack storyline is selected as the attack progress depth value.

[0020] By adopting the above technical solutions, the degree of progress of the kill chain can be quantified, reflecting the urgency of the attack.

[0021] Preferably, in step S3, the product of the value weight of the affected asset and the attack technology impact coefficient is accumulated to obtain the horizontal impact breadth value.

[0022] By adopting the above technical solutions, the value of assets and the impact of attacks are comprehensively considered, and the solutions meet business security requirements.

[0023] Preferably, in step S3, the defense failure coefficient is calculated based on the effectiveness of the defense measures, and the product of the attack progress depth, the lateral impact breadth, and the defense failure coefficient is used as the risk value to generate a situation score.

[0024] By adopting the above technical solutions, a defense effectiveness offset is introduced to objectively reflect the remaining risks.

[0025] Preferably, in step S4, the permission status is defined as a node, and the exploitation techniques are defined as edges, generating a transfer path graph describing the transition from initial access to control of core assets. By adopting the above technical solution, a full-network attack surface model is constructed, providing a complete path search space.

[0026] Preferably, in step S4, the product of the path success rate and the target asset value is calculated, and then divided by the average defense strength of the path to obtain the path risk value.

[0027] By adopting the above technical solutions, high-risk paths can be accurately selected by comprehensively considering the attack costs, benefits, and defense costs.

[0028] Preferably, in step S4, a list of high-risk paths is extracted by sorting the path risk values, the next-hop attack intent is identified, and the situation score is associated with the path list and output.

[0029] By adopting the above technical solutions, the urgent threats and trends can be visually displayed, assisting in the formulation of blocking strategies.

[0030] This invention provides a method for quantitative assessment and prediction of network security situation based on attack chain context awareness. It has the following beneficial effects:

[0031] 1. This invention collects heterogeneous security data and performs paradigmatic processing, mapping it to technical identifiers within a predefined attack chain framework. It then constructs a dynamic attribute graph for clustering and association to generate attack storylines. This technical solution can transform fragmented, massive amounts of alert data into complete attack sequences with contextual logic, effectively solving the problem of isolated events being difficult to analyze in traditional detection methods, reducing false alarm rates, and accurately identifying complex, advanced threats that have been lurking for a long time or moving laterally across hosts.

[0032] 2. This invention constructs a multi-dimensional risk quantification assessment model by separately calculating the attack progress depth value, the lateral impact breadth value, and the defense measure effectiveness coefficient. This technical solution changes the ambiguity of traditional qualitative assessment, and can combine the attacker's stage in the kill chain, the actual value of the affected assets, and the blocking capability of the existing defense system to output objective and quantitative risk values ​​and situational scores, providing security operations personnel with precise handling basis based on business priorities.

[0033] 3. This invention starts with the current state of a high-risk attack scenario, constructs a potential attack graph by combining network topology and vulnerability information, and prioritizes the searched feasible paths based on path risk values. This technical solution achieves a leap from post-attack analysis to pre-attack warning, enabling the prediction of the attacker's next action and high-risk paths before the attack reaches core assets. This assists the defense system in deploying blocking strategies at critical nodes in advance, thereby improving the proactive defense capabilities of network security. Attached Figure Description

[0034] Figure 1 This is an architecture diagram of the network security situation quantitative assessment and prediction system based on attack chain context awareness according to the present invention.

[0035] Figure 2This is a flowchart of the network security situation quantitative assessment and prediction method based on attack chain context awareness of the present invention. Detailed Implementation

[0036] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] See attached document Figure 1 This invention provides a cybersecurity situational awareness quantitative assessment and prediction system based on attack chain context. This system can be deployed in security operations centers, cloud server clusters, or local data center servers for the full lifecycle monitoring, assessment, and prediction of security threats in the network environment. The system includes a data acquisition and processing module, an attack chain context association engine, a dynamic situational awareness quantitative assessment model, and an attack path prediction and priority ranking engine.

[0038] The data acquisition and processing module serves as the system's data input, communicating with various heterogeneous data sources within the network, including but not limited to endpoint detection and response devices, network detection and response devices, firewalls, intrusion detection systems, security information and event management systems, asset management systems, and vulnerability scanners. This module is equipped with a log connector and a multi-protocol parser to collect raw logs and alarm data, and to clean and normalize the heterogeneous data, unifying field formats. The module also features an enrichment component to add asset-critical tags and network area tags to the normalized data based on information from the asset management system, and then sends the processed, standardized event data to the attack chain context association engine.

[0039] The attack chain context association engine communicates with the data acquisition and processing module to receive standardized event data and construct attack activity context. This engine includes a technology mapping unit, which stores a predefined rule base and machine learning models to map each received security event to a specific technology node or tactical stage within a predefined attack chain framework, generating event data with technology identifiers. The engine also includes a graph construction unit and an event clustering unit. The graph construction unit instantiates events, hosts, users, processes, and files as graph nodes and instantiates interactions between nodes as edges, constructing a dynamic attribute graph. The event clustering unit uses graph clustering algorithms to cluster discrete events based on temporal proximity, process parent-child relationships, network session associations, and user identity identity as association factors, generating attack storylines. Each attack storyline includes an attack activity identifier, a list of involved assets, the observed technology sequence, and the current main tactical stage.

[0040] The dynamic situational awareness quantitative assessment model communicates with the attack chain context association engine to receive generated attack storylines and calculate quantitative risk indicators. This model includes a depth calculation unit, a breadth calculation unit, and a defense effectiveness assessment unit. The depth calculation unit determines the attack progress depth value by matching a preset tactical stage weight table to the current tactical stage reached by the attack storyline. The breadth calculation unit identifies all affected assets involved in the attack storyline and calculates the lateral impact breadth value based on the asset's preset value weight and the severity of the attack techniques detected on that asset. The defense effectiveness assessment unit queries the security defense strategy library to determine whether there are defense measures covering and their detection and blocking capabilities at the technical nodes involved in the current attack storyline, generating a defense measure effectiveness coefficient. Based on the attack progress depth value, lateral impact breadth value, and defense measure effectiveness coefficient, the model generates a dynamic security situation score through a preset weighted calculation logic.

[0041] The attack path prediction and priority ranking engine communicates with the attack chain context association engine and the dynamic situational awareness assessment model to predict future attack trends. This engine includes an attack graph builder, which combines network topology, known vulnerability information, and misconfiguration information to construct a potential attack graph describing state transition relationships within the network. Nodes represent the attacker's privilege status on a specific asset and the techniques used to exploit vulnerabilities or configuration flaws to achieve state transitions. The engine also includes a path search algorithm unit and a risk ranking unit. The path search algorithm unit uses the current end state of the attack storyline as the prediction starting point and high-value critical assets in the network as the prediction targets, traversing the potential attack graph to search for all feasible paths. The risk ranking unit calculates the path risk value for each feasible path. This risk value is positively correlated with the path success rate and the value of the target asset, and negatively correlated with the average defense strength along the path. The engine sorts all feasible paths in descending order based on their path risk values, generating and outputting a list of high-risk attack paths and the next-hop technique prediction results for each path.

[0042] The aforementioned data acquisition and processing module, attack chain context association engine, dynamic situational awareness quantification assessment model, and attack path prediction and priority ranking engine all run on an electronic computing device. This device includes a processor and a memory. The memory stores computer program instructions, and the processor reads and executes these instructions via a bus to realize the logical functions and data processing of the various modules, engines, and models. The system's output is transmitted to a display terminal for presentation via a visualization interface.

[0043] See attached document Figure 2 This invention provides a method for quantitative assessment and prediction of network security situation based on attack chain context awareness. The method mainly includes data collection and mapping steps, attack chain context association steps, dynamic situation quantitative assessment steps, and attack path prediction and priority ranking steps.

[0044] In the data acquisition and mapping step, the system first collects raw logs and alarm data from heterogeneous data sources in the network environment. These heterogeneous data sources include terminal detection and response devices, network detection and response devices, security information and event management systems, firewalls, and intrusion detection systems. The system performs normalization processing on the collected raw data, mapping log fields from different vendors and formats to unified standard fields. Subsequently, the system uses a predefined rule base and machine learning model to map each standardized security event to a specific technical identifier in the MITRE ATT&CK framework. For example, when the system detects a Mimikatz process (a security testing tool for extracting Windows system credentials) on a host, it maps it to technical identifier T1003.001, which corresponds to LSASS (Local Security Authority Subsystem Service) memory dumping technology in operating system credential dumping; when it detects PsExec network connection behavior (a network connection established using the PsExec remote management tool), it maps it to technical identifier T1021.002, which corresponds to SMB or Windows management sharing technology in remote services.

[0045] In the attack chain context association step, the system employs a graph-based association algorithm to cluster discrete events into attack storylines. The system first constructs a dynamic attribute graph, defining events, hosts, users, processes, and files as graph nodes, and the interactions between these entities as edges. Interactions include network connections, process spawning, and login behavior. The system traverses and connects graph nodes based on preset association factors, including temporal proximity, process parent-child relationships, network session associations, and identity similarity (sharing the same source IP, target IP, or user identity). The system applies community detection algorithms and multi-dimensional time-series analysis algorithms to cluster event nodes with association relationships, generating one or more attack storylines. The data structure of each generated attack storyline includes an attack activity identifier, a list of involved assets, observed ATT&CK technology sequences, and the current main tactical phase of the activity.

[0046] In the dynamic situational awareness assessment step, the system performs real-time risk calculations for each generated attack storyline and aggregates them to generate a global situational awareness score. For a single attack storyline... The system calculates the risk value based on three dimensions: the depth of attack progress, the breadth of lateral impact, and the effectiveness of defense measures. .

[0047] First, the system calculates the depth of the attack's progress. The system pre-determines a basic risk weight for each tactical phase in the ATT&CK framework. The basic risk weight increases non-linearly from the reconnaissance phase to the impact phase of the tactical stage. In a specific embodiment, the initial access phase has a weight of 10, the execution phase has a weight of 30, the persistence phase has a weight of 50, the privilege escalation phase has a weight of 70, the defense and evasion phase has a weight of 80, the credential access phase has a weight of 90, the discovery phase has a weight of 40, the lateral movement phase has a weight of 95, the collection phase has a weight of 60, the command and control phase has a weight of 85, and the data penetration phase has a weight of 100. The system identifies all tactical stages that the attack storyline has reached so far and selects the tactical stage with the highest weight. Value as attack progress depth .

[0048] Secondly, the system calculates the breadth of lateral influence. The system identifies the set of affected assets involved in the attack storyline. For each affected asset in the set... The system obtains its preset asset value weight. and the impact coefficient of the attack techniques detected on this asset. Horizontal influence breadth Calculated using the following formula:

[0049] ;

[0050] The summation symbol represents all affected assets involved in the storyline. Accumulate.

[0051] Secondly, the effectiveness of the defense measures should be systematically assessed. The system queries the defense strategy database to determine whether defense measures are deployed on the ATT&CK technology nodes involved in the current attack storyline, and determines the appropriate measures based on the coverage and detection / blocking effectiveness of these measures. The value of . It is a decay factor with a value between 0 and 1. For example, when an attacker uses the PsExec technique, and a micro-segmentation strategy that can effectively block this technique is deployed in the environment, Choose a lower value to reduce the final risk value.

[0052] Finally, the system calculates the risk value of a single storyline using the following formula.

[0053] ;

[0054] The system weights and sums the risk values ​​of all active attack storylines or takes the maximum value, and combines it with a time decay factor to generate a global situational score that reflects the current overall threat level.

[0055] In the attack path prediction and prioritization step, the system predicts future attack paths based on the current attack landscape. The system constructs a potential attack graph by combining network topology, asset vulnerability information, and configuration information. Nodes in the attack graph represent attack states, such as an attacker having user privileges on a specific host; edges in the attack graph represent a state transition achieved by exploiting a specific vulnerability or misconfiguration, corresponding to an ATT&CK technique. The system sets the current end state of the attack storyline output from the attack chain context association step as the prediction starting point and sets key assets in the network environment as prediction targets. These key assets include domain controllers and core database servers.

[0056] The system uses a graph traversal algorithm to search the potential attack graph for all possible paths from the predicted starting point to the predicted target. For each predicted path found, the system calculates its path risk value. Path risk value The calculation formula is as follows:

[0057] ;

[0058] in, This represents the success rate of the path, which is determined based on the difficulty of exploiting vulnerabilities involved in the path and the ease of exploiting configuration defects. Indicates the value of the target asset that the path ultimately leads to; This represents the average defense strength along the path, which is determined based on the average effectiveness of defense measures deployed at nodes and edges along the path.

[0059] The system is based on the calculated path risk value All predicted paths are sorted in descending order, and a list of the top N high-risk attack paths is generated. While outputting the list of high-risk attack paths, the system also identifies the next-hop vulnerability or technique most likely to be exploited by attackers on each path, providing defense suggestions to the display terminal.

[0060] It should be noted that the network security situation quantitative assessment and prediction method based on attack chain context awareness provided in this embodiment of the invention can be implemented as a computer program and run on an electronic device. The electronic device includes at least one processor and a memory for storing the computer program. The processor reads and executes instructions in the memory via a bus connection to implement the steps of data acquisition, attack chain mapping, situation quantitative assessment, and path prediction in the above embodiments. Furthermore, this invention can also be implemented as a computer-readable storage medium storing computer instructions, which, when executed on a computer, cause the computer to perform the above method.

Claims

1. A network security posture quantitative evaluation prediction method based on attack chain context awareness, characterized in that, Includes the following steps: S1. Collect heterogeneous security data in the network environment and perform normalization processing. Use a preset rule base and model to map the normalized security events to the technical identifiers in the preset attack chain framework to obtain standardized event data with technical identifiers. S2. Construct a dynamic attribute graph based on the standardized event data with technical identifiers, instantiate the standardized event data into entity nodes and interaction behavior edges in the dynamic attribute graph, and cluster and associate the entity nodes and interaction behavior edges based on preset association factors to generate an attack storyline describing the attack activities. S3. Receive the attack storyline, calculate the attack progress depth value of the attack storyline on the preset attack chain framework, the lateral impact breadth value of the attack storyline on the affected assets, and the defense measure effectiveness coefficient of the defense measures deployed against the attack technology involved in the attack storyline, and calculate the risk value of the attack storyline based on the attack progress depth value, the lateral impact breadth value and the defense measure effectiveness coefficient. S4. Determine the high-risk attack storyline to be predicted based on the risk value of the attack storyline, or determine the high-risk attack storyline to be predicted based on the network security situation score generated by the risk value of the attack storyline; take the current state of the high-risk attack storyline as the prediction starting point, construct a potential attack graph in combination with network topology and vulnerability information, traverse and search all feasible paths from the prediction starting point to the preset critical assets in the potential attack graph, and prioritize the feasible paths based on the path risk value to generate an evaluation prediction result containing a list of high-risk attack paths.

2. The attack chain context-aware based cyber security posture quantification assessment and prediction method according to claim 1, characterized in that, In step S1, the step of mapping the standardized security events to technical identifiers in the preset attack chain framework includes: Identify process behavior characteristics or network connection characteristics in the standardized security events; The process behavior characteristics or network connection characteristics are matched with the tactics and techniques defined in the preset attack chain framework; Each successfully matched security event is assigned a corresponding technical identifier ID, which indicates the attack technique type defined in the preset attack chain framework.

3. The attack chain context-aware based cyber security posture quantification assessment and prediction method of claim 1, wherein, In step S2, the step of constructing a dynamic attribute graph containing entity nodes and interaction behavior edges includes: The hosts, user accounts, system processes, and files involved in the standardized event data are instantiated as graph nodes in the dynamic attribute graph; The network connection behavior, process derivation behavior, and user login behavior recorded in the standardized event data are instantiated as directed edges connecting the graph nodes; Add timestamp attributes and asset key tags to the graph nodes and the directed edges.

4. The attack chain context-aware based cyber security posture quantification assessment and prediction method of claim 1, wherein, In step S2, the step of clustering and associating the standardized event data in the dynamic attribute graph based on a preset association factor includes: The preset association factors are selected based on time proximity, process parent-child relationship, network session association, and user identity identity. The community detection algorithm is used to identify sets of nodes with connectivity in the dynamic attribute graph; Event sequences belonging to the same set of nodes are aggregated into an attack storyline, which includes an attack activity identifier, a list of affected assets, and an observed sequence of techniques.

5. The attack chain context-aware based cyber security posture quantification assessment and prediction method of claim 1, wherein, In step S3, the step of calculating the attack progression depth value of the attack storyline includes: A basic risk weight is preset for each tactical stage in the pre-defined attack chain framework. The basic risk weight increases non-linearly from the reconnaissance stage to the influence stage. Identify the tactical phase to which all technical identifiers contained in the attack storyline belong; The base risk weight corresponding to the highest weighted tactical stage reached in the attack storyline is selected as the attack progress depth value.

6. The attack chain context-aware based cyber security posture quantification assessment and prediction method of claim 1, wherein, In step S3, the step of calculating the lateral impact breadth value of the attack storyline includes: Identify all affected assets involved in the attack storyline; Obtain the preset asset value weight for each of the affected assets and the impact coefficient of the attack techniques detected on the affected assets; Calculate the product of the preset asset value weight and the influence coefficient for each of the affected assets; The horizontal impact breadth value is obtained by summing the products corresponding to all affected assets.

7. The method for quantitative assessment and prediction of network security situation based on attack chain context awareness according to claim 1, characterized in that, In step S3, the step of calculating the risk value of the attack storyline includes: The defense strategy library is queried to determine the coverage and detection and blocking effectiveness of the defense measures deployed on the technical nodes involved in the attack storyline, and an effectiveness coefficient of the defense measures with a value between zero and one is generated. The difference between the numerical value and the effectiveness coefficient of the defense measures is calculated to obtain the defense failure coefficient; The attack progress depth value, the lateral impact breadth value, and the defense failure coefficient are calculated together. The product is used as the risk value of the attack storyline, and the network security situation score is generated based on the risk values ​​of all active attack storylines.

8. The method for quantitative assessment and prediction of network security situation based on attack chain context awareness according to claim 1, characterized in that, In step S4, the step of constructing the potential attack graph includes: The state of the permissions an attacker has on network assets is defined as a state node in the potential attack graph; Based on the vulnerability information, known vulnerabilities and configuration defects in the network environment are identified, and the technical methods of using the known vulnerabilities or configuration defects to achieve state transitions are defined as the transition edges of the potential attack graph. Based on the current network topology and the known vulnerabilities and configuration defects, a directed graph is generated describing all possible transfer paths from the initial access state to the core asset control state.

9. The method for quantitative assessment and prediction of network security situation based on attack chain context awareness according to claim 1, characterized in that, In step S4, before prioritizing the feasible paths based on their path risk values, the method further includes calculating the path risk value for each feasible path. The calculation process includes: Determine the success rate of the feasible path, which is based on the difficulty of exploiting the vulnerabilities involved in the path; Determine the value of the target asset ultimately accessible by the feasible path; Determine the average defense strength of the feasible path, which is based on the average effectiveness of the defense measures deployed at nodes along the path; The product of the success rate of the path and the value of the target asset is used as the numerator, and the average defense strength of the path is used as the denominator. The calculated ratio is used as the risk value of the path.

10. The method for quantitative assessment and prediction of network security situation based on attack chain context awareness according to claim 1, characterized in that, In step S4, the step of prioritizing the feasible paths based on path risk values ​​includes: All feasible paths found are arranged in descending order of their path risk values. The list of high-risk attack paths is generated by extracting a predetermined number of the top-ranked paths. For each path in the list of high-risk attack paths, identify and output the next-hop technique or vulnerability that the attacker is most likely to use after the current state, and associate the network security situation score with the list of high-risk attack paths and output it to the display terminal.

Images