An active attack simulation and risk alerting method, system, device, and medium

Abstract

The application relates to the technical field of cyberspace security, and provides a method, system, device and medium for active attack simulation and risk early warning, which comprises the following steps: collecting multi-source threat intelligence; extracting a threat intelligence feature vector from the multi-source threat intelligence; screening threat intelligence highly related to a target organization based on the threat intelligence feature vector, inputting the screened threat intelligence into a time series prediction model, and predicting the outbreak probability of attack technology TTP in a future time window; generating an attack script and executing the attack script based on the attack technology TTP whose outbreak probability exceeds a warning threshold; performing risk early warning according to the execution of the attack script, and feeding back to the time series prediction model for adaptive optimization. The application realizes the automation of a closed loop covering multiple links of "intelligence perception-risk modeling-trend prediction-attack simulation-warning feedback", can enable an organization to carry out targeted verification and risk early warning before an attack occurs, and realizes a future-oriented active security operation mode.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, and more specifically, to a method, system, device, and medium for proactive attack simulation and risk warning. Background Technology

[0002] As digitalization deepens, the cyber threats faced by organizations exhibit significant trends such as more complex attack chains, more professional attack organizations, and increased uncertainty in attack timing. In recent years, many enterprises have gradually introduced methods such as attack and defense drills, Breach and Attack Simulation (BAS), red team testing, and MITRE ATT&CK alignment testing to identify weaknesses in their defense systems. However, current security verification methods still generally have the following shortcomings: (1) Security verification models are generally lagging behind. Organizations often use periodic or event-triggered inspection methods (such as quarterly red teams and annual penetration tests), resulting in a misalignment between the verification window and the threat outbreak window. When a new type of vulnerability or a new type of attack TTP (Technology, Tactics, Procedures) suddenly becomes active on the dark web, organizations are usually exposed to high risks without adjusting their defense strategies.

[0003] (2) Lack of targeted attack simulation. While existing intrusion and attack simulation tools have achieved automation, their test cases are usually based on a static "attack library" and executed randomly or comprehensively. This "blanket" testing fails to take into account the target organization's current specific threat environment (such as industry characteristics and geopolitical risks). Many systems still execute the same set of attack scripts, resulting in a waste of testing resources and an inability to simulate the latest targeted attacks that have not yet spread on a large scale.

[0004] (3) Attack simulations lack the ability to predict temporal evolution. Existing BAS systems generally simulate attacks based on known attack vectors, lacking the ability to predict the evolution trend of attack techniques that may emerge in the next 3-6 months. For example, a certain type of vulnerability or exploitation technique may erupt in the next two weeks due to geopolitical conflicts, but static models cannot perceive this dynamic trend.

[0005] (4) Lack of an intelligent "risk-driven attack simulation" mechanism. An ideal defense system should be able to: ① automatically detect rising risk trends from global multi-source intelligence; ② predict future attack possibilities; ③ generate customized attack simulation suggestions; ④ guide the security team to prioritize the verification of high-risk attack paths.

[0006] In summary, existing technologies cannot achieve a closed-loop proactive security model of "prediction → triggering simulation → verification → adjusting strategy". Therefore, there is an urgent need for a new intelligent, automated, forward-looking, and adaptive proactive defense technology that enables organizations to conduct targeted verification and risk warnings before an attack occurs, significantly improving overall defense maturity. Summary of the Invention

[0007] The present invention aims to provide a method, system, device and medium for proactive attack simulation and risk warning, so that organizations can conduct targeted verification and risk warning before an attack occurs.

[0008] In a first aspect, the present invention provides a method for active attack simulation and risk warning, comprising: Collect multi-source threat intelligence; Extract threat intelligence feature vectors from multi-source threat intelligence; Based on threat intelligence feature vectors, threat intelligence highly relevant to the target organization is filtered out, and the filtered threat intelligence is input into a time series prediction model to predict the probability of TTP (Tactics to Techniques) outbreak in the future time window. Based on the attack technique TTP, which uses an attack probability exceeding the warning threshold, an attack script is generated and executed. Risk warnings are issued based on the execution of attack scripts, and the time-series prediction model is adaptively optimized.

[0009] In a preferred embodiment, the extraction of threat intelligence feature vectors from multi-source threat intelligence includes: Preprocessing of multi-source threat intelligence; Convert the pre-processed multi-source threat intelligence into a standardized format; Using a natural language processing model, entities are extracted from multi-source threat intelligence in a standard format, and a threat knowledge graph library is constructed based on graph theory methods. The threat knowledge graph library includes entities and the relationships between entities. Threat intelligence feature vectors are extracted using a threat knowledge graph database.

[0010] In a preferred embodiment, the step of filtering threat intelligence highly relevant to the target organization based on threat intelligence feature vectors includes: Generate an organizational fingerprint vector based on the target organization's industry attributes, geographical location, technology stack, and core asset value; The cosine similarity between the threat intelligence feature vector and the organization fingerprint vector is calculated, and combined with the credibility score of the threat intelligence itself, threat intelligence that is highly relevant to the target organization is selected.

[0011] In a preferred embodiment, inputting the filtered threat intelligence into a time-series prediction model to predict the probability of an attack technique (TTP) occurring within a future time window includes: Using the attack techniques (TTPs) and attack path subgraph structures in the threat knowledge graph, a time series matrix is ​​constructed. The feature vectors in this time series matrix include network-wide frequency, code publication status, forum popularity, and activity cycle. The attack path subgraph structure is constructed from the relationships between entities in the threat knowledge graph. The time series matrix is ​​input into the time series prediction model to predict the probability of an attack technique emerging within a future time window; the time series prediction model is based on a machine learning model with an attention mechanism.

[0012] In a preferred embodiment, the attack script generation and execution based on the attack technique TTP (Terror Technique for Attacks Based on Outbreak Probability Exceeding Warning Threshold) includes: Based on the correlation between attack techniques (TTPs) in the threat knowledge graph database, and combined with the attack graph algorithm, attack techniques (TTPs) with an outbreak probability exceeding the warning threshold are automatically arranged into a complete attack chain. Read the organization's environment configuration, parameterize and modify each attack technique TTP in the attack chain, and generate an executable, customized attack script. The attack script is scheduled and executed in an isolated or production environment using the BAS simulation execution engine to simulate real attack behavior.

[0013] In a preferred embodiment, the risk warning refers to generating a warning report in natural language format based on the execution status of the attack script, displaying the predicted attack trend, the probability of outbreak, and suggested defense measures, and pushing it to the security management platform.

[0014] The adaptive optimization of the time series prediction model includes: After the attack script is executed, the attack script execution results are collected, including whether the attack successfully penetrates the defense system and whether the attack is successfully intercepted by the security defense device. The attack script execution results are then converted into attack script execution result feedback signals. The weight coefficients in the generated organizational fingerprint vector are adjusted based on the feedback signal of the attack script execution results. Specifically: if the attack successfully penetrates the defense system, the weight of the technology stack related to the attack technique is increased; if the attack is successfully intercepted by the security system, the weight of the technology stack related to the attack technique is decreased. The burst probability output by the time-series prediction model is corrected based on the feedback signal from the execution result of the attack script.

[0015] Secondly, the present invention provides an active attack simulation and risk warning system, comprising: The data acquisition layer is used to collect threat intelligence from multiple sources; The data processing layer is used to extract threat intelligence feature vectors from multi-source threat intelligence. The core analysis engine layer is used to filter threat intelligence that is highly relevant to the target organization based on threat intelligence feature vectors, and input the filtered threat intelligence into the time series prediction model to predict the probability of the outbreak of attack techniques (TTPs) within the future time window. The decision execution layer is used to generate and execute attack scripts based on attack techniques TTPs (Targeted Techniques) where the probability of an attack exceeds the warning threshold. The interactive feedback layer is used to provide risk warnings based on the execution status of attack scripts and to adaptively optimize the time-series prediction model.

[0016] Thirdly, the present invention provides an electronic device, comprising: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the instructions stored in the memory to perform the above-described method.

[0017] Fourthly, the present invention provides a computer-readable storage medium for storing instructions that, when executed, cause the above-described method to be implemented.

[0018] In summary, this invention achieves an automated closed loop covering multiple stages, including "intelligence perception, risk modeling, trend prediction, attack simulation, and early warning feedback." This enables organizations to conduct targeted verification and risk warnings before an attack occurs, realizing a proactive security operation model for the future. Specific beneficial effects include: 1. Upgrading from reactive verification to predictive defense: This invention breaks through the limitation of traditional security verification, which can only verify known or already occurring threats. Through time-series prediction models, it can predict the outbreak trend of specific attack techniques (TTPs) in advance, enabling organizations to take advantage of the attacker's time difference to deploy defense strategies in advance and achieve proactive preparedness.

[0019] 2. Significantly Improved Resource Allocation Efficiency: Traditional BAS or penetration testing often blindly covers all test cases. This invention, through dual filtering of organizational fingerprints and intelligence relevance, combined with predicted probabilities, accurately selects the highest priority threats for simulation. This allows limited security budgets and human resources to be focused on the risks with the highest probability of occurrence.

[0020] 3. Strong dynamic adaptability: The organizational fingerprint is dynamically updated. When the local geopolitical environment changes or the enterprise's technology stack changes (such as the launch of a new SaaS service), the weight of the intelligence can be automatically adjusted to ensure that the simulated attack scenario is always highly consistent with the current business environment.

[0021] 4. Reduce false positive rate and operational burden: By introducing an attention mechanism and multi-dimensional feature fusion, the time-series prediction model can effectively distinguish between network noise and targeted threats, reducing the fatigue of security teams caused by handling irrelevant intelligence, and the verification suggestions provided have extremely high practical value. Attached Figure Description

[0022] Figure 1 A flowchart of an active attack simulation and risk warning method provided in an embodiment of the present invention.

[0023] Figure 2 This is a flowchart illustrating the process of filtering threat intelligence in an embodiment of the present invention.

[0024] Figure 3 This is a flowchart illustrating the processing of the time-series prediction model in an embodiment of the present invention.

[0025] Figure 4 This is a flowchart illustrating the active attack simulation in an embodiment of the present invention.

[0026] Figure 5 This is a schematic diagram of the structure of an active attack simulation and risk warning system provided in an embodiment of the present invention.

[0027] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0029] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0030] like Figure 1 As shown, based on the overall design concept of layered decoupling, data-driven, prediction-triggered, and verification closed loop, this embodiment of the invention provides an active attack simulation and risk warning method, including five stages: data collection, data processing, core analysis, decision execution, and interactive feedback, thereby achieving an automated closed loop covering multiple stages such as "intelligence perception, risk modeling, trend prediction, attack simulation, and early warning feedback".

[0031] The following details the specific implementation of this proactive attack simulation and risk warning method.

[0032] S100 collects threat intelligence from multiple sources.

[0033] The multi-source threat intelligence covers a global scope, providing a data foundation for upper-level analysis. This includes gathering threat intelligence from public vulnerability databases, dark web marketplaces, social media, APT activity reports, and geopolitical data. Specifically: Obtain the latest CVE vulnerability details and PoC code information from authoritative public vulnerability databases (such as NVD, CNNVD, Exploit-DB, etc.); Monitor dark web marketplaces and hacker forums to gather intelligence on dark web transactions involving malware sales, exploit tool trading, and specific attack services. Scrape security updates from social media (such as Twitter / X), tech blogs, and code hosting platforms (GitHub); Access security vendors' APT (Advanced Persistent Threat) activity reports and geopolitical risk data to detect signs of organized attack activities.

[0034] Collect honeypot trapping data deployed in wide area networks or industry private networks to detect real-time attack traffic.

[0035] S200 extracts threat intelligence feature vectors from multi-source threat intelligence.

[0036] S201 preprocesses multi-source threat intelligence, including removing duplicate, invalid, and / or obviously false intelligence data from multi-source threat intelligence and reducing data noise.

[0037] S202, based on threat intelligence standards (such as STIX 2.1), uniformly converts pre-processed multi-source threat intelligence into a standard format to ensure compatibility between intelligence from different sources. An example of a JSON-formatted storage structure is as follows: { "type": "attack-pattern", "id": "attack-pattern--T1059.001", "name": "PowerShell", "external_references": [{"source_name": "mitre-attack", "external_id": "T1059.001"}], "x_trending_score": 0.85 / / Dynamic attribute } S203 utilizes natural language processing models (such as BERT-NER) to extract entities from multi-source threat intelligence in a standard format. These entities include intrusion sets, malware, attack patterns, and / or victim industries. A threat knowledge graph is constructed based on graph theory, denoted as G=(V,E), where V is the set of nodes containing the extracted entities, and E is the set of edges defining the relationships between entities, such as (APT28)—[USES]→(Mimikatz), (Log4j)—[AFFECTS]→(JavaApplication). Simultaneously, based on the relationships between entities, an attack path subgraph structure centered on attack techniques (TTPs) is constructed to describe the dependencies between different attack techniques (TTPs) and possible attack evolution paths, providing a basis for subsequent attack path simulations.

[0038] S204, extract threat intelligence feature vectors using a threat knowledge graph database; the threat intelligence feature vectors include network frequency (the frequency of TTPs appearing in network threat intelligence), code public status (the public status of exploit code for related CVE vulnerabilities), forum popularity (the discussion popularity of TTPs in dark web forums or underground markets), and activity cycle (the activity cycle of related APT organizations).

[0039] S300, based on threat intelligence feature vectors, filters threat intelligence that is highly relevant to the target organization and inputs the filtered threat intelligence into a time-series prediction model to predict the probability of TTP (Tactics to Techniques) outbreaks within future time windows.

[0040] S310, based on threat intelligence feature vectors, filters threat intelligence (spatial dimension) highly relevant to the target organization. To address the issues of intelligence "overload" and "irrelevance," this embodiment of the invention introduces a matching algorithm between organizational fingerprint vectors and threat intelligence feature vectors. For example... Figure 2 As shown, specifically: S311 first generates an organizational fingerprint vector based on the target organization's industry attributes, geographical location, technology stack (such as OS, middleware, cloud services), and core asset value, represented as:

[0041] in: I Code the industry attribute (e.g., finance, energy); G Geographic location encoding;S For technology stack characteristics (such as using Kubernetes, Java, AWS); A For core asset value; w i The weighting coefficient for industry attributes. w g The weighting coefficient for geographical location, w s This refers to the weighting coefficients of the technology stack. w a The weighting coefficient for the core asset value.

[0042] S312 calculates the cosine similarity between the threat intelligence feature vector and the organization fingerprint vector, and combines it with the credibility score of the threat intelligence itself to filter out threat intelligence that is highly relevant to the target organization.

[0043] For each piece of threat intelligence Calculate its matching degree with the target organization, expressed as:

[0044] in, For threat intelligence Matching degree with the target organization From threat intelligence Extracted threat intelligence feature vectors, Threat intelligence Its own credibility rating It's an adjustable parameter. Only Only threat intelligence that is relevant will be fed into the time-series prediction model. This is a preset threshold.

[0045] S320 inputs the filtered threat intelligence into a time-series prediction model to predict the probability of an attack technique (TTP) occurring within a future time window (time dimension). For example... Figure 3 As shown, specifically: S321, Using the attack technique TTP and attack path subgraph structure in the threat knowledge graph database, construct a time series matrix:

[0046] in, This indicates that the attack technique TTP in threat intelligence is in the first place. t Each feature vector represents a feature vector at a given time. It is composed of multiple features from different data sources, as detailed below:

[0047] in, This section describes the frequency of TTP (Threat Technique) attacks across the entire network in threat intelligence. The public status characteristics of the exploit code for the relevant CVE vulnerability (whether there is publicly available exploit code). This refers to the popularity of discussions related to the TTP attack technique on dark web forums or underground markets. This represents the periodic activity characteristics of relevant APT organizations. The data from different intelligence sources are combined after normalization to form a unified feature vector, thereby achieving feature fusion of multi-source threat intelligence.

[0048] S322, The time series matrix is ​​input into the time series prediction model to predict the probability of an attack technique's occurrence within a future time window; the time series prediction model is a machine learning model based on an attention mechanism. In this embodiment of the invention, the time series prediction model uses a Bi-LSTM (Bidirectional Long Short-Term Memory) network combined with an attention mechanism. It not only learns historical attack patterns but also captures the impact of sudden events (such as geopolitical conflicts) through the attention mechanism, predicting the probability of the attack technique's TTP occurring within a future time window (such as the next 3-6 months). The processing procedure of this time series prediction model is as follows: Forgotten Gate:

[0049] Input Gate:

[0050] Candidate cell status:

[0051] Current cell state:

[0052] Output gate:

[0053] Hidden state:

[0054] Bidirectional LSTM concatenates the forward and reverse hidden states:

[0055] In the attention layer, to identify key time points in the time series that have a significant impact on the attack trend, an attention mechanism is introduced to calculate weights:

[0056]

[0057]

[0058] The aforementioned context vector is then input into the fully connected layer for feature mapping.

[0059] Ultimately, the attack technique output through the Softmax layer will be used within a future time window. Probability of an internal outbreak:

[0060] In the above description, This represents the feature vector at time t. For LSTM hidden states, This is the forward hidden state of the LSTM. This is the reverse hidden state of the LSTM. This is the state of the LSTM cell. Output for the forget gate. For input gate output, For output gate output, These are the weight matrices, These are the bias terms, It is the Sigmoid activation function. It is the hyperbolic tangent function. This is the output vector of the bidirectional LSTM. For attention weights, For attention-weighted context vectors, For the weights and biases of the fully connected layer, This represents the predicted attack probability distribution.

[0061] S400, based on the attack technique TTP (Terrorism Response Technique) where the probability of an attack exceeds a warning threshold, generates and executes attack scripts; such as... Figure 4 As shown, specifically: S401, based on the relationships between attack techniques (TTPs) in the threat knowledge graph database, and combined with the attack graph algorithm, attack techniques TTPs with an outbreak probability exceeding the warning threshold are automatically orchestrated into complete attack chains. Specifically, the paths of attack techniques TTPs with an outbreak probability exceeding the warning threshold are expanded to generate complete attack paths including initial intrusion, privilege escalation, lateral movement, and persistence stages, and these attack paths are transformed into executable attack simulation processes. Typically, the IDs of attack techniques TTPs with an outbreak probability exceeding the warning threshold are obtained, which can then be mapped to specific attack payload libraries (such as Atomic Red Team test cases) to retrieve the attack technique TTPs.

[0062] S402 reads the organization's environment configuration and modifies the parameters of each attack technique TTP in the attack chain (e.g., replacing them with internal target machine IPs and test accounts) to generate an executable, customized attack script.

[0063] S403, through the BAS simulation execution engine, schedules and executes the attack script in an isolated environment or a production environment (with a security circuit breaker mechanism) to simulate real attack behavior.

[0064] The pseudocode example of the above process is as follows: class PredictiveAttackEngine: def __init__(self, org_profile, threat_intel_feed): self.org_profile = org_profile self.model = load_trained_lstm_model() self.attack_library = load_mitre_attack_library() def forecast_risks(self, time_window_days=90): """ Predict the Top N High-Risk TTPs within a future time window """ high_risk_ttps = [] current_context = self.get_context_vector() for ttp_id in self.attack_library.get_all_ids(): # Retrieve historical time series data for this TTP history_data = self.get_history(ttp_id) # Using a time-series forecasting model to predict future activity probability prob = self.model.predict(history_data, context=current_context) # Weighted by organizational relevance relevance = self.calculate_relevance(ttp_id, self.org_profile) final_score = prob relevance if final_score > THRESHOLD_CRITICAL: high_risk_ttps.append({ 'id': ttp_id, 'prob': prob, 'predicted_date': self.estimate_peak_date(history_data) }) return sorted(high_risk_ttps, key=lambda x: x['prob'], reverse=True) def generate_simulation_plan(self, risk_ttps): """ Generate an attack scenario based on the prediction results """ simulation_plan = [] for threat in risk_ttps: # Obtain atomic test capabilities payloads = self.attack_library.get_payloads(threat['id']) # Adapt to environmental parameters customized_payloads = self.adapt_payload_to_env(payloads, self.org_profile) simulation_plan.append({ 'name': f"Proactive Check for {threat['id']}", 'reason': f"Predicted surge in 3 months (Prob: {threat['prob']:.2f})", 'actions': customized_payloads, 'rollback_procedures': self.get_rollback(threat['id']) }) return simulation_plan # Main execution flow engine = PredictiveAttackEngine(my_company_profile, intel_feed) risks = engine.forecast_risks(time_window_days=90) if risks: plan = engine.generate_simulation_plan(risks) # Push to security management platform alert_security_team(plan) The S500 provides risk warnings based on the execution of attack scripts and adaptively optimizes the time-series prediction model to form a closed loop.

[0065] The aforementioned risk warning refers to generating a warning report in natural language format based on the execution status of the attack script, displaying the predicted attack trends, outbreak probability, and suggested defense measures, and pushing it to the security management platform. For example: "Based on dark web intelligence analysis and historical data, it is predicted that the probability of attacks targeting cloud service container escape (T1611) targeting the financial industry will increase by 70% within the next 90 days. It is recommended to immediately execute a simulated attack." The adaptive optimization of the time series prediction model includes: After the attack script is executed, the attack script execution results are collected, including whether the attack successfully penetrates the defense system and whether the attack is successfully intercepted by the security defense device. The attack script execution results are converted into an attack script execution result feedback signal R, where R=1 indicates successful penetration and R=-1 indicates successful interception.

[0066] The weight coefficients in the generated organizational fingerprint vector are adjusted based on the feedback signal from the attack script execution result. The organizational fingerprint vector defined in this embodiment of the invention is as follows:

[0067] The corresponding weight vector is:

[0068] If the attack successfully breaches the defense system, the weight of the technology stack related to the attack technique is increased, as shown below:

[0069] If the attack is successfully intercepted by the security system, the weight of the technology stack associated with that attack technique is reduced, as shown below:

[0070] in, α As the risk amplification coefficient, β This is the risk attenuation coefficient.

[0071] These adjustments make the organization's fingerprint vector more focused on attack techniques that have successfully breached defenses in the past.

[0072] The burst probability output by the time-series prediction model is corrected based on the feedback signal from the attack script execution results. Example: Let the burst probability output by the time series prediction model be...

[0073] The burst probability, after correcting the burst probability output by the time-series prediction model based on the feedback signal of the attack script execution result, is expressed as:

[0074] in, To predict probabilities for the model, Corrected probability, This is the feedback coefficient.

[0075] This correction mechanism increases the priority of attack techniques that have successfully breached defenses in the next round of risk warnings.

[0076] Through the aforementioned feedback mechanism, the execution result of the attack script is used as a feedback signal to dynamically adjust the weight coefficients in the generated organizational fingerprint vector and the outbreak probability output by the time-series prediction model, thereby forming a closed-loop security verification mechanism of "threat prediction - attack simulation - result feedback - model correction" to achieve continuous adaptive optimization of the attack trend prediction model.

[0077] Based on the same technological concept, such as Figure 5 As shown, embodiments of the present invention also provide an active attack simulation and risk warning system, comprising: The data acquisition layer is used to collect threat intelligence from multiple sources; The data processing layer is used to extract threat intelligence feature vectors from multi-source threat intelligence. The core analysis engine layer is used to filter threat intelligence that is highly relevant to the target organization based on threat intelligence feature vectors, and input the filtered threat intelligence into the time series prediction model to predict the probability of the outbreak of attack techniques (TTPs) within the future time window. The decision execution layer is used to generate and execute attack scripts based on attack techniques TTPs (Targeted Techniques) where the probability of an attack exceeds the warning threshold. The interactive feedback layer is used to issue risk warnings based on the execution of attack scripts and to feed back to the time-series prediction model for adaptive optimization.

[0078] The aforementioned data acquisition layer, data processing layer, core analysis engine layer, decision execution layer, and interactive feedback layer are structured from bottom to top, with each layer interacting through standardized data interfaces. The working principles of each layer can be found in the descriptions in the preceding method embodiments, and will not be repeated here.

[0079] Based on the same technical concept, embodiments of the present invention also provide an electronic device that can implement the active attack simulation and risk warning method flow provided in the above embodiments of the present invention. In one embodiment, the electronic device can be a server, a terminal device, or other electronic devices. Figure 6 As shown, the electronic device may include: At least one processor and a memory connected to the at least one processor. In this embodiment of the invention, the specific connection medium between the processor and the memory is not limited. Figure 6 The example used is the connection between the processor and memory via a bus. The bus... Figure 6 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. Buses can be divided into address buses, data buses, control buses, etc., but for ease of representation, [the specific bus type is not shown here]. Figure 6 The processor is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, a processor can also be called a controller; there are no restrictions on the name.

[0080] In this embodiment of the invention, the memory stores instructions that can be executed by at least one processor. By executing the instructions stored in the memory, at least one processor can execute the proactive attack simulation and risk warning method described above.

[0081] The processor is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory and calling data stored in memory, it can monitor the device's various functions and process data, thereby enabling overall monitoring of the device.

[0082] In an alternative design, the processor may include one or more processing units. The processor may integrate an application processor and a modem processor, wherein the application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may also not be integrated into the processor. In some embodiments, the processor and memory may be implemented on the same chip; in some embodiments, they may also be implemented separately on separate chips.

[0083] The processor can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the proactive attack simulation and risk warning method disclosed in the embodiments of this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0084] Memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory can include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures, and accessible by a computer, but is not limited thereto. In embodiments of the present invention, memory can also be a circuit or any other device capable of implementing storage functions, used to store program instructions and / or data.

[0085] By designing and programming the processor, the code corresponding to the active attack simulation and risk warning method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute the steps of the method described in the foregoing embodiments during runtime. How to design and program the processor is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0086] Based on the same inventive concept, embodiments of the present invention also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform an active attack simulation and risk warning method as described above.

[0087] In some alternative embodiments, the present invention also provides that various aspects of the proactive attack simulation and risk warning method can also be implemented in the form of a program product, which includes program code. When the program product is run on a device, the program code is used to cause the control device to perform the steps in the proactive attack simulation and risk warning method according to various exemplary embodiments of the present invention described above.

[0088] It should be noted that although several units or sub-units of the apparatus have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units. Furthermore, although the operation of the method of the invention is described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0089] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0090] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0091] Program code for performing the operations of this invention can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0092] In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0093] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0094] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0095] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for proactive attack simulation and risk warning, characterized in that, include: Collect multi-source threat intelligence; Extract threat intelligence feature vectors from multi-source threat intelligence; Based on threat intelligence feature vectors, threat intelligence highly relevant to the target organization is filtered out, and the filtered threat intelligence is input into a time series prediction model to predict the probability of TTP (Tactics to Techniques) outbreak in the future time window. Based on the attack technique TTP, which uses an attack probability exceeding the warning threshold, an attack script is generated and executed. Risk warnings are issued based on the execution of attack scripts, and the time-series prediction model is adaptively optimized.

2. The active attack simulation and risk warning method according to claim 1, characterized in that, The extraction of threat intelligence feature vectors from multi-source threat intelligence includes: Preprocessing of multi-source threat intelligence; Convert the pre-processed multi-source threat intelligence into a standardized format; Using a natural language processing model, entities are extracted from multi-source threat intelligence in a standard format, and a threat knowledge graph library is constructed based on graph theory methods. The threat knowledge graph library includes entities and the relationships between entities. Threat intelligence feature vectors are extracted using a threat knowledge graph database.

3. The active attack simulation and risk warning method according to claim 2, characterized in that, The filtering of threat intelligence highly relevant to the target organization based on threat intelligence feature vectors includes: Generate an organizational fingerprint vector based on the target organization's industry attributes, geographical location, technology stack, and core asset value; The cosine similarity between the threat intelligence feature vector and the organization fingerprint vector is calculated, and combined with the credibility score of the threat intelligence itself, threat intelligence that is highly relevant to the target organization is selected.

4. The active attack simulation and risk warning method according to claim 2, characterized in that, The process of inputting the filtered threat intelligence into a time-series prediction model to predict the probability of an attack technique (TTP) emerging within a future time window includes: Using the attack techniques (TTPs) and attack path subgraph structures in the threat knowledge graph, a time series matrix is ​​constructed. The feature vectors in this time series matrix include network-wide frequency, code publication status, forum popularity, and activity cycle. The attack path subgraph structure is constructed from the relationships between entities in the threat knowledge graph. The time series matrix is ​​input into the time series prediction model to predict the probability of an attack technique emerging within a future time window; the time series prediction model is based on a machine learning model with an attention mechanism.

5. The active attack simulation and risk warning method according to claim 2, characterized in that, The attack technique TTP based on the outbreak probability exceeding the warning threshold generates an attack script and executes it, including: Based on the correlation between attack techniques (TTPs) in the threat knowledge graph database, and combined with the attack graph algorithm, attack techniques (TTPs) with an outbreak probability exceeding the warning threshold are automatically arranged into a complete attack chain. Read the organization's environment configuration, parameterize and modify each attack technique TTP in the attack chain, and generate an executable, customized attack script. The attack script is scheduled and executed in an isolated or production environment using the BAS simulation execution engine to simulate real attack behavior.

6. The active attack simulation and risk warning method according to claim 1, characterized in that, The aforementioned risk warning refers to generating a warning report in natural language format based on the execution status of the attack script, displaying the predicted attack trends, outbreak probability, and suggested defense measures, and pushing it to the security management platform.

7. The active attack simulation and risk warning method according to claim 1, characterized in that, The adaptive optimization of the time series prediction model includes: After the attack script is executed, the attack script execution results are collected, including whether the attack successfully penetrates the defense system and whether the attack is successfully intercepted by the security defense device. The attack script execution results are then converted into attack script execution result feedback signals. The weight coefficients in the generated organizational fingerprint vector are adjusted based on the feedback signal of the attack script execution results. Specifically: if the attack successfully penetrates the defense system, the weight of the technology stack related to the attack technique is increased; if the attack is successfully intercepted by the security system, the weight of the technology stack related to the attack technique is decreased. The burst probability output by the time-series prediction model is corrected based on the feedback signal from the execution result of the attack script.

8. A proactive attack simulation and risk warning system, characterized in that, include: The data acquisition layer is used to collect threat intelligence from multiple sources; The data processing layer is used to extract threat intelligence feature vectors from multi-source threat intelligence. The core analysis engine layer is used to filter threat intelligence that is highly relevant to the target organization based on threat intelligence feature vectors, and input the filtered threat intelligence into the time series prediction model to predict the probability of the outbreak of attack techniques (TTPs) within the future time window. The decision execution layer is used to generate and execute attack scripts based on attack techniques TTPs (Targeted Techniques) where the probability of an attack exceeds the warning threshold. The interactive feedback layer is used to provide risk warnings based on the execution status of attack scripts and to adaptively optimize the time-series prediction model.

9. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed, cause the method as described in any one of claims 1-7 to be implemented.

Images