An attack chain analysis and defense strategy generation method, system, device and medium

Abstract

The application relates to the technical field of network security and intelligent attack and defense analysis, and provides an attack chain analysis and defense strategy generation method, system, device and medium. The method comprises the following steps: collecting attack and defense event data to form an event set; mapping each event in the event set to a TTP to form a characteristic event; constructing an attack chain time sequence causal diagram based on the characteristic event; performing causal intervention calculation based on the constructed attack chain time sequence causal diagram to quantize defense effectiveness; iteratively generating a defense strategy based on the defense effectiveness and through reinforcement learning; and updating the attack chain time sequence causal diagram by verifying the generated defense strategy. The application eliminates pseudo-correlation by constructing an attack chain time sequence causal diagram, performs lossless defense efficiency evaluation, and finds a globally optimal defense strategy through reinforcement learning, thereby solving the problems of how to mine attack causal chains from complex security events, quantitatively evaluate defense measures, and intelligently generate optimized strategies.

Description

Technical Field

[0001] This invention relates to the field of network security and intelligent attack and defense analysis technology, and more specifically, to an attack chain analysis and defense strategy generation method, system, device and medium. Background Technology

[0002] With the rapid development of network information technology, network attacks have become increasingly diversified, covert, and persistent. Advanced Persistent Threat (APT) attacks, in particular, are characterized by strong organization, long attack cycles, clear targets, and flexible strategies. Attackers typically employ a phased, multi-path "attack chain" strategy, using continuous actions such as initial penetration, privilege escalation, lateral movement, and persistent presence to ultimately intrude into the target.

[0003] Deficiencies of existing technology: (1) Alarms lack causal explanation. Traditional Intrusion Detection Systems (IDS) or Security Information and Event Management (SIEM) systems are mostly based on rule matching or statistical correlation. They can alert what happened, but cannot explain precisely why it happened or the contribution of preceding events to the success of subsequent attacks through mathematical models. Defense strategies generated solely based on correlation are prone to false alarms or false negatives.

[0004] (2) Defense strategies are difficult to quantify and verify. Existing Breach and Attack Simulation (BAS) systems typically only output binary results of "success / failure". Defenders find it difficult to quantify and evaluate the specific effectiveness of a measure (such as blocking IPs or modifying ACLs) in blocking the entire attack chain (such as reducing the attack success rate by a certain percentage) before implementing the strategy.

[0005] (3) Lacking dynamic closed-loop optimization, the defense strategy is often statically configured, making it difficult to dynamically adjust and make optimal trade-offs based on real-time changes in attack methods and business environment (cost, business impact).

[0006] Therefore, there is an urgent need for a method that can uncover the deep causal logic of attack events, perform counterfactual reasoning without interfering with the production environment, and ultimately automatically generate a defense strategy with optimal overall benefits. Summary of the Invention

[0007] To address the aforementioned problems, this invention provides an attack chain analysis and defense strategy generation method, system, device, and medium. It eliminates spurious correlations by constructing a temporal causal graph of the attack chain, performs a lossless defense effectiveness evaluation, and utilizes reinforcement learning to find the globally optimal defense strategy under multiple constraints.

[0008] In a first aspect, the present invention provides a method for attack chain analysis and defense strategy generation, comprising: Collect attack and defense event data to form an event set; Map each event in the event set to a TTP to form a characteristic event; Constructing an attack chain temporal causal graph based on characteristic events. G ; Based on the constructed attack chain time-series cause-effect graph G Perform causal intervention calculations to quantify the effectiveness of defenses; Based on defense effectiveness, iterative generation of defense strategies is achieved through reinforcement learning; The generated defense strategy is verified, and the attack chain temporal causality graph is updated. G .

[0009] In a preferred embodiment, the attack chain temporal causality graph G Defined as:

[0010] in, Represents a set of nodes, each node Corresponding to a characteristic event Mapped TTP; Represents a set of directed edges, one from node Pointing to node The directed edge represents the node. The TTP represented is a node. The direct cause of the occurrence.

[0011] In a preferred embodiment, a causal discovery algorithm based on temporal constraints and conditional independence tests is used to automatically construct the temporal causal graph of the attack chain. G ; The timing constraints include: for any two characteristic events and If a characteristic event It is another characteristic event The reason is that the time of its occurrence must meet the following conditions. < ;in, For characterizing events The time of occurrence, For characterizing events The time of occurrence; The conditional independence test includes: traversing all node pairs that satisfy the temporal constraints, and for each node pair, checking whether the two nodes of the node pair are conditionally independent given other node sets Z. If the two nodes of the node pair are not conditionally independent for all other node sets Z, then a directed edge is established between the node pairs.

[0012] In a preferred embodiment, the constructed attack chain-based temporal causality graph G Perform causal intervention calculations to quantify the effectiveness of defenses, including: Do-calculus is used to perform causal intervention calculations to obtain the probability of a node successfully attacking the node of the final target. The effectiveness of the defense is quantified by comparing the probability of attack success before and after intervention.

[0013] In a preferred embodiment, the iteration and generation of defense strategies based on defense effectiveness and through reinforcement learning includes: Do-calculus is used to calculate the average causal effect of each node on the final target node; Nodes whose average causal effect exceeds a preset threshold are selected to form a key factor set; For each node in the key factor set, query the TTP-defense measures knowledge base and generate corresponding defense strategy suggestions; The proposed defense strategy is subjected to reinforcement learning to generate the optimal defense strategy. The state space of the reinforcement learning is the safe state, the action space is the defense strategy, and the reward function is composed of a weighted sum of the change in the effectiveness of the defense, the deployment cost of implementing the defense strategy, and the potential negative impact of implementing the defense strategy on the business system.

[0014] In a preferred embodiment, the attack chain temporal causality graph is updated by verifying the generated defense strategy. G ,include: The generated defense strategy is deployed and verified in an isolated test environment; simulated attacks are relaunched to collect new attack and defense event data, forming a new event set; Define a causal consistency loss function, which measures the temporal causal graph of the attack chain. G The deviation between the predicted results and the actual verification results in the new event set; Update the temporal causal graph of the attack chain based on the causal consistency loss function. G .

[0015] In a preferred embodiment, gradient descent is used to update the attack chain temporal causal graph.G .

[0016] Secondly, the present invention provides an attack chain analysis and defense strategy generation system, comprising: The data acquisition module is used to collect attack and defense event data and form an event set; The data processing module is used to map each event in the event set to the TTP, forming characteristic events; The model building module is used to construct a temporal causal graph of the attack chain based on characteristic events. G ; Intervention quantization module, used for constructing a temporal causal graph of the attack chain. G Perform causal intervention calculations to quantify the effectiveness of defenses; The strategy optimization module is used to iterate and generate defense strategies based on defense effectiveness and through reinforcement learning. The model update module is used to update the attack chain temporal causal graph by verifying the generated defense strategy. G .

[0017] Thirdly, the present invention provides an electronic device, comprising: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the instructions stored in the memory to perform the above-described method.

[0018] Fourthly, the present invention provides a computer-readable storage medium for storing instructions that, when executed, cause the above-described method to be implemented.

[0019] In summary, this invention solves the technical challenges of how to extract attack causal chains from complex security incidents, quantify and evaluate defensive measures, and intelligently generate optimization strategies by constructing a temporal causal graph of the attack chain to eliminate spurious correlations, performing lossless defense effectiveness evaluation, and utilizing reinforcement learning to find the globally optimal defense strategy under multiple constraints. Specific beneficial effects include: 1. Precisely pinpoint root causes and reduce false alarm rates. This invention overcomes the limitations of traditional detection technologies that rely solely on statistical correlation. By constructing a temporal causal graph of the attack chain and performing conditional independence tests, it effectively eliminates spurious correlation interference from massive logs, accurately identifies the logical dependencies between attack events, and pinpoints the root causes of successful attacks, fundamentally reducing false alarm rates and alarm fatigue.

[0020] 2. Quantifiable defensive effectiveness, supporting counterfactual analysis. This invention utilizes Do-calculus in causal reasoning to quantify defensive measures. Counterfactual analysis can be performed without interfering with existing network services, and the average causal effect of specific defensive measures on blocking the attack chain can be calculated, providing defenders with insights based on "how to implement defensive strategies." S The precise decision-making basis is that "the success rate of the attack will decrease by X%".

[0021] 3. Multi-dimensional trade-offs, automatically generating the optimal strategy. This invention introduces a multi-objective reinforcement learning mechanism, solving the problem of traditional defense strategies neglecting business impact. When generating a strategy, it comprehensively calculates defense gains, business disruption risks, and deployment costs, automatically searching for the globally optimal strategy combination that balances security and business continuity.

[0022] 4. Constructing an adaptive closed loop with continuous evolution capabilities. This invention establishes a closed-loop feedback mechanism of "attack simulation → causal reasoning → strategy generation → defense verification." By calculating the causal consistency loss between the predicted intervention results and the actual verification results, it can update the causal graph structure and parameters online, achieving dynamic adaptation and self-evolution to new attack methods and environmental changes.

[0023] 5. Standardized semantic mapping improves response efficiency. This invention maps multi-source heterogeneous security data to the MITREATT&CK standard framework, eliminating semantic gaps between different devices. This not only improves the readability of analysis results but also provides standardized decision input for Automated Orchestration and Response (SOAR), significantly shortening emergency response time. Attached Figure Description

[0024] Figure 1 This is a flowchart of an attack chain analysis and defense strategy generation method provided in an embodiment of the present invention.

[0025] Figure 2 This is a flowchart illustrating the strategy optimization in an embodiment of the present invention.

[0026] Figure 3 This is a schematic diagram of the structure of an attack chain analysis and defense strategy generation system provided in an embodiment of the present invention.

[0027] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0029] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0030] like Figure 1 As shown, this embodiment of the invention provides a method for attack chain analysis and defense strategy generation, including: S100 collects attack and defense event data to form an event set; In this embodiment of the invention, attack and defense event data are collected from BAS (Attack Simulation System), EDR (Endpoint Detection and Response System), SIEM (Security Information and Event Management System), and log auditing system. The collected attack and defense event data is parsed and structured into an event set D. Each event in event set D... This is represented as a four-tuple containing an event timestamp, attack action, system state, and defense response result. Therefore, the event set D is represented as:

[0031] in, Represents the event timestamp, accurate to milliseconds, used to determine the order of events; For attack actions, describe the specific operations performed by the attacker (e.g., executing "cmd.exe / c whoami"); For system status, record the system context when the event occurs (e.g., "{User: "SYSTEM", Host: "WinServer2019", Port: 445}"). For defense response results, record the defense system's reaction to the event (e.g., "{Detected: True, Blocked: False, ExitCode: 0}").

[0032] S200 maps each event in the event set to a TTP, forming a characteristic event; In this embodiment of the invention, a standardized function is used. For each event in the event set D Process each event Mapped to the TTP (Tactics, Techniques, Procedures) within the MITRE ATT&CK framework, generating unified characteristic events. , is represented as:

[0033] Thus, each characteristic event Mapping has TTPs. For example, an event "Execute PowerShell command" might be mapped to T1059.001: PowerShell. This step unifies heterogeneous events from different sources into a common feature space with a clear tactical intent; that is, each characteristicized event corresponds to a TTP, represented as:

[0034] S300, constructing an attack chain temporal causality graph based on characteristic events. G .

[0035] The attack chain time-series cause-effect graph G A directed acyclic graph (DAG) representing the causal dependencies between different time-to-product (TTP) relationships is defined as follows:

[0036] in, Represents a set of nodes, each node Corresponding to a characteristic event Mapped TTPs (e.g., T1059.001). Node attributes include: attack technique type, executor (e.g., svchost.exe under SYSTEM privileges), trigger conditions (e.g., successful execution of preceding TTP T1566.001), defense response status, detection status, and attack result (success / failure). Represents a set of directed edges, one from node Pointing to node The directed edge ( , )∈E represents a node The TTP represented is a node. The direct cause of the occurrence.

[0037] In this embodiment of the invention, a causal discovery algorithm based on temporal constraints and conditional independence tests is used to automatically construct the temporal causal graph of the attack chain. G .

[0038] The timing constraints include: for any two characteristic events and If a characteristic event It is another characteristic event The reason is that the time of its occurrence must meet the following conditions. < ,in, For characterizing events The time of occurrence, For characterizing events The timing of the occurrence. This eliminates a large number of impossible combinations for searching for causal relationships.

[0039] The conditional independence test includes: traversing all node pairs that satisfy the temporal constraints ( , For each node pair, check whether the two nodes in the pair are conditionally independent given the other node set Z. For example, check the nodes... and nodes Are they conditionally independent with respect to the set of other nodes Z? ⊥ |Z). If for all other node sets Z, the node pair ( , If neither of the two nodes in a given pair is conditionally independent, then in the pair of nodes ( , Establish a directed edge between () and (). Through this process, spurious causal relationships (i.e., correlations) can be eliminated, leaving only direct causal relationships.

[0040] Probabilistic parameterization for attack chain temporal causal graphs G Each node in Estimate the conditional probability distribution based on the event set D. ,in, It is a node The set of parent nodes. The conditional probability distribution can be implemented using classification models such as frequency counting, decision trees, or trained logistic regression. Finally, the joint probability distribution of the entire attack chain temporal causal graph G is represented as:

[0041] S400, based on a constructed attack chain temporal cause-effect graph. G Perform causal intervention calculations to quantify the effectiveness of defense.

[0042] Based on the constructed attack chain time-series cause-effect graph G The impact of different defense measures on the attack outcome is calculated using a causal reasoning algorithm. The attack chain time-series causal graph is then used. GRepresented as a structural causal model (SCM), where each node The value is represented as:

[0043] in, These are exogenous noise variables, representing unmodeled or random factors; It can be a conditional probability model learned from data.

[0044] S401, Do-calculus is used to perform causal intervention calculations to obtain the probability of a node successfully attacking the final target node. In this embodiment of the invention, in order to evaluate the effectiveness of a certain defense measure, Judea Pearl's Do-calculus is used to perform causal intervention calculations. Assume a defense measure is to block a node... X The occurrence of this indicates intervention. ,in, This indicates the state of intervention, including failure or interception. After intervention, the probability of a node successfully attacking the final target node. Calculated using the following formula:

[0045] in, Y The node that represents the final target of the attack (e.g., "domain controller privilege acquisition"). Z It is except for nodes X and nodes Y The set of other nodes besides the attack chain. This calculation is performed through the attack chain temporal causality graph. G Remove all pointers to nodes X The directed edges and their values ​​are fixed. Then, in the new attack chain time-series cause-effect graph G The results were obtained through probabilistic reasoning, thus simulating the effect of forcibly enforcing defensive measures.

[0046] S402 quantifies defense effectiveness by comparing the probability of attack success before and after intervention. (i.e., causal effect), expressed as:

[0047] in, It is a node X The state before intervention, including success or occurrence. If A value greater than 0 indicates that the intervention effectively reduced the attack success rate; the higher the value, the better the effect. By performing this calculation on all potential intervention nodes (i.e., all TTP nodes), the most critical defensive link in the attack chain that can bring the greatest defensive effect can be found.

[0048] S500 is based on defense effectiveness and iterates and generates defense strategies through reinforcement learning.

[0049] In this embodiment of the invention, specific and executable defense strategies are automatically generated based on the results of causal reasoning, and continuous optimization is performed using reinforcement learning. For example... Figure 2 As shown, it specifically includes: S501 uses Do-calculus to compute each node. X i Nodes that are the final target of the attack Y Average Causal Effect (ACE):

[0050] in, X 1 and X 0 represents node X i Two different states (e.g., a successful / occurring state without intervention and a failed / intercepted state with intervention).

[0051] S502, filter out products whose average causal effect exceeds a preset threshold. The nodes form a set of key factors. C :

[0052] S503, for the key factor set C Each node in the system queries the TTP-Defense Measures Knowledge Base to generate corresponding defense strategy suggestions. The TTP-Defense Measures Knowledge Base stores the defense measures corresponding to each TTP, can be associated with frameworks such as MITRE D3FEND, and is maintained by the system. A strategy generation function can be used. It will query the TTP-Defense Measures Knowledge Base and generate corresponding defense strategy suggestions. For example, if the key factor is T1003.001: LSASSMemory, the generated defense strategy S may include: "Enable Credential Guard" and "Configure LSA protection".

[0053] S504 uses reinforcement learning to generate the optimal defense strategy based on the proposed defense strategy. In this embodiment of the invention, reinforcement learning is used iteratively to find the optimal combination among multiple optional defense strategies (considering defense effectiveness, business impact, deployment costs, etc.). The state space of the reinforcement learning is a safe state s, the action space is defense strategy a, and the reward function is... It is composed of a weighted average of the change in defense effectiveness, the deployment cost of implementing the defense strategy, and the potential negative impact of implementing the defense strategy on the business system, and is expressed as follows:

[0054] in, This represents the change in defense effectiveness resulting from defense strategy a. This represents the deployment cost of implementing defense strategy a. This indicates the potential negative impact of implementing defense strategy a on the business system. w 1 ，w 2 ， w 3 is the corresponding weighting parameter, used to balance defense effectiveness, deployment cost, and business impact.

[0055] In this embodiment of the invention, an optimal policy is learned through continuous simulation-verification loops using algorithms such as Q-learning or Policy Gradient. This optimal strategy can be applied in any safe state. s Below, we recommend defense strategy a, which maximizes long-term cumulative rewards.

[0056]

[0057] in, The optimal strategy is... As a discount factor, The reward function for defense (such as increased attack interception rate, decreased false alarm rate, etc.).

[0058] The S600 updates the attack chain causality graph by verifying the generated defense strategy. G This enables a closed-loop feedback and self-learning mechanism.

[0059] S601, generated defense strategy S First, deployment and verification are performed in an isolated test environment (sandbox); then, a simulated attack is re-initiated to collect new attack and defense event data, forming a new event set D'. This set can be used to analyze the attack chain's temporal cause-effect graph. G Visualize it.

[0060] S602, Define the causal consistency loss function The causal consistency loss function measures the temporal causal graph of the attack chain.G The deviation between the causal intervention calculation results and the actual verification results in the new event set is expressed as:

[0061] in, attack chain temporal cause-effect graph G China's defense strategy S Nodes that are the final target of the attack Y The causal intervention calculation results This represents the actual verification results in the new event set. This indicates the calculation deviation.

[0062] The causal consistency loss function The current attack chain's temporal causal graph was measured. G t For the current set of events D t The prediction accuracy is improved. In this embodiment of the invention, gradient descent is used to update the weight parameters θ of the attack chain temporal causal graph, and even structural relearning is triggered (re-running step S300) when the deviation is too large. The update formula of the attack chain temporal causal graph can be expressed as:

[0063] in, For learning rate, This is a gradient operator. It means that the attack chain temporal causal graph will automatically adjust its structure and parameters based on new evidence to better reflect the current threats. After multiple rounds of "attack simulation → causal reasoning → strategy generation → defense verification," an intelligent defense system with self-optimization capabilities is finally formed. Therefore, this invention solves the technical challenge of how to extract attack causal chains from complex security events, quantitatively evaluate defense measures, and intelligently generate optimized strategies.

[0064] Based on the same technological concept, such as Figure 3 As shown, this embodiment of the invention also provides an attack chain analysis and defense strategy generation system, including: The data acquisition module is used to collect attack and defense event data and form an event set; The data processing module is used to map each event in the event set to the TTP, forming characteristic events; The model building module is used to construct a temporal causal graph of the attack chain based on characteristic events. G ; Intervention quantization module, used for constructing a temporal causal graph of the attack chain. G Perform causal intervention calculations to quantify the effectiveness of defenses; The strategy optimization module is used to iterate and generate defense strategies based on defense effectiveness and through reinforcement learning. The model update module is used to update the attack chain temporal causal graph by verifying the generated defense strategy. G .

[0065] The working principles of each functional module in the above system can be referred to the description in the aforementioned method embodiments, and will not be repeated here.

[0066] Based on the same technical concept, embodiments of the present invention also provide an electronic device that can implement the attack chain analysis and defense strategy generation method flow provided in the above embodiments of the present invention. In one embodiment, the electronic device can be a server, a terminal device, or other electronic devices. Figure 4 As shown, the electronic device may include: At least one processor and a memory connected to the at least one processor. In this embodiment of the invention, the specific connection medium between the processor and the memory is not limited. Figure 4 The example used is the connection between the processor and memory via a bus. The bus... Figure 4 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. Buses can be divided into address buses, data buses, control buses, etc., but for ease of representation, [the specific bus type is not shown here]. Figure 4 The processor is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, a processor can also be called a controller; there are no restrictions on the name.

[0067] In this embodiment of the invention, the memory stores instructions that can be executed by at least one processor. By executing the instructions stored in the memory, at least one processor can execute the attack chain analysis and defense strategy generation method described above.

[0068] The processor is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory and calling data stored in memory, it can monitor the device's various functions and process data, thereby enabling overall monitoring of the device.

[0069] In an alternative design, the processor may include one or more processing units. The processor may integrate an application processor and a modem processor, wherein the application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may also not be integrated into the processor. In some embodiments, the processor and memory may be implemented on the same chip; in some embodiments, they may also be implemented separately on separate chips.

[0070] The processor can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the attack chain analysis and defense strategy generation method disclosed in the embodiments of this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0071] Memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory can include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures, and accessible by a computer, but is not limited thereto. In embodiments of the present invention, memory can also be a circuit or any other device capable of implementing storage functions, used to store program instructions and / or data.

[0072] By designing and programming the processor, the code corresponding to the attack chain analysis and defense strategy generation method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute the steps of the method described in the foregoing embodiments during runtime. How to design and program the processor is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0073] Based on the same inventive concept, embodiments of the present invention also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform an attack chain analysis and defense strategy generation method described above.

[0074] In some alternative embodiments, the present invention also provides that various aspects of the attack chain analysis and defense strategy generation method can also be implemented in the form of a program product, which includes program code. When the program product is run on a device, the program code is used to cause the control device to perform the steps in the attack chain analysis and defense strategy generation method according to various exemplary embodiments of the present invention described above.

[0075] It should be noted that although several units or sub-units of the apparatus have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units. Furthermore, although the operation of the method of the invention is described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0076] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0077] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0078] Program code for performing the operations of this invention can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0079] In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0080] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0081] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0082] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for attack chain analysis and defense strategy generation, characterized in that, include: Collect attack and defense event data to form an event set; Map each event in the event set to a TTP to form a characteristic event; Constructing an attack chain temporal causal graph based on characteristic events. G ; Based on the constructed attack chain time-series cause-effect graph G Perform causal intervention calculations to quantify the effectiveness of defenses; Based on defense effectiveness, iterative generation of defense strategies is achieved through reinforcement learning; The generated defense strategy is verified, and the attack chain temporal causality graph is updated. G .

2. The attack chain analysis and defense strategy generation method according to claim 1, characterized in that, The attack chain time-series cause-effect graph G Defined as: in, Represents a set of nodes, each node Corresponding to a characteristic event Mapped TTP; Represents a set of directed edges, one from node Pointing to node The directed edge represents the node The TTP represented is a node. The direct cause of the occurrence.

3. The attack chain analysis and defense strategy generation method according to claim 2, characterized in that, A causal discovery algorithm based on temporal constraints and conditional independence tests is used to automatically construct the temporal causal graph of the attack chain. G ; The timing constraints include: for any two characteristic events and If a characteristic event It is another characteristic event The reason is that the time of its occurrence must meet the following conditions. < ;in, For characterizing events The time of occurrence, For characterizing events The time of occurrence; The conditional independence test includes: traversing all node pairs that satisfy the temporal constraints, and for each node pair, checking whether the two nodes of the node pair are conditionally independent given other node sets Z. If the two nodes of the node pair are not conditionally independent for all other node sets Z, then a directed edge is established between the node pairs.

4. The attack chain analysis and defense strategy generation method according to claim 1, characterized in that, The constructed attack chain-based temporal cause graph G Perform causal intervention calculations to quantify the effectiveness of defenses, including: Do-calculus is used to perform causal intervention calculations to obtain the probability of a node successfully attacking the node of the final target. The effectiveness of the defense is quantified by comparing the probability of attack success before and after intervention.

5. The attack chain analysis and defense strategy generation method according to claim 1, characterized in that, The iteration and generation of defense strategies based on defense effectiveness and through reinforcement learning includes: Do-calculus is used to calculate the average causal effect of each node on the final target node; Nodes whose average causal effect exceeds a preset threshold are selected to form a key factor set; For each node in the key factor set, query the TTP-defense measures knowledge base and generate corresponding defense strategy suggestions; The proposed defense strategy is subjected to reinforcement learning to generate the optimal defense strategy. The state space of the reinforcement learning is the safe state, the action space is the defense strategy, and the reward function is composed of a weighted sum of the change in the effectiveness of the defense, the deployment cost of implementing the defense strategy, and the potential negative impact of implementing the defense strategy on the business system.

6. The attack chain analysis and defense strategy generation method according to claim 1, characterized in that, The process involves verifying the generated defense strategy and updating the attack chain temporal causality graph. G ,include: The generated defense strategy is deployed and verified in an isolated test environment; simulated attacks are relaunched to collect new attack and defense event data, forming a new event set; Define a causal consistency loss function, which measures the temporal causal graph of the attack chain. G The deviation between the predicted results and the actual verification results in the new event set; Update the attack chain temporal causal graph based on the causal consistency loss function. G .

7. The attack chain analysis and defense strategy generation method according to claim 6, characterized in that, Update the temporal causal graph of the attack chain using gradient descent G .

8. An attack chain analysis and defense strategy generation system, characterized in that, include: The data acquisition module is used to collect attack and defense event data and form an event set; The data processing module is used to map each event in the event set to the TTP, forming characteristic events; The model building module is used to construct a temporal causal graph of the attack chain based on characteristic events. G ; Intervention quantization module, used for constructing a temporal causal graph of the attack chain. G Perform causal intervention calculations to quantify the effectiveness of defenses; The strategy optimization module is used to iterate and generate defense strategies based on defense effectiveness and through reinforcement learning. The model update module is used to update the attack chain temporal causal graph by verifying the generated defense strategy. G .

9. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed, cause the method as described in any one of claims 1-7 to be implemented.

Images