Attack scenario visualization arrangement and automatic execution system based on ATT&CK framework

Abstract

The application relates to the technical field of network security, and discloses an attack scene visualization arrangement and automatic execution system based on an ATT&CK framework, which comprises a scene creation and attack case card generation module, a conditional branch connection module, a card independent configuration module, a global parameter aggregation and state checking module, an attack chain execution scheduling module, and an execution monitoring and result display module. Attack cases are organized through an ATT&CK tactical classification system, a conditional branch attack chain is constructed through double-color directed connection, and independent configuration and automatic scheduling execution of attack nodes in each stage are supported.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to an attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework. Background Technology

[0002] Intrusion and attack simulation systems are used to verify the effectiveness of enterprise security protection systems. Existing BAS systems typically describe attack flows using static attack sequences. The construction of attack scenarios lacks a systematic correspondence with the ATT&CK framework's tactical classification system, and the organization of attack cases is not standardized, making it difficult to cover the complete tactical scope of the attack lifecycle. The execution flow of the attack chain cannot dynamically select subsequent execution paths based on the actual execution results of preceding attack steps, and there is a significant deviation between the attack simulation logic and the behavior of real attackers who adaptively adjust their strategies based on protection responses. In multi-stage attack scenarios, the network nodes targeted by each step remain unchanged, failing to accurately represent the dynamic changes in the source and destination points of attack traffic when attackers move laterally between different network areas. These problems result in insufficient fidelity in the simulation of real attack behavior by BAS systems, making it impossible to effectively support the continuous verification and improvement of enterprise security protection capabilities. Summary of the Invention

[0003] This invention provides an attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework, which solves the technical problems in related technologies such as the lack of attack chain orchestration and execution capabilities that support conditional branch scheduling, and the inability to quantitatively evaluate and trend analyze protection and detection capabilities.

[0004] This invention discloses an attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework, including a scenario creation and attack case card generation module, a conditional branch connection module, an independent card configuration module, a global parameter aggregation and status verification module, an attack chain execution scheduling module, and an execution monitoring and result display module.

[0005] The scenario creation and attack case card generation module displays attack cases in a primary category according to the tactical hierarchy of the ATT&CK framework, and in a secondary category according to attack technology items and sub-technology items. In response to user selection, it generates attack case card nodes in the arrangement canvas that are bound to ATT&CK technology numbers and attribute information.

[0006] The conditional branching module renders red and green dots on each attack case card in the orchestration canvas. Responding to user drag-and-drop operations, it generates directed connections between the source and target cards. A red directed connection triggers a successor node when the attack case execution result of the source card is invalid, and a green directed connection triggers a successor node when the result is valid, using edge triples. Persistent storage of connection topology relationships is used to construct a directed graph of attack chain branches based on execution results; whereby... For source node identifier, Identify the target node. This is a connection type.

[0007] The card-independent configuration module allows for independent configuration of global parameters, attacker-side proxy nodes, and victim-side proxy nodes for each attack case card. Different cards support different node combinations.

[0008] The global parameter aggregation and status verification module deduplicates and merges the global parameter sets of all cards to generate a parameter aggregation mapping table, completes the distribution of parameter values ​​to each card, and performs configuration completeness verification on each card. The run button is activated only when all cards pass the verification.

[0009] The attack chain execution scheduling module constructs a directed graph. ,in For a set of nodes, Given a set of directed edges, the set of nodes with an in-degree of zero is used as the starting node. Tasks are orchestrated and executed according to the conditional branch scheduling logic, based on the status value of each node's execution result. Match outgoing edges of the corresponding type to determine the successor node.

[0010] The execution monitoring and result display module pushes the execution status of each card node in real time through a WebSocket long connection, renders the node status differently in the orchestration canvas, and displays the verification results, protection blocking status, and alarm trigger status.

[0011] Furthermore, the attack chain execution scheduling module is also configured to: obtain the task name and execution cycle filled in by the user, the execution cycle including immediate execution once, periodic repetition execution defined by Cron expression, and scheduled execution triggered on a specified date and time, and create an orchestrated task record in the task database.

[0012] Furthermore, the execution monitoring and result display module is also configured to: respond to the user's click on the card operation that has been completed, render the complete execution log record, original data packet information, alarm details and execution timeline, and the execution timeline displays the node initialization time, attack packet sending time, result waiting time and result determination time in the form of a time axis.

[0013] Furthermore, it also includes an attack execution time sequence fingerprint construction module, a detection capability index calculation module, a significant change point detection module, and a detection capability profile generation and write-back module. After all orchestration nodes have been executed, the attack execution time sequence fingerprint construction module sorts all executed nodes in ascending order of execution timestamp, and encodes each node's ATT&CK tactical attribution tag, ATT&CK technical number, execution result status value, protection blocking status value, and alarm trigger status value into feature tuples. ,in A tag for ATT&CK tactics. For ATT&CK technology designation, The execution result status value, To protect the blocking status value, The alarm trigger status values ​​are concatenated in chronological order to form an attack execution time fingerprint sequence. The detection capability index calculation module calculates the attack execution time sequence fingerprint. According to ATT&CK tactical affiliation labels Perform segmented aggregation for each tactical segment subsequence. Calculate the blocking rate separately and alarm coverage Generate detection capability index vectors according to the ATT&CK tactical phase standard sequence. ,in Total number of tactical phases. For tactical phase indexing. The significant change point detection module's detection capability index vector. The blocking rate and alarm coverage rate of adjacent tactical phases are calculated using differential sequences. and After smoothing by the mean of a sliding window, if the absolute value exceeds a preset decay threshold... The location points form a set of records of significant changes. The detection capability profile generation and write-back module is based on detection capability index vectors. and a set of records of significant changes Generate a detection capability profile data structure, and write it back to the visualization layout canvas in an overlay layer manner for rendering, aligning it with the original layout path.

[0014] Furthermore, in the detection capability index calculation module, the blocking rate... and alarm coverage The calculation methods are as follows: ; ; in For characteristic tuples The protection and blocking status value, For characteristic tuples The alarm trigger status value, Tactical segmentation subsequence The total number of tuples in the data. For the total number of tuples, it is an indicator function; Less than the preset minimum sample size threshold The tactical segmented subsequences are output with an insufficient data warning.

[0015] Furthermore, in the significant change point detection module, the difference sequence is calculated as follows: ; in For tactical phase indexing; apply a window width of [value] to the difference sequence. The sliding window mean smoothing process is applied, and the smoothed 1st... The value at each position is centered at that position and has a width of [value missing]. The arithmetic mean of the differences within the window, with existing values ​​used to fill the boundary positions.

[0016] Furthermore, the detection capability profile data structure includes: a tactical phase label as the dimension axis, and a... and The data includes: radar charts of blocking rates for various dimensions; a detection status matrix indexed by ATT&CK technology numbers and columns for protection blocking status and alarm triggering status; and a set of records of significant changes. Each record is a directed decay path data formed by the source tactical phase and target tactical phase label pairs, and the path edge weight is the absolute value of the corresponding difference value.

[0017] Furthermore, the detection capability profile generation and write-back module is also configured to: align the detection capability profile data of the current execution batch with the detection capability profile data of historical execution batches along the time dimension, and perform tactical phase analysis on the same protective equipment across different execution batches. Linear regression was performed on the blockage rate sequence to obtain the trend slope value. ;Will and Exceeding the preset degradation threshold The tactical phase is marked as a continuously degrading item, triggering a highlight annotation in the corresponding tactical phase node area of ​​the arrangement canvas, and generating a longitudinal comparative analysis report containing degradation warning information.

[0018] Furthermore, the parameter aggregation mapping table generated by the global parameter aggregation and status verification module uses the parameter name as the key and the parameter description, data type, and a list of card identifiers related to the parameter as the value. For cases where the same type of parameter needs to be configured with different values ​​in different cards, the configuration row of the parameter is displayed separately by card dimension in the summary configuration interface, and the independent values ​​filled in by the user for each card are obtained and written to the corresponding records respectively.

[0019] This invention discloses a method for visualizing, orchestrating, and automatically executing attack scenarios based on the ATT&CK framework, used to execute the aforementioned system, comprising the following steps: Attack cases are displayed in a first-level category according to the tactical hierarchy of the ATT&CK framework, and in a second-level category according to attack technology items and sub-technology items. In response to user selection, attack case card nodes bound to ATT&CK technology numbers and attribute information are generated in the arrangement canvas. In response to user drag-and-drop operations, generate a red or green directed line between the source card and the target card, using edge triples. Persistently store the connection topology and construct a directed graph of attack chain branches based on the execution result; Configure global parameters, attacker-side proxy nodes, and victim-side proxy nodes independently for each attack case card; The global parameter set of all cards is deduplicated and merged to generate a parameter aggregation mapping table, which completes the distribution of parameter values ​​to each card. The configuration completeness is checked for each card, and the run button is activated only when all cards pass the check. Constructing a directed graph ,in For a set of nodes, Given a set of directed edges, the set of nodes with an in-degree of zero is used as the starting node. Tasks are orchestrated and executed according to the conditional branch scheduling logic, based on the status value of each node's execution result. Match outgoing edges of the corresponding type to determine the successor node; The execution status of each card node is pushed in real time through a WebSocket long connection. The node status is rendered differently in the orchestration canvas, and the verification results, protection blocking status and alarm trigger status are displayed.

[0020] The beneficial effects of this invention are as follows: This invention addresses the technical problems of non-standard attack case organization and difficulty in covering the complete attack tactical chain by using the tactical and technical classification system of the ATT&CK framework as the basis for organizing attack cases. It achieves the technical effect of establishing a direct correspondence between attack scenario construction and a standardized attack knowledge base, covering the entire tactical scope of the attack lifecycle. Furthermore, by introducing two-color directed connections that trigger semantics based on execution results, it solves the technical problem of significant deviations between attack simulation logic and the adaptive behavior of real attackers. This achieves the technical effect that the attack simulation process can dynamically select subsequent execution paths based on the actual response results of the protection mechanism. Finally, by supporting independent configuration of attacker and victim proxy nodes for each card, it solves the technical problem of insufficient lateral movement simulation due to fixed attack nodes. This achieves the technical effect that multi-stage attack scenarios can accurately express the dynamic changes in the source and destination of attack traffic. Attached Figure Description

[0021] Figure 1 This is a flowchart of the attack scenario visualization orchestration and automatic execution method based on the ATT&CK framework provided in this embodiment of the invention; Figure 2 This is a sub-flowchart of card-independent configuration in the attack scenario visualization orchestration and automatic execution method based on the ATT&CK framework provided in the embodiments of the present invention; Figure 3 This is a flowchart of the method for analyzing the detection capabilities of protective equipment across tactical phases provided in an embodiment of the present invention. Detailed Implementation

[0022] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, some features described in the examples may be combined in other examples.

[0023] Example 1 At least one embodiment of the present invention discloses an attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework, the method of which is described below. Figure 1 The system comprises: a scenario management module running within the BAS system; the BAS system includes a front-end orchestration canvas, a scenario database, a task database, and proxy nodes deployed in various network zones. The ATT&CK framework is a network attack tactics and techniques knowledge base maintained by the MITRE organization, covering the complete attack lifecycle from initial access to data leakage, tactical classifications, and their specific technical items.

[0024] The scenario creation and attack case card generation module is configured to generate a set of attack case card nodes in the orchestration canvas based on the ATT&CK framework classification system.

[0025] The system retrieves the scenario name, target security device type, and verification result storage type filled in by the user in the basic information configuration area, creates the corresponding orchestration scenario record in the scenario database, and generates an initial blank attack case card in the center of the orchestration canvas.

[0026] In response to user-triggered use case additions, attack cases are displayed in a primary category according to the tactical hierarchy of the ATT&CK framework. Tactical categories include reconnaissance, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, infiltration, and impact. Under each tactical category, attack cases are displayed in a secondary category according to specific attack techniques and sub-techniques. Each attack case entry includes attribute information such as the use case name, ATT&CK technique number, use case description summary, and supported target device types.

[0027] The system retrieves one or more target attack cases selected by the user, binds the selected cases to the corresponding cards, and renders the name, ATT&CK number, and brief description of the selected cases on the cards. If the user selects multiple attack cases at once, an independent attack case card is generated for each selected case and arranged in a tiled manner on the arrangement canvas.

[0028] Each card corresponds to an independent attack execution step in the attack chain; the spatial layout of each card node on the orchestration canvas only affects the visual presentation and does not affect the actual execution logic order of the attack chain; a yellow exclamation mark icon is rendered in the upper left corner of the card to indicate that the current configuration is not yet complete. The orchestration canvas supports scaling and panning operations to adapt to the node layout requirements in large-scale attack chain scenarios.

[0029] The conditional branch connection module is configured to construct an attack chain branch dependency graph based on two-color directed connections, with the execution result as the condition.

[0030] In the arrangement canvas, two types of interactive connection trigger dots are rendered in the lower area of ​​each attack use case card: red dots and green dots. In response to the user's interaction of dragging from the source card's dot position to the target card and releasing it, a directed line of the corresponding color is generated between the source card and the target card. The direction of the line is indicated by an arrow, pointing from the source card to the target card.

[0031] The conditional trigger semantics of the red directed connection are defined as follows: when the attack case bound to the source card is executed and the result status is determined to be invalid (i.e., the attack successfully bypassed the protection mechanism, and the protection side failed to effectively intercept or alert), the system adds the attack case bound to the target card to the execution queue. The conditional trigger semantics of the green directed connection are defined as follows: when the attack case bound to the source card is executed and the result status is determined to be valid (i.e., the attack was successfully identified and blocked by the protection mechanism), the system adds the attack case bound to the target card to the execution queue.

[0032] The topological relationships between all card nodes and connections are represented using a directed graph data structure, allowing for various combinations such as chain structures, branch structures, and convergence structures. Each connection is recorded as a triplet with its edges. The data is persistently stored in the scene database in the form of [database name]. For the source card node identifier, Identify the target card node. , Corresponding to the red failed connection, The corresponding green line is valid.

[0033] A single attack case card can have both red and green outgoing edges, each pointing to two different successor cards, thus forming a binary branch structure based on the execution result. In response to a user clicking on the connected arc area and performing a delete operation, the corresponding edge record is removed from the scenario database. The connection deletion operation does not affect the configuration information of the source and target cards themselves.

[0034] The card-independent configuration module is configured to allow for independent parameter configuration and verification node binding for each attack test case card.

[0035] In response to user's independent configuration operations for each attack use case card in the orchestration canvas, the following three types of configuration data are processed respectively.

[0036] Card Name Configuration Submodule: Retrieves the custom name entered by the user in the card name input box, writes the custom name into the configuration record of the current card, and refreshes the rendering in the name display area at the top of the card.

[0037] The global parameter configuration submodule retrieves the pre-declared global parameter set for the attack cases bound to the current card. Global parameters include external input variables such as target IP address, target port, attack payload type, and timeout duration. Different attack cases require different global parameter sets. It also retrieves the parameter values ​​entered by the user in the current card's parameter configuration panel and writes these values ​​only to the current card's parameter storage record, without affecting the parameter settings of other cards.

[0038] Verification Node Configuration Submodule: In the attacker-side node area and the attacked-side node area of ​​the verification node selection panel, the specific node instance selected by the user from the online proxy node list is obtained respectively. The attacker-side node is the execution proxy node that initiates the attack in the BAS system, and the attacked-side node is the target proxy node that receives the attack. Each node instance corresponds to a proxy program deployed in a specific network area (including DMZ, intranet, core area, etc.). The identifier of the selected node instance is written to the configuration record of the current card.

[0039] Different cards can be configured with different combinations of attacker and victim nodes to support simulation requirements where the source and destination of attack traffic dynamically change as the attack progresses in multi-stage attack scenarios. For example, card 1 is configured with an attacker node as an external network proxy and a victim node as a DMZ proxy to simulate an external attack breaching the boundary; card 2 is configured with an attacker node as a DMZ proxy and a victim node as an internal network proxy to simulate an attacker moving laterally into the internal network after breaching the boundary; the two cards are connected through the connection relationship in the conditional branch connection module to form a multi-stage attack simulation path.

[0040] The global parameter aggregation and status verification module is configured to aggregate global parameters and perform status verification on the completeness of each card's configuration.

[0041] In response to a user-triggered one-click configuration operation, the system iterates through all attack case cards in the orchestration canvas, reads the global parameter set declared by the attack case bound to each card, performs a deduplication and merging operation on the parameter sets of all cards, generates a parameter aggregation mapping table with parameter name as the key and parameter description, data type, and a list of card identifiers related to the parameter as the value, and presents it in the form of a form in the summary configuration interface.

[0042] The system retrieves the parameter values ​​entered by the user in the summary configuration interface. Based on the card affiliation recorded in the parameter aggregation mapping table, it writes each parameter value to the parameter storage record of the corresponding card, completing the parameter value distribution from the summary configuration interface to each card. For cases where the same type of parameter requires different values ​​in different cards, the system displays the configuration row for that parameter separately by card in the summary configuration interface, retrieves the independent values ​​entered by the user for each card, and writes them to the corresponding records.

[0043] After parameter distribution is complete, a configuration completeness check is performed on each card in the orchestration canvas: the list of required parameters and the list of required configuration items for the attack test cases bound to the current card are read, and each item is checked to see if a non-empty valid value is stored in the configured record of the current card. If all required configuration items are fully filled, the status icon of the card is changed from a yellow exclamation mark to a green checkmark, indicating that the card is configured and ready; if there are still required configuration items that are not filled or have invalid values, the yellow exclamation mark icon is maintained, indicating that the card configuration needs to be improved.

[0044] The Run button in the upper right corner of the interface will be switched from disabled to active only if the status flags of all attack test case cards on the arrangement canvas are switched to green checkmarks; if the status of any card changes from ready to pending improvement, the Run button will be switched back to disabled.

[0045] The attack chain execution scheduling module is configured to generate an attack chain execution flowchart and drive task execution according to conditional branch scheduling logic.

[0046] In response to user-triggered operation, a directed graph data structure is constructed using all card nodes in the arrangement canvas as the vertex set and all red-green directed lines as the directed edge set. ,in This is a set of attack use case card nodes. The total number of cards; Let be the set of directed edges connecting lines. This represents the total number of connections; each directed edge... Defined as a triple ,in As the source node, For the target node, Indicates the connection type. This is the index of the directed edge.

[0047] Compute directed graphs The set of nodes with an in-degree of zero is used as the starting node set of the attack chain. The set of nodes with a degree of zero is calculated as the set of nodes that terminate the attack chain. Directed graph and node set , Together they form the attack chain execution flowchart, which is stored in the task database in serialized form.

[0048] Retrieve the task name, execution cycle (execute immediately once, repeat periodically as defined by a Cron expression, or scheduled execution triggered at a specified date and time) and task-level metadata entered by the user in the task parameter configuration dialog box, create an orchestrated task record in the task database, and set the initial task status to pending execution.

[0049] After the orchestration task record is created, the task execution engine drives execution according to the following scheduling logic: Set the attack chain start node set... All card nodes are set to a pending state, and execution instructions are sent to the attacker and victim proxy nodes configured for the corresponding card, passing in the card's global parameter configuration and the target attack case identifier, thus triggering the actual execution of the attack case. When the node After the attack test case is executed, obtain the node. Execution result status value ,in Indexing card nodes in a directed graph Query the set of outgoing edges that meet the conditions and All directed edges will correspond to successor nodes. Add the node to the execution queue. If a node has multiple directed edges corresponding to different predecessor nodes among its incoming edges, the node will only be added to the execution queue after all its predecessor nodes have completed execution and met the corresponding conditions. Repeat the above scheduling process until the execution queue is empty or the preset task-level timeout threshold is reached, then update the task status to completed.

[0050] The execution monitoring and results display module is configured to collect execution status data in real time and render monitoring and results views in a multi-dimensional format.

[0051] During task execution, real-time execution status data for each attack case card is collected. Status values ​​include pending execution, executing, completed (including valid and invalid sub-states), and execution failed. Status updates are pushed from the server to the front end via a WebSocket long connection. Differentiated visual rendering is applied to each card node in the attack chain flowchart on the task details page: cards in the pending execution state are displayed in gray; cards in the executing state are highlighted in blue with a dynamic rotation loading animation; cards in the completed state with valid results are displayed in green, and cards with invalid results are displayed in red; cards in the execution failed state are displayed in orange with an error type summary noted in the card area. Connections that have been triggered and completed are highlighted with solid lines, while untriggered connections retain the default dashed line style.

[0052] The key results summary information of this execution is overlaid and rendered in the visible area of ​​the card, including the verification result (valid or invalid, reflecting the detection and interception capabilities of the protection mechanism), the protection blocking status (blocked or not blocked, reflecting whether the protection device has implemented blocking actions on the attack traffic) and the alarm trigger status (alarmed or not alarmed, reflecting whether the security monitoring system has generated an alarm event for this attack behavior).

[0053] In response to the user clicking on the card indicating that the execution has been completed, the following multi-dimensional detailed information is rendered on the test case execution details page: complete execution log records (including the sending timestamp, sending node identifier, and sending status of each attack packet), raw data packet information (including the complete packet content of the attack traffic, supporting PCAP format download), alarm details (including alarm rule name, alarm level, alarm time, and alarm raw log), and execution timeline (displaying the time distribution of each stage from test case triggering to execution completion in the form of a time axis, including node initialization time, attack packet sending time, result waiting time, and result determination time).

[0054] This invention uses the tactical and technical classification system of the ATT&CK framework as the basis for organizing attack use cases, thus establishing a direct correspondence between the construction of attack scenarios and a standardized attack knowledge base. This covers the entire tactical scope of the attack lifecycle and overcomes the problems of non-standardized attack use case organization and difficulty in covering the complete attack tactical chain in traditional solutions.

[0055] This invention expands the execution logic of the attack chain from a static linear sequence to a conditional branching directed graph structure by introducing two-color directed connections that trigger semantics based on the execution result. Red failed connections represent the attacker's path of further advance after successfully bypassing the defense, while green valid connections represent the attacker's adaptive adversarial behavior of changing attack strategies after encountering interception. The combination of these two types of connections allows the attack simulation process to dynamically select subsequent execution paths based on the actual response of the defense mechanism, thereby improving the simulation fidelity of the real attacker's adaptive behavior and solving the problem of significant deviations between the attack simulation logic and the real attacker behavior in traditional solutions.

[0056] This invention enables multi-stage attack scenarios to accurately represent the dynamic changes in the source and destination of attack traffic when an attacker moves laterally between different network regions by supporting independent configuration of attacker and victim proxy nodes for each card. This overcomes the problem of insufficient simulation of lateral movement caused by fixed attack nodes in traditional solutions.

[0057] This invention ensures that execution is only allowed when all card configuration items meet the non-empty and valid condition by linking configuration completeness verification with the run button. This eliminates the risk of execution interruption due to missing parameters or unbound nodes during the configuration phase. Real-time status push and multi-dimensional result rendering via WebSocket long-connection enable security operations personnel to continuously observe the actual progress of the attack chain on each branch path and the evaluation conclusions of the protection effect at each step during task execution, providing observable data for the continuous verification and improvement of security protection capabilities.

[0058] Example 2 In the attack scenario visualization orchestration and automatic execution method described in Example 1, after the orchestration task is completed, the system can mark the execution status (effective or ineffective), protection blocking status and alarm triggering status of each attack use case card node on the attack chain flowchart. Security operations personnel can view the execution result summary information of each card node by node through the execution monitoring and result display module.

[0059] However, when an attack scenario involves dozens of ATT&CK technology nodes and the orchestration path has multiple conditional branches, there are temporal dependencies and tactical phase progression relationships between the execution results of each node. When security operations personnel view the status annotations node by node on the visualization canvas, they cannot automatically identify the changing patterns of the protection device's detection capabilities across tactical phases during the attack scenario's progression. For example, a protection device might effectively block most technology nodes during the initial access phase, but its blocking rate significantly decreases during the lateral movement phase. This cross-tactical phase detection capability attenuation pattern cannot be automatically identified and quantified by viewing the canvas status annotations node by node. Based on Example 1, this implementation adds the following module after the execution monitoring and result display module is completed to automatically identify the changing patterns of the protection device's detection capabilities across tactical phases during the attack scenario's progression and to write the structured analysis results back to the visualization orchestration canvas.

[0060] At least one embodiment of the present invention discloses an attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework, the method of which is described below. Figure 3 The system includes: This embodiment runs in the system environment described in Embodiment 1, and reuses the basic components of Embodiment 1 such as the front-end orchestration canvas, scene database, task database and proxy nodes.

[0061] The attack execution timing fingerprint construction module is configured to construct an attack execution timing fingerprint sequence from the execution records after all orchestration nodes have been executed.

[0062] After all orchestration nodes in the attack scenario have been automatically executed, the execution records of all executed technical nodes in the visual orchestration canvas are read from the task database. All executed nodes are sorted in ascending order by execution timestamp. The ATT&CK tactical attribution tag, ATT&CK technical number, execution result status value, protection blocking status value, and alarm trigger status value of each node are extracted and encoded into fixed-length feature tuples. ,in The tactical affiliation label for ATT&CK is encoded as a tactical enumeration integer value. For ATT&CK technology number (preserve the original string encoding). , , These are the execution result status value, the protection blocking status value, and the alarm trigger status value (each encoded as a binary integer). or ), For the time-series index of executed nodes, the fields are concatenated in a fixed order to form a feature vector representation of equal length.

[0063] Concatenate them in chronological order to form an attack execution time fingerprint sequence. ,in This represents the total number of nodes that have actually been executed in the attack scenario. Corresponding to the The feature tuples of each executed node. The execution result status values ​​above. The data obtained after each node in the attack chain execution scheduling module of Example 1 has completed execution. Maintain consistency and protect against blocking status values Alarm trigger status value The data is consistent with the corresponding fields in the card execution status data collected in the execution monitoring and result display module, so there is no need to collect it again.

[0064] The detection capability index calculation module is configured to aggregate the attack execution time fingerprint sequence in segments according to the ATT&CK tactical phase and calculate the detection capability index vector.

[0065] Execute the timing fingerprint sequence of the attack. According to ATT&CK tactical affiliation labels Segmentation is performed, and feature tuples belonging to the same tactical phase are aggregated into a tactical segment subsequence. ,in This serves as a tactical phase identifier. Feature tuples from the same tactical phase, regardless of temporal continuity, are aggregated into the same tactical segment subsequence. In this context, it is crucial to correctly handle situations where conditional branches in the orchestration path lead to discontinuous distribution of nodes in the same tactical phase on the timeline.

[0066] For each tactical segment subsequence Calculate the following two indicators separately.

[0067] First, the blocking rate The calculation method is tactical segmented subsequence. Medium protection blocking status value The number of feature tuples accounts for a certain percentage of the tactical segmented subsequence The ratio of the total number of tuples, i.e.: ; in Representing feature tuples The protection and blocking status value, Represents tactical segmented subsequences The total number of tuples in the data. This is an indicator function.

[0068] Secondly, alarm coverage The calculation method is tactical segmented subsequence. The alarm trigger status value is The number of feature tuples accounts for a certain percentage of the tactical segmented subsequence The ratio of the total number of tuples, i.e.: ; in Representing feature tuples The alarm trigger status value.

[0069] Arrange the above calculation results in the standard order of the ATT&CK tactical phase to generate a detection capability index vector. ,in This represents the total number of tactical phases covered by the current attack scenario. This serves as an index for tactical phases, with each element arranged in the order of the ATT&CK tactical standard.

[0070] The significant change point detection module is configured to calculate the difference sequence of the detection capability index vector and detect significant change points.

[0071] For detection capability index vector The difference values ​​of the blocking rate and alarm coverage rate indicators in adjacent tactical phases are calculated to generate a blocking rate difference sequence. Alarm coverage difference sequence ,in: ; ; Apply a window width of [value] to the two difference sequences mentioned above. The sliding window mean smoothing process generates a smoothed difference sequence. and After smoothing, the first The value at each position is centered at that position and has a width of [value missing]. The arithmetic mean of the differences within the window, with existing values ​​used to fill the boundary positions; This is the preset sliding window width parameter.

[0072] Smoothed difference sequence and In the middle, the absolute value of the detection exceeds the preset attenuation threshold. Location These location points are marked as points of significant change in detection capability, and the source tactical phase label corresponding to each point of significant change is extracted. Target tactical phase tags The corresponding difference value is used as the magnitude of change, forming a set of records of significant change points. .

[0073] for tactical segmented subsequences (of which (The minimum sample size threshold is set beforehand). When outputting the detection results at points of significant change, an insufficient data volume prompt is added to remind safety operations personnel that the indicator values ​​at this stage have limited reference value.

[0074] The detection capability profile generation and write-back module is configured to generate detection capability profile data structures and write them back to the visualization orchestration canvas.

[0075] Based on detection capability index vector and a set of records of significant changes Generate a data structure for the detection capability profile of the target protection equipment. The detection capability profile includes the following three types of data.

[0076] Firstly, the radar chart data on blocking rates arranged according to the ATT&CK tactical phases, with the tactical phase label as the dimension axis and... and The values ​​in each dimension form the vertex coordinate data of the polygon radar chart.

[0077] Secondly, the detection status matrix data, which is subdivided according to the ATT&CK technology number, uses the ATT&CK technology number of the executed node as the row index and the protection blocking status and alarm trigger status as the columns, and fills in the binary status values ​​for each node to generate matrix structure data.

[0078] Third, the detection capability attenuation link data is recorded from a set of points of significant change. Each record in the data is constructed into a directed decay path based on the source tactical phase and target tactical phase label pairs, and the weight of the path edge is the absolute value of the corresponding difference value.

[0079] After serializing the three types of detection capability profile data, they are written into the corresponding orchestration scene records in the scene database. At the same time, the detection capability profile data is written back to the visualization orchestration canvas and rendered in an overlay layer manner, aligned with the original orchestration path: overlay rendering is performed in the corresponding tactical stage node areas. and The numerical labels render decay trend lines between tactical phase nodes corresponding to points of significant change, with the line thickness being positively correlated with the magnitude of change; the radar chart is rendered as a floating layer in the statistics panel area on the right side of the layout canvas.

[0080] Furthermore, based on the completion of the aforementioned detection capability profile data write-back, the detection capability profile data structure generated during the current attack scenario is aligned with the detection capability profile data of historical execution batches along the time dimension, allowing for the same protective device to be analyzed across different execution batches and tactical phases. Calculate the trend slope value of the blocking rate sequence ,in By analyzing the corresponding actions taken during each phase of this tactical phase... The trend slope is obtained by linear regression fitting of time series data; and Exceeding the preset degradation threshold The tactical phase is marked as a continuously degrading item, triggering a highlight in the corresponding tactical phase node area on the visualization orchestration canvas. A longitudinal comparative analysis report containing degradation warning information is generated. The longitudinal comparative analysis report includes the tactical phase label and degradation slope value for each continuously degrading item. The execution batch range covered and the corresponding time-series line graph data of the blocking rate.

[0081] This invention encodes the discrete states of each node after the orchestration task is completed into an attack execution time-series fingerprint sequence. It preserves the temporal relationship between the execution results of each node and the ATT&CK tactical attribution information, providing a structured data foundation for subsequent cross-stage analysis.

[0082] This invention segments and aggregates attack execution time-series fingerprint sequences according to ATT&CK tactical tags, transforming discrete node-by-node state annotations into a blocking rate index with tactical phase granularity. and alarm coverage metrics This allows the execution results, which were originally scattered across various card nodes, to be aggregated and quantified at the tactical stage level, thus providing a calculable numerical representation for cross-stage detection capability comparison.

[0083] This invention detects significant changes by calculating the difference sequence of index values ​​of adjacent tactical stages and smoothing them with the mean of a sliding window. It can automatically locate the boundaries of tactical stages where the detection capabilities of protective equipment change significantly during the attack scenario. It transforms the cross-tactical stage capability change patterns, which originally required security operations personnel to manually compare each node to perceive, into a structured record of significant change points. This solves the problem that viewing the status annotations node by node in multi-node, multi-branch attack scenarios cannot reveal the correlation changes in detection capabilities between tactical stages.

[0084] This invention writes back detection capability profile data to a visualization orchestration canvas in an overlay format, aligning tactical-stage detection capability indicators with the original orchestration path in the same view. Security operations personnel can directly observe the distribution of detection capabilities and attenuation links at each tactical stage along the attack path without switching views. Based on longitudinal comparative analysis, the automatic marking of persistent degradation items and the generation of early warning reports enable the systematic discovery of protection capability degradation trends after accumulating data from multiple batches of executions, providing traceable quantitative evidence for continuous improvement of security protection capabilities.

[0085] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. A system for visualizing, orchestrating, and automatically executing attack scenarios based on the ATT&CK framework, characterized in that, include: The scenario creation and attack case card generation module displays attack cases in a first-level category according to the tactical hierarchy of the ATT&CK framework, and in a second-level category according to attack technology items and sub-technology items. In response to user selection operations, it generates attack case card nodes in the arrangement canvas that are bound to ATT&CK technology numbers and attribute information. The conditional branching module renders red and green dots on each attack case card in the orchestration canvas. Responding to user drag-and-drop operations, it generates directed connections between the source and target cards. A red directed connection triggers a successor node when the attack case execution result of the source card is invalid, and a green directed connection triggers a successor node when the result is valid, using edge triples. Persistently store the connection topology and construct a directed graph of attack chain branches based on the execution result; The card-independent configuration module allows for independent configuration of global parameters, attacker-side proxy nodes, and victim-side proxy nodes for each attack case card. Different cards support different node combinations. The global parameter aggregation and status verification module deduplicates and merges the global parameter sets of all cards to generate a parameter aggregation mapping table, completes the distribution of parameter values ​​to each card, and performs configuration completeness verification on each card. The run button is activated only when all cards pass the verification. Attack chain execution scheduling module, constructing a directed graph The set of nodes with an in-degree of zero is used as the starting node. The task is orchestrated and executed according to the conditional branch scheduling logic, and the status value of each node is used as the basis for the execution result. Match outgoing edges of the corresponding type to determine the successor node; The execution monitoring and result display module pushes the execution status of each card node in real time through a WebSocket long connection, renders the node status differently in the orchestration canvas, and displays the verification results, protection blocking status, and alarm trigger status.

2. The system according to claim 1, characterized in that, The attack chain execution scheduling module is also configured to: obtain the task name and execution cycle filled in by the user, the execution cycle includes immediate execution once, periodic repetition execution defined by Cron expression, and scheduled execution triggered on a specified date and time, and create an orchestrated task record in the task database.

3. The attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework according to claim 1, characterized in that, The execution monitoring and result display module is also configured to: respond to the user's click on the card operation that has been completed, render the complete execution log record, original data packet information, alarm details and execution timeline. The execution timeline displays the node initialization time, attack packet sending time, result waiting time and result determination time in the form of a time axis.

4. The attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework according to claim 1, characterized in that, Also includes: The attack execution time fingerprinting module, after all orchestration nodes have been executed, sorts all executed nodes in ascending order of execution timestamp and encodes each node's ATT&CK tactical attribution tag, ATT&CK technical number, execution result status value, protection blocking status value, and alarm trigger status value into feature tuples. The sequence of timestamps is used to construct the attack execution time fingerprint. ; The detection capability index calculation module calculates the attack execution time fingerprint sequence. According to ATT&CK tactical affiliation labels Perform segmented aggregation for each tactical segment subsequence. Calculate the blocking rate separately and alarm coverage Generate detection capability index vectors according to the ATT&CK tactical phase standard sequence. ; The significant change point detection module detects the vector of detection capability indicators. The blocking rate and alarm coverage rate of adjacent tactical phases are calculated using differential sequences. and After smoothing by the mean of a sliding window, if the absolute value exceeds a preset decay threshold... The location points form a set of records of significant changes. ; The detection capability profile generation and write-back module is based on detection capability index vectors. and a set of records of significant changes Generate a detection capability profile data structure, and write it back to the visualization layout canvas in an overlay layer manner for rendering, aligning it with the original layout path.

5. The attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework according to claim 4, characterized in that, In the detection capability index calculation module, the blocking rate and alarm coverage The calculation methods are as follows: ； ； in For characteristic tuples The protection and blocking status value, For characteristic tuples The alarm trigger status value, Tactical segmentation subsequence The total number of tuples in the data. For the total number of tuples, it is an indicator function; Less than the preset minimum sample size threshold The tactical segmented subsequences are output with an insufficient data warning.

6. The attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework according to claim 4, characterized in that, In the significant change point detection module, the difference sequence is calculated as follows: ； in For tactical phase indexing; apply a window width of [value] to the difference sequence. The sliding window mean smoothing process is applied, and the smoothed 1st... The value at each position is centered at that position and has a width of [value missing]. The arithmetic mean of the differences within the window, with existing values ​​used to fill the boundary positions.

7. The attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework according to claim 4, characterized in that, The detection capability profile data structure includes: a dimension axis based on tactical phase labels, and a dimension axis based on... and The data includes: radar charts of blocking rates for various dimensions; a detection status matrix indexed by ATT&CK technology numbers and columns for protection blocking status and alarm triggering status; and a set of records of significant changes. Each record is a directed decay path data formed by the source tactical phase and target tactical phase label pairs, and the path edge weight is the absolute value of the corresponding difference value.

8. The attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework according to claim 4, characterized in that, The detection capability profile generation and write-back module is also configured to: align the detection capability profile data of the current execution batch with the detection capability profile data of historical execution batches along the time dimension, and perform the same protection device across different execution batches and tactical phases. Linear regression was performed on the blockage rate sequence to obtain the trend slope value. ;Will and Exceeding the preset degradation threshold The tactical phase is marked as a continuously degrading item, triggering a highlight annotation in the corresponding tactical phase node area of ​​the arrangement canvas, and generating a longitudinal comparative analysis report containing degradation warning information.

9. The attack scenario visualization orchestration and automatic execution system based on the ATT&CK framework according to claim 1, characterized in that, The parameter aggregation mapping table generated by the global parameter aggregation and status verification module uses the parameter name as the key and the parameter description, data type, and a list of card identifiers related to the parameter as the value. For cases where the same type of parameter needs to be configured with different values ​​in different cards, the configuration row of the parameter is displayed separately by card dimension in the summary configuration interface, and the independent values ​​filled in by the user for each card are obtained and written to the corresponding records.

10. A method for visualizing, orchestrating, and automatically executing attack scenarios based on the ATT&CK framework, used to execute the attack scenario visualizing, orchestrating, and automatically executing system based on the ATT&CK framework as described in any one of claims 1 to 9, characterized in that, include: Step 1: Display attack cases in a first-level category according to the tactical hierarchy of the ATT&CK framework, and in a second-level category according to attack technology items and sub-technology items. In response to user selection, generate attack case card nodes in the arrangement canvas that are bound to ATT&CK technology numbers and attribute information. Step 2: In response to the user's drag operation, generate a red or green directed line between the source card and the target card, using edge triples. Persistently store the connection topology and construct a directed graph of attack chain branches based on the execution result; Step 3: Configure global parameters, attacker-side proxy nodes, and victim-side proxy nodes independently for each attack case card; Step 4: Deduplicatively merge the global parameter sets of all cards to generate a parameter aggregation mapping table, complete the distribution of parameter values ​​to each card, and perform configuration completeness verification on each card. The run button is activated only when all cards pass the verification. Step 5, construct the directed graph The set of nodes with an in-degree of zero is used as the starting node. The task is orchestrated and executed according to the conditional branch scheduling logic, and the status value of each node is used as the basis for the execution result. Match outgoing edges of the corresponding type to determine the successor node; Step 6: Push the execution status of each card node in real time through a WebSocket long connection, render the node status differently in the orchestration canvas, and display the verification results, protection blocking status and alarm trigger status.

Images