Multi-level multi-dimensional attack effect evaluation method and system based on atomic index decomposition

Abstract

This invention discloses a multi-level, multi-dimensional attack effectiveness evaluation method and system based on atomic index decomposition, belonging to the field of network security technology. The system includes a network security testbed, a data acquisition unit, a data analysis unit, an attack effectiveness evaluation unit, a data storage unit, and a data preprocessing unit. The network security testbed is communicatively connected to the data acquisition unit, the data acquisition unit is communicatively connected to the data analysis unit, and the data analysis unit is communicatively connected to the attack effectiveness evaluation unit. The data acquisition unit, data analysis unit, and attack effectiveness evaluation unit are each communicatively connected to the data storage unit. This invention reduces each network attack from a broad scope to a specific point, and then further decomposes the point into hierarchical and dimensional components, thereby enabling a more granular and precise evaluation of the network attack's effectiveness.

Description

Technical Field

[0001] This invention relates to the field of network security technology. Specifically, it relates to a multi-level, multi-dimensional attack effectiveness evaluation method and system based on atomic index decomposition. Background Technology

[0002] Cybersecurity attacks are inherently unpredictable: 1) Multiple attack methods can be employed to achieve the same level of effectiveness; 2) Similar attack methods can produce the same effect, but with different configuration options; 3) The responses of the targets to the attacks are also not the same.

[0003] Attacks often occur when the attacker and defender are unequal in terms of time, space, and other aspects, making it difficult to trace the source afterward. Since the two sides rarely overlap, discrepancies in their understanding of the attack's effects and impacts always exist (this is unavoidable). Current attack effectiveness assessments are relatively simple: they only assess the severe consequences for the attacked target, such as being controlled or paralyzed—a one-dimensional approach (either good or bad). They lack a clear description of the intermediate process, progress, and measurable values. Finding a measurable assessment method that allows for intuitive understanding of the current situation would be of great help to both the attacker and defender.

[0004] Cybersecurity test range platforms, as redundant and reconfigurable simulation platforms for real-world cyberspace, can construct attack environments, monitor attack paths, and collect and analyze attack traffic. In other words, they can simulate real-world attack events, conduct detailed analysis, and adjust variables during the attack process. In a sense, they can exhaust all possibilities, providing a reference for evaluating the effectiveness of current cyberattacks and defenses, and offering suggestions for future protection. Summary of the Invention

[0005] Therefore, the technical problem to be solved by the present invention is to provide a multi-level and multi-dimensional attack effect evaluation method and system based on atomic index decomposition. By reducing each network attack from a surface to a point, and then splitting the point into levels and dimensions, the effect evaluation of network attacks can be carried out at a finer and more accurate granularity.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] A multi-level, multi-dimensional attack effectiveness evaluation method based on atomic index decomposition includes the following steps:

[0008] S1) Data0 is collected in real time at the contact points between the simulated network attack and the network security range when conducting simulated network attacks on the network security range; wherein, the network security range is constructed based on real network attack events, and the contact points include regular contact points and key contact points;

[0009] S2) Use the data information Data0 collected in step S1) to form a complete data description surface for simulating network attacks;

[0010] S3) Perform multi-level and multi-dimensional decomposition and analysis on the overall data description surface formed in step S2) according to the preset simulated network attack indicators; wherein, the simulated network attack indicators include more than or equal to 2 primary indicators, each primary indicator includes more than or equal to 2 secondary indicators, and each secondary indicator includes more than or equal to 2 tertiary indicators.

[0011] S4) Calculate the attack effect evaluation value of the superior indicator based on the weight of each subordinate indicator in the superior indicator and the attack effect evaluation value of each subordinate indicator, and obtain the final attack effect evaluation value.

[0012] The aforementioned multi-level, multi-dimensional attack effectiveness evaluation method based on atomic index decomposition has different data collection rules for regular contact points and key contact points.

[0013] The above-mentioned multi-level and multi-dimensional attack effect evaluation method based on atomic index decomposition pre-sets the data collection rules for the contact point when collecting data information Data0, in cases where there are multiple rules for data collection at the contact point.

[0014] The above-mentioned multi-level and multi-dimensional attack effect evaluation method based on atomic index decomposition, when conducting simulated network attacks, if there are multiple attack lines in the simulated network attack, will attack them one by one until the entire simulated network attack is completed.

[0015] In the above-mentioned multi-level and multi-dimensional attack effect evaluation method based on atomic index decomposition, in step S3), when performing multi-level and multi-dimensional decomposition analysis on the overall data description surface, the sample data of simulated network attacks are decoupled from specific scenarios.

[0016] In the above-mentioned multi-level and multi-dimensional attack effect evaluation method based on atomic index decomposition, the attack effect evaluation values ​​of different levels of index items are calculated using different algorithms in step S4).

[0017] The aforementioned multi-level, multi-dimensional attack effectiveness evaluation method based on atomic index decomposition, when conducting simulated network attacks, if changes occur in the building elements of the network security test range, resulting in the inability to collect data information for a certain index item in the simulated network attack, then the applicability of that index item is adjusted to make it universally applicable to network attacks; otherwise, new data collection rules are set.

[0018] The aforementioned multi-level and multi-dimensional attack effect evaluation method based on atomic index decomposition constructs a complete set of attack paths, attack steps, and attack methods when performing multi-level and multi-dimensional decomposition and analysis of the overall data description surface. Then, it calculates the relative metric values ​​of attack steps and attack paths based on the index items of attack steps, and finally forms the global attack metric value of the network security test range instance.

[0019] A system for evaluating network attack effectiveness using the aforementioned multi-level, multi-dimensional attack effectiveness evaluation method based on atomic index decomposition includes:

[0020] A cybersecurity range is used to conduct simulated cyberattacks.

[0021] The data acquisition unit is used to collect contact point data information (Data0) between simulated network attacks and network security test ranges.

[0022] The data analysis unit is used to form an overall data description surface for simulating network attacks using data information Data0, and to decompose and analyze the formed overall data description surface.

[0023] The attack effectiveness evaluation unit is used to evaluate the attack effectiveness by utilizing the analysis results from the data analysis unit.

[0024] The data storage unit is used to store the contact point data information Data0 collected by the data acquisition unit, the analysis results of the data analysis unit, and the evaluation results of the attack effect evaluation unit.

[0025] The cybersecurity test range is connected to the data acquisition unit, the data acquisition unit is connected to the data analysis unit, and the data analysis unit is connected to the attack effect evaluation unit; the data acquisition unit, the data analysis unit, and the attack effect evaluation unit are each connected to the data storage unit.

[0026] The system also includes a data preprocessing unit that preprocesses the contact point data information Data0. The data preprocessing unit is communicatively connected to the data acquisition unit, the data analysis unit, and the data storage unit. The preprocessing of the contact point data information Data0 includes data cleaning.

[0027] The technical solution of the present invention achieves the following beneficial technical effects:

[0028] 1. In a cybersecurity test environment, there is a deeper understanding and awareness of attacks on incidents; it is no longer limited to whether they are successful or not; but rather the stage / position at which the attack stops, and the effectiveness of each stage (3 attempts to brute-force the password, 1 successful), described using multiple indicators such as qualitative and quantitative methods.

[0029] 2. The assessment has better applicability and can be adapted to the environment of cybersecurity test ranges for adjustment / optimization. It compares and displays the changes in the impact of environmental variables on the assessment results, making it more valuable. Attached Figure Description

[0030] Figure 1 This is a schematic diagram illustrating the working principle of the multi-level, multi-dimensional attack effectiveness evaluation system based on atomic index decomposition of the present invention.

[0031] Figure 2 This is a flowchart illustrating the multi-level, multi-dimensional attack effectiveness evaluation based on atomic index decomposition in this invention. Detailed Implementation

[0032] The present invention will be further explained below with reference to examples.

[0033] like Figure 1 The multi-level, multi-dimensional attack effect evaluation system based on atomic index decomposition in this invention includes a network security test range, a data acquisition unit, a data analysis unit, an attack effect evaluation unit, a data storage unit, and a data preprocessing unit. The network security test range is communicatively connected to the data acquisition unit, the data acquisition unit is communicatively connected to the data analysis unit, and the data analysis unit is communicatively connected to the attack effect evaluation unit. The data acquisition unit, the data analysis unit, and the attack effect evaluation unit are each communicatively connected to the data storage unit, and the data preprocessing unit is communicatively connected to the data acquisition unit, the data analysis unit, and the data storage unit.

[0034] In this invention, a network security test range is used to simulate network attacks; a data acquisition unit is used to acquire contact point data information Data0 between the simulated network attack and the network security test range; a data analysis unit is used to use the data information Data0 to form an overall data description surface of the simulated network attack and to decompose and analyze the formed overall data description surface; an attack effect evaluation unit is used to evaluate the attack effect using the decomposition and analysis results of the data analysis unit; a data storage unit is used to store the contact point data information Data0 acquired by the data acquisition unit, the analysis results of the data analysis unit, and the evaluation results of the attack effect evaluation unit; and a data preprocessing unit is used to preprocess the contact point data information Data0, wherein the preprocessing of the contact point data information Data0 includes data cleaning.

[0035] Cyberattacks typically target vulnerabilities or points of high data exchange in a target system as entry points. These points are the points of contact between the cyberattack and the target system, or the points of contact between a simulated cyberattack and a cybersecurity testbed. Some of these points are the primary attack points or key cybersecurity points simulated in the testbed, known as critical contact points. When launching a cyberattack on a target system, attackers may differ in speed, frequency, and methods when targeting critical and regular contact points. Therefore, by refining the cyberattacks against critical and regular contact points in multiple dimensions and levels, not only can targeted defenses be implemented, but the effectiveness of cyberattacks can also be accurately evaluated. Based on this, this invention classifies the points of contact between cyberattacks and the cybersecurity testbed and sets multiple indicators and different data collection rules for the data generated when different contact points are attacked, enabling the evaluation of cyberattack effectiveness at the most basic level—the atomic level.

[0036] like Figure 2 As shown, when using the multi-level, multi-dimensional attack effectiveness evaluation system based on atomic index decomposition in this invention to evaluate the attack effectiveness of network attacks, the following steps are taken:

[0037] S1) Data0 is collected in real time at the contact points between the simulated network attack and the network security range when conducting simulated network attacks on the network security range; wherein, the network security range is constructed based on real network attack events, and the contact points include regular contact points and key contact points;

[0038] S2) Use the data information Data0 collected in step S1) to form a complete data description surface for simulating network attacks;

[0039] S3) Perform multi-level and multi-dimensional decomposition and analysis on the overall data description surface formed in step S2) according to the preset simulated network attack indicators; wherein, the simulated network attack indicators include more than or equal to 2 primary indicators, each primary indicator includes more than or equal to 2 secondary indicators, and each secondary indicator includes more than or equal to 2 tertiary indicators.

[0040] S4) Calculate the attack effect evaluation value of the superior indicator based on the weight of each subordinate indicator in the superior indicator and the attack effect evaluation value of each subordinate indicator, and obtain the final attack effect evaluation value.

[0041] To reduce system load, different data collection rules can be set for different types of contact points. This allows for the acquisition of data with different focuses, resulting in data that is more relevant to the contact point type. This makes the subsequent attack effect assessment more closely reflect the actual situation. Based on this, the data collection rules for conventional contact points are different from those for critical contact points in this invention.

[0042] When evaluating the effectiveness of different network attacks, data collection from the same contact point may involve collecting different types and quantities of data. Therefore, multiple data collection rules are preset for the same contact point. However, when evaluating the effectiveness of a specific network attack, if there are multiple data collection rules for the contact point, the data collection rules for the contact point are pre-set when collecting data information Data0.

[0043] Meanwhile, when conducting simulated network attacks, if changes occur to the building elements of the network security range, resulting in the inability to collect data for a certain indicator of the simulated network attack, the applicability of that indicator will be adjusted to make it universally applicable to network attacks; otherwise, new data collection rules will be set.

[0044] Because different network attacks have different attack patterns or strategies, their attack paths differ. Some network attacks have only one attack path, while others have multiple attack paths. Therefore, in this invention, when simulating a network attack, if the simulated network attack has multiple attack paths, each path is attacked sequentially until the entire simulated network attack is completed, ensuring a comprehensive evaluation of the simulated network attack.

[0045] The targets of the same type of network attack may belong to different application scenarios, and there may be significant differences between different application scenarios. If the unique characteristics of the application scenario are not eliminated, the evaluation of the network attack effect will have the unique characteristics of the specific scenario. Therefore, in step S3), when performing multi-level and multi-dimensional decomposition and analysis of the overall data description surface, the sample data of simulated network attacks are decoupled from the specific scenario. This can reduce the number of scenario simulations when evaluating the attack effect of a certain network attack, thereby reducing the number of network security test ranges to be built, and correspondingly reducing the number of simulated network attacks.

[0046] Furthermore, when performing multi-level and multi-dimensional decomposition and analysis of the overall data description surface, a complete set of attack paths, attack steps, and attack methods are constructed. Then, based on the indicator items of the attack steps, the relative metric values ​​of the attack steps and attack paths are calculated, and then the global attack metric value of the network security test range instance is formed.

[0047] When evaluating the effectiveness of network attacks using the multi-level, multi-dimensional attack effectiveness evaluation system based on atomic index decomposition as described in this invention, a strategy of knowledge guidance, feedback optimization, and dynamic adjustment can be adopted to establish an adaptive selection mechanism for the attack effectiveness evaluation model based on this invention, thereby improving the accuracy of the attack effectiveness evaluation. In this invention, by performing multi-level, multi-dimensional decomposition analysis on network attacks targeting contact points, multiple functional attributes, multiple atomic functions, multiple evaluation indicators, and multiple collection indicators can be constructed. The attack effectiveness evaluation model based on the multi-level, multi-dimensional attack effectiveness evaluation system based on atomic index decomposition as described in this invention, which is currently in use, has constructed a hierarchical attack effectiveness evaluation indicator system with 19 functional attributes, 87 atomic functions, 195 evaluation indicators, and 290 collection indicators. It has implemented 37 evaluation algorithm plugins and can perform qualitative and quantitative effectiveness evaluations of more than 10 types of network attacks, including information detection, intrusion control, and denial-of-service attacks, providing scientific and accurate evaluation results and analysis data. By performing multi-level and multi-dimensional analysis of network attack behaviors and the data generated during the execution of network attacks, the multi-level and multi-dimensional attack effect evaluation system based on atomic index decomposition in this invention can more accurately evaluate the attack effect of network attacks.

[0048] Specifically, when evaluating the effectiveness of a network attack on a certain contact point, if the listed indicators based on existing knowledge cannot accurately describe or score the attack effectiveness, the listed indicators are broken down to obtain the next level of indicators. Priority is given to breaking down key indicators. For example, if the attack process involves a key contact point, primary indicators such as attack indicators, speed indicators, stealth indicators, technical complexity indicators, and task completion status indicators are set for that key contact point. Then, the key indicators are further broken down. For example, for attack indicators, multiple secondary indicators such as information acquisition, initial breakthrough, privilege escalation, lateral movement, defense avoidance, and persistent control are set. Then, for information acquisition indicators, tertiary indicators such as network detection, operating system identification, and application identification are set. Finally, for network detection, quaternary indicators such as port detection and service detection can be set.

[0049] To avoid the accumulation or amplification of errors in the attack effect evaluation value due to imperfect algorithms or other factors (such as offsets or deviations in relevant parameters), this invention uses different algorithms to calculate the attack effect evaluation value for different levels of indicators.

[0050] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of the claims of this application.

Claims

1. A multi-level, multi-dimensional attack effectiveness evaluation method based on atomic index decomposition, characterized in that, Includes the following steps: S1) Data0 is collected in real time at the contact points between the simulated network attack and the network security range when conducting simulated network attacks on the network security range; wherein, the network security range is constructed based on real network attack events, and the contact points include regular contact points and key contact points; S2) Use the data information Data0 collected in step S1) to form a complete data description surface for simulating network attacks; S3) Perform multi-level and multi-dimensional decomposition and analysis on the overall data description surface formed in step S2) according to the preset simulated network attack indicators; wherein, the simulated network attack indicators include more than or equal to 2 primary indicators, each primary indicator includes more than or equal to 2 secondary indicators, and each secondary indicator includes more than or equal to 2 tertiary indicators. S4) Calculate the attack effect evaluation value of the superior indicator based on the weight of each subordinate indicator in the superior indicator and the attack effect evaluation value of each subordinate indicator, and obtain the final attack effect evaluation value.

2. The multi-level, multi-dimensional attack effect evaluation method based on atomic index decomposition according to claim 1, characterized in that, The data acquisition rules for regular contact points are different from those for critical contact points.

3. The multi-level, multi-dimensional attack effect evaluation method based on atomic index decomposition according to claim 1, characterized in that, When there are multiple rules for data acquisition at the contact point, the data acquisition rules for the contact point are preset when acquiring data information Data0.

4. The multi-level, multi-dimensional attack effect evaluation method based on atomic index decomposition according to claim 2, characterized in that, When conducting a simulated network attack, if there are multiple attack lines, they are attacked one by one until the entire simulated network attack is completed.

5. The multi-level, multi-dimensional attack effect evaluation method based on atomic index decomposition according to claim 1, characterized in that, In step S3), when performing multi-level and multi-dimensional decomposition and analysis on the overall data description surface, the sample data of the simulated network attack is decoupled from the specific scenario.

6. The multi-level, multi-dimensional attack effect evaluation method based on atomic index decomposition according to claim 1, characterized in that, In step S4), different algorithms are used to calculate the attack effect evaluation value of different levels of indicator items.

7. The multi-level, multi-dimensional attack effect evaluation method based on atomic index decomposition according to claim 1, characterized in that, When conducting simulated network attacks, if changes occur to the building elements of the network security range, resulting in the inability to collect data for a certain indicator of the simulated network attack, the applicability of that indicator will be adjusted; otherwise, new data collection rules will be set.

8. The multi-level, multi-dimensional attack effect evaluation method based on atomic index decomposition according to claim 1, characterized in that, When performing multi-level and multi-dimensional decomposition and analysis of the overall data description surface, a complete set of attack paths, attack steps, and attack methods are constructed. Then, based on the indicator items of the attack steps, the relative metric values ​​of the attack steps and attack paths are calculated, and the global attack metric value of the network security test range instance is formed.

9. A system for evaluating network attack effectiveness using the multi-level, multi-dimensional attack effectiveness evaluation method based on atomic index decomposition as described in claim 1, characterized in that, include: A cybersecurity range is used to conduct simulated cyberattacks. The data acquisition unit is used to collect contact point data information (Data0) between simulated network attacks and network security test ranges. The data analysis unit is used to form an overall data description surface for simulating network attacks using data information Data0, and to decompose and analyze the formed overall data description surface. The attack effectiveness evaluation unit is used to evaluate the attack effectiveness by utilizing the analysis results from the data analysis unit. The data storage unit is used to store the contact point data information Data0 collected by the data acquisition unit, the analysis results of the data analysis unit, and the evaluation results of the attack effect evaluation unit. The cybersecurity test range is connected to the data acquisition unit, the data acquisition unit is connected to the data analysis unit, and the data analysis unit is connected to the attack effect evaluation unit; the data acquisition unit, the data analysis unit, and the attack effect evaluation unit are each connected to the data storage unit.

10. The system according to claim 9, characterized in that, It also includes a data preprocessing unit for preprocessing contact point data information Data0, which is communicatively connected to the data acquisition unit, the data analysis unit, and the data storage unit; the preprocessing of contact point data information Data0 includes data cleaning.

Images