222 results about "Attack graph" patented technology

The invention relates to the field of security surveying and mapping, in particular to a network security space surveying and mapping method, system and device based on multi-source data fusion, and the method comprises the steps: obtaining network security data in real time, and constructing a dynamic network topological graph; calculating a time-varying vulnerability score based on the topological graph and a historical attack log, and predicting an attack path and a propagation probability through a Bayesian network; performing cross-domain fusion on equipment, service and user behavior characteristics by adopting a federated learning framework to generate a dynamic asset portrait; generating a risk thermodynamic diagram in combination with spatial autocorrelation analysis and a multi-index fusion algorithm; a defense strategy effect is simulated based on an attack graph reconstruction engine, a Pareto optimal strategy combination is generated through an NSGA-II algorithm, and closed-loop verification and dynamic parameter correction are realized by utilizing honeypot deployment and flow traction. Therefore, the problems of topology update lag, single risk assessment dimension, cross-domain threat association fracture, defense strategy static stiffness, non-closed loop of a verification system and the like in the traditional technology are solved.

The invention discloses an automatic penetration test method, system and device based on deep reinforcement learning, and a medium, and the method comprises the steps: carrying out the vulnerability scanning and baseline verification of a device through employing a vulnerability scanning and baseline verification tool, and obtaining the vulnerability information of a tested system; generating an attack graph according to the obtained vulnerability information, determining a vulnerability utilization probability according to the vulnerability information, and assigning values to edges of the attack graph to obtain a Bayesian attack graph; designing an attacker target node reward value on the generated Bayesian attack graph, simulating a possible attack behavior of an attacker, and calculating an attack strategy of the attacker by using a deep reinforcement learning method; simulating potential attack behaviors of an attacker in the attack graph according to an attack strategy, and generating a penetration attack path which is most likely to be adopted by the attacker; and performing an automatic penetration test to generate a penetration test report. According to the invention, the penetration test scheme can be intelligently generated according to the vulnerability of the system, and the precision and efficiency of network security evaluation are greatly improved.

The invention discloses a network traceability data processing method, system and device and a medium, and the method comprises the steps: collecting network data, carrying out the preprocessing of the network data, and generating the preprocessed network data; extracting behavior characteristics from the preprocessed network data to obtain network behavior characteristics; constructing an attack graph according to the obtained network behavior characteristics, and forming a dynamic graph representing an attack path; and carrying out traceability decision on the dynamic atlas, and positioning an attack source and an attack path through the traceability decision. Through the technical means of six-dimensional feature vector construction, quantum derivation genetic algorithm optimization detection and attack atlas construction through the tense graph convolutional network, the problems of data dimension missing, correlation analysis lagging and insufficient traceability precision are effectively solved.

The invention provides a knowledge graph-based security event automatic response method, which comprises the following steps of: acquiring multi-source security data, performing de-duplication and standardization processing, and generating a structured security data set; based on the network security ontology model, entities and relationships are extracted from the data set, and a security knowledge graph is constructed through entity alignment and conflict resolution; according to ATTamp; the CK framework divides network subnets, generates attack path diagrams of the subnets, and fuses the attack path diagrams into a global attack graph. Then, abnormal behavior nodes in the security knowledge graph are analyzed, and risk scores of the service layer, the host layer and the system layer are calculated in combination with the global attack graph; and matching a predefined response strategy library based on the risk scores, executing operations such as banning an IP (Internet Protocol), isolating a host or updating firewall rules and the like through an SOAR platform, generating a disposal report and updating a security knowledge graph. According to the invention, the network security event processing efficiency and accuracy can be improved, and the overall security protection capability of the system is enhanced.

The invention discloses a multi-class network security threat perception and active and passive cooperative response processing system and method, and the system comprises a multi-class threat perception module which is used for perceiving a plurality of security threats existing in a network environment, and transmitting an obtained security event to a threat information association module; the threat information association module is used for analyzing and integrating various security events and extracting threat information from the security events; the attack graph-based threat path analysis module is used for mining vulnerability information in a network system, describing a network topology structure and an operation state, constructing an attack graph and obtaining active defense nodes in combination with a currently occurring security event and an analysis result of the attack graph; and the strategy generation module generates a corresponding response processing strategy according to the threat information and the property and the emergency degree of the security event, and generates an active defense strategy in combination with the active defense node, thereby realizing active defense and advanced deployment and control of potential threats. According to the invention, network security threats can be timely and effectively found and coped with.

The invention discloses a network security protection method and system based on a digital twin technology, belongs to the technical field of network security, and is used for solving the technical problems that an attack graph adopted by an existing network risk assessment method has limitation, vulnerability repair and defense depend on experience, and the effectiveness of a defense means is difficult to verify. The method comprises the following steps: constructing a network vulnerability dynamic knowledge graph based on multi-source network vulnerability information; acquiring real-time vulnerability information of the target network, and constructing an attribute attack graph of the target network according to the real-time vulnerability information and the dynamic knowledge graph; expanding the attribute attack graph based on the dynamic knowledge graph to obtain an expanded attribute attack graph; determining a predicted attack path according to the extended attribute attack graph; the attack complexity of the attack path is deduced and predicted in the digital twin model, and a defense strategy is determined according to the attack complexity level; and carrying out validity verification on the defense strategy, and feeding back the defense strategy passing the verification to the network node in the predicted attack path.

The invention relates to the technical field of risk management, and discloses an asset and risk management-oriented dynamic risk visual management method, which comprises the following steps of: automatically scanning to obtain asset information in a network, and classifying assets; based on the asset information, determining a connection relationship between assets, and constructing a network topology structure diagram; based on a vulnerability database, vulnerabilities existing in the assets are analyzed, an attack graph is generated, and a preset attack path is determined; analyzing a preset attack path to determine an attack path in combination with the network flow data and an attack technique; evaluating the security defense system in the attack path by using a simulated attack technology, and determining the defense efficiency; based on augmented reality and virtual reality technologies, vulnerabilities, attack paths and defense efficiency of each asset are dynamically displayed on a network topology structure diagram. The invention provides an efficient, intuitive and dynamic risk visualization management method by combining various technologies, and the asset management and risk response capabilities can be remarkably improved.

The invention discloses a computer network security threat real-time monitoring method and system, and relates to the technical field of network security, and the method comprises the steps: collecting and preprocessing multi-source network data, organizing the multi-source network data into a behavior sequence according to a time sequence, and forming time sequence behavior data for analysis; constructing an attack atlas based on the preprocessed multi-source network data, and in the atlas construction process, forming dynamic representation of the attack atlas in combination with time attributes of behavior events and inter-entity contexts; time sequence behavior data are input into an RCLNet architecture for analysis, the RCLNet extracts spatial features through CNN, the LSTM captures time features, key behavior features are concerned by using an adaptive attention mechanism, and a high-dimensional behavior embedding vector is generated. High-precision and real-time detection and response to network threats are realized, and the intelligence and actual combat adaptability of the system are greatly improved.

The invention provides a cloud environment active defense system based on dynamic honey spots. The system comprises a honey spot deployment and management module which generates and deploys honey spots, manages honey spot layout and provides honey spot information; the dynamic defense control module monitors network flow, perceives an attack path, analyzes attack behavior characteristics, adjusts honey point layout, generates an adjustment instruction and generates alarm information according to the attack behavior characteristics; the attack chain tracking and analyzing module is used for acquiring attack event data for attack behavior tracking, constructing an attack graph for attack path analysis and attack intention prediction and generating a threat intelligence report; and the system integration and management module monitors the running state and the resource use condition of each module, dynamically distributes system computing resources, and sets an interaction unit to provide interaction. According to the system, a complete deception defense mechanism is constructed, a deception environment is constructed by utilizing honey points, the honey points are dynamically adjusted according to attacks, and quick response and accurate countering are ensured through a flexible defense strategy and multi-layer cooperation.

Implementations include receiving graph data representative of a process-aware analytical attack graph (AAG) representing paths within an enterprise network with respect to observed facts of the enterprise network, the process-aware AAG at least partially defining a digital twin of the enterprise network, receiving data indicating at least one non-observed fact of the enterprise network, generating, from the graph data and the received data, an augmented process-aware AAG representing paths within the enterprise network with respect to the observed facts and the at least one non-observed fact, determining, by a process-aware risk assessment module, a risk assessment based on the augmented process-aware AAG, and providing, by a mitigation simulator module, a mitigation list based on the process-aware AAG and the risk assessment, the mitigation list comprising a prioritized list of observed facts of the process-aware AAG.

The invention discloses an electric power production data private network security situation awareness system and method. The method comprises the following steps: 1) acquiring security data of an electric power production data private network in real time; 2) standardizing the acquired data; 3) constructing a power grid entity relation graph, and fusing the standardized data obtained in the step 2) into the graph; 4) constructing an attack graph, and associating the attack graph with the power grid equipment entity relationship graph; 5) combining the power grid entity relation graph with the attack graph, performing deep correlation analysis, and identifying potential attacks in the power grid; 6) generating a grade risk alarm according to an identification result in the step 5), and triggering corresponding countermeasures; and 7) simulating the defense measures in the step 6), and optimizing and adjusting the defense countermeasures according to a feedback result. According to the method, the multi-source data is combined with the dynamic knowledge graph technology, real-time correlation analysis of the power grid entity relationship and the attack behavior is supported, and the recognition capability of novel attacks is remarkably improved.

The invention discloses an enterprise network weak password evaluation method based on a logic attack graph and password evaluation, which comprises the following steps: firstly, collecting a network topology structure, a security policy and system configuration of an enterprise intranet, and combining ATTamp; according to the inference rule mapped by the CK knowledge base, logical inference is carried out by using a MulVAL tool to obtain a logical attack graph; then acquiring system account password information of each host, calculating password entropy and simulating password blasting time evaluation to obtain a password risk value; then, the password risk value is associated and combined with the logic attack graph, and a new weighted attack graph containing the password risk value is generated; identifying an attack starting point and an attack target point in the attack graph with the weight at the same time; traversing all attack paths in the weighted attack graph by using a depth-first search algorithm, and calculating a weak password risk value on each attack path; and finally, taking the attack path with the highest weak password risk value as an optimal attack path, generating and visualizing, and improving the network security defense level of an enterprise.

The invention discloses a network security analysis early warning system based on artificial intelligence, and relates to the technical field of network security, and the system comprises the following steps: S1, constructing a multi-dimensional state table based on original traffic features; s2, generating an attack graph based on a causal relationship by using the state table; s3, extracting a topological evolution path by using an attack graph; s4, performing joint mode mapping by using the state table and the risk path; and S5, performing neural discriminant embedding modeling by using the composite risk event set. Through setting the attack graph based on the causal relationship, the technology significantly improves the integrity of risk propagation condition modeling, and lays a more stable data foundation for intelligent early warning of network security risk propagation. The joint modeling overcomes the problems of insufficient data granularity and incomplete application conditions caused by only depending on adjacency relation or simple condition judgment in the prior art, and can more clearly describe the internal relation between conditions when risk propagation occurs.

The invention provides an attack fault tree security risk assessment system based on deep reinforcement learning, and relates to the technical field of information security. The system specifically comprises a network asset data fingerprint scanner module, a deep reinforcement learning network model generation and training module and an automatic penetration test tool set module. The invention aims to determine the optimal attack path from the system attack graph by using deep reinforcement learning. By combining the screened attack paths with various resources and time costs encountered in the actual penetration test, the failure rates of various security risks in the attack fault tree, the success probabilities of various attacks and other indexes can be determined. And finally, establishing an attack fault tree of a power system scene in the embodiment, comparing the attack lethality and the detection capability level of each attack path in a game phase, and qualitatively and quantitatively analyzing the final security capability level of the target system and the damage degree caused by attacks.