179 results about "Attack graph" patented technology

The invention relates to the field of security surveying and mapping, in particular to a network security space surveying and mapping method, system and device based on multi-source data fusion, and the method comprises the steps: obtaining network security data in real time, and constructing a dynamic network topological graph; calculating a time-varying vulnerability score based on the topological graph and a historical attack log, and predicting an attack path and a propagation probability through a Bayesian network; performing cross-domain fusion on equipment, service and user behavior characteristics by adopting a federated learning framework to generate a dynamic asset portrait; generating a risk thermodynamic diagram in combination with spatial autocorrelation analysis and a multi-index fusion algorithm; a defense strategy effect is simulated based on an attack graph reconstruction engine, a Pareto optimal strategy combination is generated through an NSGA-II algorithm, and closed-loop verification and dynamic parameter correction are realized by utilizing honeypot deployment and flow traction. Therefore, the problems of topology update lag, single risk assessment dimension, cross-domain threat association fracture, defense strategy static stiffness, non-closed loop of a verification system and the like in the traditional technology are solved.

The invention discloses a network traceability data processing method, system and device and a medium, and the method comprises the steps: collecting network data, carrying out the preprocessing of the network data, and generating the preprocessed network data; extracting behavior characteristics from the preprocessed network data to obtain network behavior characteristics; constructing an attack graph according to the obtained network behavior characteristics, and forming a dynamic graph representing an attack path; and carrying out traceability decision on the dynamic atlas, and positioning an attack source and an attack path through the traceability decision. Through the technical means of six-dimensional feature vector construction, quantum derivation genetic algorithm optimization detection and attack atlas construction through the tense graph convolutional network, the problems of data dimension missing, correlation analysis lagging and insufficient traceability precision are effectively solved.

The invention provides a knowledge graph-based security event automatic response method, which comprises the following steps of: acquiring multi-source security data, performing de-duplication and standardization processing, and generating a structured security data set; based on the network security ontology model, entities and relationships are extracted from the data set, and a security knowledge graph is constructed through entity alignment and conflict resolution; according to ATTamp; the CK framework divides network subnets, generates attack path diagrams of the subnets, and fuses the attack path diagrams into a global attack graph. Then, abnormal behavior nodes in the security knowledge graph are analyzed, and risk scores of the service layer, the host layer and the system layer are calculated in combination with the global attack graph; and matching a predefined response strategy library based on the risk scores, executing operations such as banning an IP (Internet Protocol), isolating a host or updating firewall rules and the like through an SOAR platform, generating a disposal report and updating a security knowledge graph. According to the invention, the network security event processing efficiency and accuracy can be improved, and the overall security protection capability of the system is enhanced.

The invention discloses a multi-class network security threat perception and active and passive cooperative response processing system and method, and the system comprises a multi-class threat perception module which is used for perceiving a plurality of security threats existing in a network environment, and transmitting an obtained security event to a threat information association module; the threat information association module is used for analyzing and integrating various security events and extracting threat information from the security events; the attack graph-based threat path analysis module is used for mining vulnerability information in a network system, describing a network topology structure and an operation state, constructing an attack graph and obtaining active defense nodes in combination with a currently occurring security event and an analysis result of the attack graph; and the strategy generation module generates a corresponding response processing strategy according to the threat information and the property and the emergency degree of the security event, and generates an active defense strategy in combination with the active defense node, thereby realizing active defense and advanced deployment and control of potential threats. According to the invention, network security threats can be timely and effectively found and coped with.

The invention discloses a network security protection method and system based on a digital twin technology, belongs to the technical field of network security, and is used for solving the technical problems that an attack graph adopted by an existing network risk assessment method has limitation, vulnerability repair and defense depend on experience, and the effectiveness of a defense means is difficult to verify. The method comprises the following steps: constructing a network vulnerability dynamic knowledge graph based on multi-source network vulnerability information; acquiring real-time vulnerability information of the target network, and constructing an attribute attack graph of the target network according to the real-time vulnerability information and the dynamic knowledge graph; expanding the attribute attack graph based on the dynamic knowledge graph to obtain an expanded attribute attack graph; determining a predicted attack path according to the extended attribute attack graph; the attack complexity of the attack path is deduced and predicted in the digital twin model, and a defense strategy is determined according to the attack complexity level; and carrying out validity verification on the defense strategy, and feeding back the defense strategy passing the verification to the network node in the predicted attack path.

The invention relates to the technical field of risk management, and discloses an asset and risk management-oriented dynamic risk visual management method, which comprises the following steps of: automatically scanning to obtain asset information in a network, and classifying assets; based on the asset information, determining a connection relationship between assets, and constructing a network topology structure diagram; based on a vulnerability database, vulnerabilities existing in the assets are analyzed, an attack graph is generated, and a preset attack path is determined; analyzing a preset attack path to determine an attack path in combination with the network flow data and an attack technique; evaluating the security defense system in the attack path by using a simulated attack technology, and determining the defense efficiency; based on augmented reality and virtual reality technologies, vulnerabilities, attack paths and defense efficiency of each asset are dynamically displayed on a network topology structure diagram. The invention provides an efficient, intuitive and dynamic risk visualization management method by combining various technologies, and the asset management and risk response capabilities can be remarkably improved.

The invention discloses a computer network security threat real-time monitoring method and system, and relates to the technical field of network security, and the method comprises the steps: collecting and preprocessing multi-source network data, organizing the multi-source network data into a behavior sequence according to a time sequence, and forming time sequence behavior data for analysis; constructing an attack atlas based on the preprocessed multi-source network data, and in the atlas construction process, forming dynamic representation of the attack atlas in combination with time attributes of behavior events and inter-entity contexts; time sequence behavior data are input into an RCLNet architecture for analysis, the RCLNet extracts spatial features through CNN, the LSTM captures time features, key behavior features are concerned by using an adaptive attention mechanism, and a high-dimensional behavior embedding vector is generated. High-precision and real-time detection and response to network threats are realized, and the intelligence and actual combat adaptability of the system are greatly improved.

The invention provides a cloud environment active defense system based on dynamic honey spots. The system comprises a honey spot deployment and management module which generates and deploys honey spots, manages honey spot layout and provides honey spot information; the dynamic defense control module monitors network flow, perceives an attack path, analyzes attack behavior characteristics, adjusts honey point layout, generates an adjustment instruction and generates alarm information according to the attack behavior characteristics; the attack chain tracking and analyzing module is used for acquiring attack event data for attack behavior tracking, constructing an attack graph for attack path analysis and attack intention prediction and generating a threat intelligence report; and the system integration and management module monitors the running state and the resource use condition of each module, dynamically distributes system computing resources, and sets an interaction unit to provide interaction. According to the system, a complete deception defense mechanism is constructed, a deception environment is constructed by utilizing honey points, the honey points are dynamically adjusted according to attacks, and quick response and accurate countering are ensured through a flexible defense strategy and multi-layer cooperation.

Implementations include receiving graph data representative of a process-aware analytical attack graph (AAG) representing paths within an enterprise network with respect to observed facts of the enterprise network, the process-aware AAG at least partially defining a digital twin of the enterprise network, receiving data indicating at least one non-observed fact of the enterprise network, generating, from the graph data and the received data, an augmented process-aware AAG representing paths within the enterprise network with respect to the observed facts and the at least one non-observed fact, determining, by a process-aware risk assessment module, a risk assessment based on the augmented process-aware AAG, and providing, by a mitigation simulator module, a mitigation list based on the process-aware AAG and the risk assessment, the mitigation list comprising a prioritized list of observed facts of the process-aware AAG.

The invention discloses an electric power production data private network security situation awareness system and method. The method comprises the following steps: 1) acquiring security data of an electric power production data private network in real time; 2) standardizing the acquired data; 3) constructing a power grid entity relation graph, and fusing the standardized data obtained in the step 2) into the graph; 4) constructing an attack graph, and associating the attack graph with the power grid equipment entity relationship graph; 5) combining the power grid entity relation graph with the attack graph, performing deep correlation analysis, and identifying potential attacks in the power grid; 6) generating a grade risk alarm according to an identification result in the step 5), and triggering corresponding countermeasures; and 7) simulating the defense measures in the step 6), and optimizing and adjusting the defense countermeasures according to a feedback result. According to the method, the multi-source data is combined with the dynamic knowledge graph technology, real-time correlation analysis of the power grid entity relationship and the attack behavior is supported, and the recognition capability of novel attacks is remarkably improved.

The invention discloses a network security analysis early warning system based on artificial intelligence, and relates to the technical field of network security, and the system comprises the following steps: S1, constructing a multi-dimensional state table based on original traffic features; s2, generating an attack graph based on a causal relationship by using the state table; s3, extracting a topological evolution path by using an attack graph; s4, performing joint mode mapping by using the state table and the risk path; and S5, performing neural discriminant embedding modeling by using the composite risk event set. Through setting the attack graph based on the causal relationship, the technology significantly improves the integrity of risk propagation condition modeling, and lays a more stable data foundation for intelligent early warning of network security risk propagation. The joint modeling overcomes the problems of insufficient data granularity and incomplete application conditions caused by only depending on adjacency relation or simple condition judgment in the prior art, and can more clearly describe the internal relation between conditions when risk propagation occurs.

The invention provides an attack fault tree security risk assessment system based on deep reinforcement learning, and relates to the technical field of information security. The system specifically comprises a network asset data fingerprint scanner module, a deep reinforcement learning network model generation and training module and an automatic penetration test tool set module. The invention aims to determine the optimal attack path from the system attack graph by using deep reinforcement learning. By combining the screened attack paths with various resources and time costs encountered in the actual penetration test, the failure rates of various security risks in the attack fault tree, the success probabilities of various attacks and other indexes can be determined. And finally, establishing an attack fault tree of a power system scene in the embodiment, comparing the attack lethality and the detection capability level of each attack path in a game phase, and qualitatively and quantitatively analyzing the final security capability level of the target system and the damage degree caused by attacks.

The invention discloses an intelligent construction and tracing method and device for an attack graph, and relates to the technical field of network security. The method comprises the steps of performing semantic analysis and entity relationship extraction on a multi-source heterogeneous security log according to a predefined structured security data model, and generating a standardized security entity relationship triple set; based on the set, taking an entity in an initial alarm as a starting point, and adopting an iterative closed loop driven by a large language model to dynamically construct an attack graph; and carrying out attack technique and tactics mapping and threat attribution based on the final map, and generating a response strategy of priority ranking. According to the method, automatic and high-precision source tracing and response of the attack chain are realized, and the problems that the prior art depends on static rules and semantic segmentation and lacks dynamic reasoning capability are effectively solved.

The invention belongs to the technical field of network security, and discloses a countering measure strategy construction method and system based on attack intelligence. According to the method, firstly, multi-source attack intelligence is fused, and a causal time sequence attack knowledge graph is constructed; then, mapping the atlas on a digital twinborn model based on the IEC 62443 standard, constructing a Bayesian attack graph, and quantifying the risk of each attack path; then, taking the risk, the cost and the operation influence as multiple targets, and adopting an NSGA-II algorithm to generate a Pareto optimal countering strategy set; further, an optimal robust strategy is selected from the strategy set by solving the Stackelberg safety game model; and finally, explaining the decision process by using an interpretable AI technology. According to the method, the problems of passive threat intelligence analysis, static risk assessment, sub-optimal strategy selection and opaque decision-making process in the prior art are solved, and active, quantitative, optimal and credible defense decision-making for the key infrastructure is realized.

The embodiment of the invention provides a method, device and system for constructing an attack graph, and a storage medium, and relates to the technical field of network security. The method comprises the steps that based on a test case knowledge base of a target system, an attack graph information expansion algorithm is executed through a knowledge graph technology, and expanded information is obtained; utilizing the expanded information to construct an attribute attack graph of the target system; and carrying out attack path description on vulnerabilities of the target system based on the attribute attack graph. An attack graph information expansion algorithm is executed through a test case knowledge base based on a target system and by means of a knowledge graph technology, information needed for constructing an attack graph can be obtained, potential attack paths can be mined, the attack graph information is expanded, and then a comprehensive and accurate attribute attack graph is constructed. According to the method, effective description of the vulnerability attack path of the target system is realized, so that the constructed attack graph can reflect the security condition of the network system more truly, more scientific decision support is provided for network security management personnel, and the network security protection effect is improved.

The invention relates to an open source component multi-modal dependency risk tracing method and device, and the method comprises the steps: employing a mode of combining static analysis and dynamic analysis to analyze a component dependency relationship of software, and combining AST analysis and construction script analysis; function-level features are extracted, a binary fingerprint database is constructed, the similarity between different versions is analyzed through LSH, behavior patterns in binary codes are analyzed, and hidden dependencies or malicious code injection is detected; the version updating history of the dependent component is analyzed and monitored by using a time sequence, and the vulnerability security of the component is evaluated in combination with attack graph analysis; high-risk components on the path are calculated, potential supply chain attack points are identified, and risk points are subjected to cross validation; a time sequence diagram database is used for recording the component dependency relationship, and time backtracking query is supported. According to the method, a multi-mode dependency analysis method is adopted, potential dependency risks are rapidly identified, and potential supply chain attack risks are timely warned.

The invention discloses a network security attack path prediction system based on a graph neural network, and relates to the technical field of network security, and the system comprises a data collection module which collects network full-link time sequence security data, and outputs standardized time sequence data through time sequence alignment and abnormal noise reduction processing; the time sequence diagram construction module is used for constructing a dynamic attack graph containing nodes and time sequence edges; the feature learning module introduces a time sequence attention mechanism, calculates a time-space fusion attention coefficient based on a graph attention network framework, and outputs a node embedding vector; the reasoning and pruning module is used for generating attack paths based on node embedding vectors and outputting a high-value attack path set; and the analysis decision module is used for carrying out importance sorting on all nodes on the high-value attack path, determining a path core risk point and generating a key node decision basis of the attack path. According to the method, the problem that the traditional technology cannot accurately capture the attack behavior time sequence dependence is solved, and the high-precision prediction of the attack path is realized.

The invention discloses a vulnerability risk monitoring method and system based on a transmission and distribution power grid, and the method comprises the steps: obtaining power grid data, and carrying out the preprocessing of the power grid data, and obtaining first power grid data; based on the first power grid data, using a neural network model to predict a power grid load demand to obtain prediction data; performing multi-time scale vulnerability index calculation on the prediction data to obtain a calculation result, constructing a Bayesian attack graph according to the calculation result, and identifying a high-risk path; the high-risk path is implemented by formulating a protection strategy, and data generated by risk monitoring is stored, so that the accuracy of risk path identification is improved.

The invention discloses a situation awareness and linkage disposal system based on dynamic threat modeling driving, and the system comprises a security data collection and standardization module which is used for collecting security data of a network, a host and an application layer, and carrying out the standardization processing; the dynamic threat modeling module is used for constructing a dynamic threat model; the threat agent modeling and simulation module is used for modeling each node in the threat attack graph into a threat agent; the parameter optimization module is used for globally optimizing parameters and strategy weights of the Monte Carlo tree search network by using a seagull algorithm; the linkage processing decision module is used for configuring a Monte Carlo tree search network based on the optimal parameter group; the safety equipment scheduling module is used for analyzing the optimal linkage disposal decision scheme; and the disposal effect evaluation and feedback module is used for performing multi-dimensional analysis on the disposal feedback data set. According to the invention, accurate situation awareness and linkage processing are provided for the user.

The invention relates to the field of network security, and particularly discloses a network security defense strategy optimization method based on machine learning, and the method comprises the steps: aggregating isolated security events into attack activity clusters through causal association analysis, constructing a dynamically evolved global attack graph, and improving a defense perspective from a discrete event to a full combat view. In order to realize foresight, a graph neural network is utilized to analyze a graph to identify attack tactics and predict the next intention. A hierarchical reinforcement learning framework is innovatively introduced in the decision-making stage; an upper-layer strategic agent formulates a macroscopic defense target based on a global situation; and the lower-layer tactical agent focuses on the related attack sub-graph under the strategic guidance, and selects and executes the specific tactical action which can reach the target most. The strategy and tactical separated decision-making mode ensures that each defense action serves a long-distance target, so that strategic passivity caused by only taking care of previous threats is avoided.

Various systems and methods for providing risk-based vulnerability management are described herein. A system is configured to access an attack graph, the attack graph including exploits represented as preconditions and postconditions; access vulnerability information of a plurality of nodes in the network, the vulnerability information including conditions of the plurality of nodes in the network; access a network connectivity graph that represents a logical network topology of the plurality of nodes in the network; identify a set of attack paths in the attack graph by comparing the conditions of the plurality of nodes in the network with preconditions and postconditions in the attack graph; calculate a risk score for each of the set of attack paths in the attack graph; and present the risk score for each of the set of attack paths.

A computer-implemented method for monitoring a computer network is provided, the method comprising: storing a first attack graph, the attack graph comprising a plurality of nodes each representing an event that may occur within the computer network; storing one or more predetermined variation properties of one or more of the events represented by the nodes, the variation properties being indicative of possible changes to the nodes within the first attack graph; determining a plurality of possible alternative sequences of the nodes in the first attack graph based on the variation properties; generating a plurality of additional attack graphs, each of the additional attack graphs comprising a plurality of the nodes of the first attack graph arranged in one of the possible sequences; and monitoring events within the network to detect a set of events occurring in a sequence that corresponds to one of the additional attack graphs to identify a potential security attack. A computer system including at least one processor and memory storing computer program code configured to perform the said method, and a computer program or computer readable medium comprising instructions that when executed by a computer system cause the computer system to perform the said method are also provided.

The invention discloses a virtual simulation and security evaluation method and system based on a network security target range, and the method comprises the steps: constructing a network asset knowledge graph for describing a virtualized target range environment through information collection; secondly, based on an attack strategy grammar rule base, adopting a Monte Carlo Tree Search (MCTS) algorithm to carry out intelligent attack simulation on the knowledge graph so as to discover a nonlinear and multi-stage attack path; thirdly, constructing a Bayesian attack graph (BAG) based on the knowledge graph, and performing probabilistic and systematic quantitative evaluation on the security risk of each asset node in the network through Bayesian reasoning; and finally, integrating the attack path and the quantitative risk value, and generating a comprehensive assessment report containing a visual path, a risk sequence and a reinforcement suggestion. According to the target range simulation method and device, the problems that existing target range simulation is insufficient in confrontation authenticity, one-sided in safety evaluation and lack of predictability are solved by combining the strategy simulation of the MCTS and the global quantitative analysis of the BAG.

The invention discloses an asset vulnerability repair priority evaluation method based on an attack graph, and the method comprises the following steps: S1, carrying out the detection of all assets, and carrying out the vulnerability scanning of the detected assets; s2, obtaining a network access relation of the detected assets; s3, constructing an asset access relation graph based on the network access relation; s4, extracting external reachable vertexes based on the asset access relation graph; s5, carrying out asset importance calculation on the extracted vertexes; and S6, performing vulnerability priority ranking according to asset importance. According to the method, the accessibility of the network access relation is considered when the vulnerabilities are subjected to priority ranking, various attack paths possibly existing in the network can be fully reflected, and therefore the asset vulnerability repair priority can be more comprehensively and accurately reflected.

The invention discloses an APT attack detection and tracing method based on a graph neural network and reinforcement learning, and belongs to the technical field of network security and multi-step attacks, and the method comprises the following steps: carrying out the modeling of an event in a system audit log through a continuous-time dynamic heterogeneous graph, generating a more challenging sample through an AGNN, improving the quality of the sample, and carrying out the detection of the APT attack. The generated positive sample is more complex and is close to a real attack scene; attention on similarity between attack steps is enhanced by using contrast loss, the ability of detecting attack behaviors is improved, and in a fine adjustment stage, according to a sample type, edge embedding is obtained by embedding nodes on two sides of a spliced edge; the full connection layer maps the embedding to the probability that a connection edge belongs to an attack event, and a weighted cross entropy loss function is used as a fine tuning target; the method of combining Monte Carlo tree search with reinforcement learning is used for gradually tracing events in the system. According to the method, APT attack graph embedded feature extraction and detection can be better carried out.

A stream of cybersecurity alerts is received. Each cybersecurity alert from the stream of cybersecurity alerts is associated with a set of attributes. Each cybersecurity alert from the stream of cybersecurity alerts is associated, based on the set of attributes and as that cybersecurity alert is received, to a bucket from a set of buckets. Each bucket from the set of buckets is associated with (1) an attribute from the set of attributes different than remaining buckets from the set of buckets and (2) a set cybersecurity alerts from the stream of cybersecurity alerts having the attribute. For each bucket from the set of buckets, a set of correlations between cybersecurity alerts included in the set of cybersecurity alerts for that bucket are determined, based on the set of cybersecurity alerts for that bucket, to generate an attack graph associated with that bucket.

The invention discloses a dynamic verifiable fuzzy multi-keyword cloud ciphertext search method based on a block chain, and relates to the technical field of cloud native security. According to the method, full-process automatic analysis from vulnerability collection to attack graph generation to vulnerability evaluation is realized by combining vulnerability data of CNNVD, Docker container information and various vulnerability analysis algorithms. The core part in the design is attack graph generation and vulnerability analysis, and the part aims to comprehensively discover vulnerabilities existing in the system as much as possible and evaluate potential safety influences of the vulnerabilities. Through fusion evaluation of the analytic hierarchy process and the improved BP algorithm, the accuracy of vulnerability evaluation can be ensured, and the purpose of providing deeper analysis for the overall security condition of the system through the prediction capability of the neural network can be achieved. According to the multi-angle evaluation mode, the comprehensiveness and scientificity of vulnerability evaluation can be improved, so that a security team is helped to manage security risks in the system more effectively.

Implementations include methods, systems, computer-readable storage medium for mitigating cyber security risk of an enterprise network. A method includes: receiving an initial analytic attack graph (AAG) that is representative of paths within the enterprise network with respect to at least one target asset, the initial AAG comprising nodes and edges between the nodes; identifying, from the nodes of the initial AAG, a plurality of node groups, each node group including two or more nodes having at least one common attribute; generating an abstract AAG from the initial AAG, the abstract AAG including at least one abstract node, wherein each node group of the initial AAG is represented by a respective abstract node of the abstract AAG; determining a set of remedial actions at least partially based on the abstract AAG; and executing remedial actions in the set of remedial actions to reduce a cyber security risk to the enterprise network.

The present application provides an attack source tracing method and apparatus, a device, and a medium. The method comprises: acquiring data related to an attack event, using the data related to the attack event to update a pre-constructed Bayesian attack graph, and determining an attack path with the maximum reachable probability in the updated Bayesian attack graph as a target attack path, wherein the pre-constructed Bayesian attack graph is a Bayesian attack graph constructed on the basis of data related to a historical attack event; and performing feature extraction from the data related to the attack event and the updated Bayesian attack graph, matching the extracted features with pre-formed feature clusters, and determining an attacker corresponding to the successfully matched feature cluster as a target attacker, wherein the pre-formed feature clusters are feature clusters which are formed by clustering the data related to the historical attack event and features extracted from the pre-constructed Bayesian attack graph and represent different attackers. According to the present application, the Bayesian attack graph and the feature clustering are utilized, effectively realizing rapid source tracing of the attack path and the attacker.

The invention discloses a traffic mirroring data processing method for local threat tracing, and belongs to the field of network security. Aiming at the problems of data redundancy, poor real-time performance, weak traceability and the like in the traditional technology, the technical scheme of dynamic traffic mirroring and preprocessing, multi-dimensional feature aggregation, time decay threat graph construction and a localized traceability engine is constructed. Threat index dynamic sampling, multi-protocol layer feature fusion, entity dependency relationship dynamic recording and attack path real-time tracing are realized through an adaptive mirror image proportional adjustment algorithm, a protocol stack entropy aggregation model, a time decay incidence matrix, an improved Bayesian attack graph and a dynamic programming algorithm. Through multi-scene verification, the threat detection rate reaches 96.8%, the false alarm rate is 2.3%, the traceability time is shortened to 58 seconds, the storage cost is reduced by 61%, and the security protection capability of the industrial control network is effectively improved.