65 results about "Kill chain" patented technology

The invention relates to the technical field of APT killing chain reconstruction and prediction methods, and provides an APT killing chain reconstruction and prediction method and system based on causal reasoning. The method aims at solving the problems that in an existing APT detection and defense technology, multi-source heterogeneous data integration is difficult, space-time dynamic feature modeling is insufficient, killer chain reconstruction is inaccurate, the predictive capacity is limited, interpretability is poor, and real-time performance and accuracy are difficult to consider at the same time. The method comprises the steps of obtaining multi-source heterogeneous data, constructing a causal graph, performing multi-modal feature extraction based on the causal graph, and obtaining node initial feature representation; inputting the node initial feature representation into a time sequence causal graph convolution learning algorithm to obtain an optimized node representation; executing killer chain reconstruction based on the optimized node representation to obtain a possible killer chain sequence; predicting a future attack path according to the possible killing chain sequence to obtain a potential attack path; and generating an interpretability analysis report based on the potential attack path.

The invention discloses a dynamic time sequence event equipment system adversarial network construction and recommendation method and device, and relates to the field of killing network design, and the method comprises the steps: constructing an initial detection-command and control-strike warning network; a dynamic time sequence event on the battlefield is continuously monitored, when the event type of the dynamic time sequence event is an equipment state event, the initial detection-command-strike warning network is updated, and when the event type of the dynamic time sequence event is a chained event, a closed detection-command-strike link set containing an enemy target is generated; the closed detection-command-strike link set comprises a plurality of killing chains; based on the multi-dimensional evaluation index system, evaluating each killing chain to obtain an evaluation result corresponding to each killing chain; and according to the evaluation results corresponding to all the killing chains, recommending an optimal interception scheme of an air defense and anti-guide interception action. The method overcomes the problems of large calculation dimension and slow response speed of an existing method.

The invention discloses a security event traceability system and method based on attack chain analysis, relates to the technical field of data security protection, and is used for realizing multi-level perception of attack activities by building a multi-modal killing chain probe matrix as a structured data basis. Modeling analysis is carried out on attack behaviors of different levels through a deep heterogeneous feature extraction architecture, multi-dimensional features are fused into a cross-layer joint feature vector, a 3D attack deduction sand table is constructed according to the cross-layer joint feature vector, the propagation path and probability of APT attack are simulated, a high-dimensional attack curved surface is drawn, and a 3D attack deduction sand table is constructed according to the cross-layer joint feature vector. And key path nodes and potential transverse diffusion directions are identified, and a defense strategy knowledge graph is constructed according to a modeling result. The traceability system breaks through barriers among threat detection, attack understanding and defense response through a stage linkage mode of'probe sensing-intention recognition-path modeling-defense deduction ', and realizes accurate traceability and efficient disposal of security events.

The present application relates to a method and apparatus for generating a cyber kill chain, and an electronic device. The method comprises: generating multi-source logs and security alarm logs on the basis of network traffic and terminal behaviors; performing aggregation processing on the security alarm logs to obtain aggregated security alarm logs, and associating the aggregated security alarm logs with the multi-source logs to obtain a user behavior sequence; inputting the user behavior sequence into a pre-trained detection model to detect, on the basis of the detection model, whether there is attack traffic in the user behavior sequence; and when there is attack traffic in the user behavior sequence, inputting the user behavior sequence into a pre-trained generation model to generate, on the basis of the generation model, a cyber kill chain corresponding to the attack traffic. By means of the method, the recognition efficiency and accuracy of detecting the attack traffic can be improved, and the cyber kill chain corresponding to the attack traffic can be accurately restored, so that the cybersecurity personnel can comprehensively assess and promptly deal with cybersecurity threats.

A computer implemented security method security method is described, for detecting attacks on a system or network. The method comprises defining a sequence of attack tactics, each attack tactic representing a generalisation of a set of attack techniques, associating one or more attack detection rules with each of the attack techniques, detecting attack events based on the attack detection rules, correlating the detected attack events with the attack tactics based on the attack technique associated with the attack detection rule used to detect the attack events, linking the detected attack events based on one or more criteria, and identifying one or more paths of attack techniques through the sequence in dependence on the linked attack events. The identified paths of attack techniques represent kill chains. The present technique makes it possible to identify new kill chains of known techniques, as well as making it possible to identify high-risk kill chains.

The invention provides a system efficiency evaluation method based on OODA ring closing, and the method comprises the steps: dividing an efficiency index system into three dimensions: a task, an OODA ring flow, and a killing chain, and constructing the overall dimension of the efficiency index system; establishing a multi-layer efficiency index system of task-OODA ring process-killing chain sub-chain-efficiency index by analyzing the OODA ring process and killing chain closing; and acquiring expert comprehensive weights of each node in the task layer, the OODA ring flow layer and the killing chain layer and each efficiency index in the efficiency index layer, and performing layer-by-layer upward recursion by adopting a weighted summation method according to the expert score and the expert comprehensive weight of each node or index in each layer, thereby determining a comprehensive efficiency value of the system, and completing efficiency evaluation of the cross-domain collaborative system. According to the method, the system efficiency index is constructed based on OODA ring closing, the richness and integrity of task requirements are ensured, and meanwhile, the finally obtained efficiency index can more comprehensively and effectively represent the capability of the system on the system level from the perspective of OODA ring closing.

The invention discloses a multi-target killing chain optimization method and device based on combinatorial optimization, and the method comprises the steps: constructing a combat network according to the interaction relation between combat units, and determining an edge attribute as a combat index according to a network node parameter; according to the number of targets attacked in the current combat scene and the number of combat indexes required for optimization, whether a static killing chain or a dynamic killing chain is generated is judged; if the number of the attacking targets in the current combat scene is single, carrying out monocular single-index killing chain optimization, or carrying out monocular multi-index killing chain optimization to generate a static killing chain; and if the number of the combat targets in the current combat scene is multiple and the number of the combat indexes is multiple, performing multi-view and multi-index killing chain optimization by combining and optimizing different killing chain paths, and generating a dynamic killing chain. According to the invention, a commanding mechanism can be assisted to select a static killing chain or a dynamic killing chain which most meets requirements from a plurality of killing chains based on the four combat indexes.

The invention discloses a service-based killer chain analysis construction method, which belongs to the technical field of cooperative combat, and comprises the following steps: constructing a service resource pool, and setting a service discovery mechanism; on the basis of the fusion situation set, a situation switching event is recognized so as to perform local updating, and a three-level situation view is constructed; constructing a directed hyperedge, generating a directed hypergraph in combination with function category constraints, generating a dimensionality reduction state space based on multi-dimensional constraints, and generating an initial combat candidate set; configuring a management node, sending task invitation information to the initial combat candidate set in combination with the subtasks, generating a response scheme, performing adaptive screening, generating an initial killing chain, and performing failure verification; constructing a servitization twinborn body, deducing the initial killing chain, and executing delay at a calculation end so as to perform elimination recombination or delay optimization; a service combination template is constructed, an efficiency feedback mechanism is established, the superposition influence of frequent situation switching and state space catastrophe is cooperatively solved, and the real-time performance of generation of the killing chain is remarkably improved.

The invention discloses a multi-scale fusion network efficiency evaluation method based on killing chain driving, and the method employs the bottom-up idea of a complex system, considers the three-in-one condition of confrontation, dynamic and overall structure based on the incidence relation of nodes, a killing chain and a killing network, and carries out the evaluation of the efficiency of a multi-scale fusion network. An evaluation model from a micro scale to a middle scale and then to a macro scale is constructed, and the feasibility of the method is verified by comparing network efficiencies of tactical-level command systems with different architecture forms through simulation. By using the method, the integrality, the dynamic nature, the antagonism and the uncertainty characteristics of the network are comprehensively considered, and efficiency evaluation can be performed on the network in different environments. The method can be widely applied to the field of network performance evaluation.

Some embodiments construct an entity map describing a group of inter-related entities and determine whether a computing device comprises malware according to the respective entity map. The entity map includes worker entities (e.g., processes) and resource entities (e.g., files) accessed by the respective worker entities. Some entity maps are persistently stored and recovered in response to a reboot, enabling a complete reconstruction of a kill chain even when malicious activities are distributed among multiple entities and multiple computing sessions. Some embodiments detect infection by comparing a current entity map with a signature map describing at least a fragment of a known attack.

The invention discloses an unmanned aerial vehicle cluster survivability evaluation method based on a killing chain, and relates to the technical field of unmanned combat system evaluation, and the method comprises the following steps: S1, summarizing the types and number of our unmanned aerial vehicles, forming a our unmanned aerial vehicle equipment list, and collecting enemy target information, and forming an enemy target list; s2, according to the communication relationship between the unmanned aerial vehicle clusters, analyzing the network topology structure of the unmanned aerial vehicle cluster combat, eliminating invalid network communication modes and enemy target nodes, and forming a directed unmanned aerial vehicle cluster survivability analysis network graph D = lt; e, Vgt; . According to the unmanned aerial vehicle cluster survivability evaluation method based on the killing chain, different unmanned aerial vehicle nodes are destroyed, the comprehensive survivability evaluation value change of the whole unmanned aerial vehicle cluster is calculated, a survivability change trend chart is drawn, and key equipment nodes and weak links which have the largest influence on network survivability are judged.

The invention discloses a method based on Bayesian ATTamp; the invention discloses a general complex network attack inference method for a CK network, and relates to the technical field of network security. Performing sequential logic modeling on tactics in the CK framework to ensure that a generated attack sequence is logically coherent and reflects a behavior pattern of a real complex network attack; based on the tactical sequential logic sequence, guiding of expert knowledge on tactical transfer is expanded into guiding on technology transfer, and a technology dependence network is constructed and formed; an anonymized data set from a real network attack event is adopted, and a technical dependency network is further optimized by utilizing a technical co-occurrence relation in the data set; bayesian ATTamp is carried out on the basis of a technical co-occurrence relation between a technical dependency network and a real network attack data set; the CK network performs structure learning and parameter learning, constructs a network model independent of a specific threat detection system, and realizes complex network attack inference independent of a specific system.

The present invention provides a method for constructing a kill chain based on a simulation deduction based on the combination of virtual and real, which relates to the field of simulation technology, and comprises: S1: obtaining a combat mission, identifying and defining a target according to the requirements of the combat mission, and determining the type of the kill chain based on the combat mission; S2: collecting corresponding scene data for different combat domains, and constructing a three-dimensional digital virtual environment based on the scene data; S3: establishing a multi-dimensional physical model for various types of combat platforms, and rendering the multi-dimensional physical model in real time into a virtual environment to form a virtual combat unit, wherein the combat platform comprises a plurality of sensors; S4: collecting sensor data of each combat platform, fusing the sensor data, and generating a unified target situation map; S5: making a plan decision by using a decision algorithm according to the target situation map and a combat knowledge base, and generating a combat plan; S6: deducing and verifying the combat plan in a virtual environment, and evaluating and optimizing the combat plan by using an evaluation method, and obtaining an optimized combat plan; S7: converting the optimized combat plan into an executable instruction parameter set, and transmitting the instruction parameter set to each combat platform through a heterogeneous network to coordinate and dispatch combat; S8: forming a kill chain according to the process of steps S1-S7. The present invention provides a reliable kill chain construction method for different combat domains, which not only improves the flexibility and efficiency of operations, but also lays a solid foundation for the development of future combat fields.

In one aspect, a method for implementing a cloud-platform push for one or more known data breaches includes the step of, for each data breach of the one or more known data breaches, providing a functionality that maps one or more kill chains or Tactics, Techniques, and Procedures (TTPs) for a specified set of security dimensions. A step includes generating a security rule for each mapped kill chain or TTP based on the functionality that maps the one or more kill chains or Tactics, Techniques, and Procedures (TTPs) for a specified set of security dimensions. A step includes pushing the security rule to an enterprise so that the enterprise is aware of a vulnerability in the data breach. A step includes generating a customized posture for a Virtual private cloud (VPC) in the enterprise's cloud-based network. A step includes determining that the data breach can occur within the enterprise's cloud-based network.

The application belongs to the technical field of network security, and particularly relates to a CPS attack path reconstruction method and system based on a kill chain model clustering. CPS information layer and physical layer operation data are collected, a feature vector is generated through time window fusion, a feature subspace is divided based on the four stages of the kill chain, candidate clusters are obtained by clustering the data of each stage, high-confidence clusters are screened in combination with time concentration and behavior intensity, a causal diagram is constructed according to time proximity and cross-layer correlation, and complete reconstruction of the attack path is realized; the application adapts to the cross-layer coupling characteristics of CPS, improves the accuracy of attack stage division and path reconstruction, and can provide reliable support for attack tracing and defense strategy formulation.

The embodiments of the present application relate to the field of virus attack prediction, and specifically to a virus attack prediction method and device based on a network attack-kill chain. A specific implementation of the method includes: inputting a network browsing log set into an abnormal log feature information detection model; inputting each abnormal log feature detection information that meets the abnormal feature conditions into a log data abnormal recognition model corresponding to the abnormal log recognition configuration information; for each log data abnormal recognition result, performing the following processing steps: inputting a historical user access behavior information sequence into a pre-trained network attack-kill chain generation model to obtain a network attack-kill chain corresponding to the abnormal user; constructing a network virus attack prediction model based on each obtained network attack-kill chain; and performing network virus attack prediction on each accessing user based on the network virus attack prediction model. This implementation improves the recognition of various types of virus attacks and enhances network security.

The present disclosure relates to methods, systems, and computer program products for generating an asset remediation trend map used in remediating against an attack campaign. The method comprises receiving attack kill chain data. The attack kill chain data comprises steps for executing an attack campaign on one or more assets associated with a computing device. The method further comprises parsing the attack kill chain data to determine one or more attack execution operations for executing the attack campaign on the one or more assets associated with the computing device. The method determines based on the parsing, one or more remediation operations corresponding to the one or more attack execution operations. In addition, the method sequences the one or more remediation operations to form an asset remediation trend map. In one implementation, the asset remediation trend map indicates steps for remediating the attack campaign.

The invention provides a supply and demand vector matching-based killing chain rapid construction method, which mainly comprises the following steps of: obtaining a task target, and carrying out demand vector modeling; performing supply vector modeling according to the specific performance of each equipment platform; the obtained demand vector and supply vector are matched to obtain an effective killing chain combination, and the matching mode is to screen out a combination scheme set meeting conditions according to the set conditions; for the obtained combination scheme set, calculating the energy efficiency of each combination scheme according to a set strategy, and selecting the combination scheme with the optimal performance; and executing a task by using the obtained optimal combination scheme and monitoring, and automatically releasing resources after the task is finished. Through simulation verification, according to the method, for multiple targets, under the condition that the target troop combat formation, the target time sensitivity and the damage strategy are known, a killing net dynamic combination scheme meeting the combat time sensitivity requirement and the damage requirement can be rapidly constructed.

Threat activity statistical analysis driven adaptive control specification includes retrieving a data structure from over a computer communications network into memory of a computing device and parsing the data structure in the memory to extract a listing of different threat activities. Threat activity statistical analysis driven adaptive control specification also includes computing in the memory a statistical analysis of the different threat activities. Finally, threat activity statistical analysis driven adaptive control specification includes responding to the statistical analysis surpassing a threshold for an identified one of the different threat activities by determining a corresponding threat incorporating the identified one of the different threat activities in an associated kill chain, retrieving a control specification addressing the corresponding threat, and modifying the control specification to address changes in the corresponding threat.

The present invention discloses a comprehensive analysis method and system of threat warning information based on kill chain, which relates to the field of data processing technology. The method includes: obtaining threat warning information, and performing data cleaning to obtain warning information to be extracted; performing threat behavior extraction to obtain a threat behavior set; obtaining a threat log set, and performing multi-dimensional feature extraction on the threat log set to obtain a threat log feature set; determining the killing stage to obtain an identified threat behavior set; constructing a kill chain model, performing threat behavior analysis, and obtaining multiple threat behavior chains; performing differentiated maintenance on the target network based on multiple threat behavior chains. The present invention solves the technical problems in the prior art that threat warning information is complicated, the utilization rate is low, and a reliable basis for network maintenance cannot be provided, and achieves the technical effect of improving the quality of warning information analysis and the effectiveness of network maintenance.

A method for evaluating the mission reliability of an equipment system based on the kill chain. Guided by the new requirements of modern equipment system-based informatized warfare and centered on the research of the mission reliability of the equipment system, in view of the heterogeneous characteristics of the nodes and edges of the equipment system's combat network, a method for simulating and evaluating the mission reliability of the equipment system based on the kill chain and considering dynamic reconfiguration and node repair is proposed. This invention takes into account the combined effects of the combat network dynamic reconfiguration strategy and the node repair strategy, applies theories such as reliability simulation evaluation and heterogeneous networks, conducts research on the modeling of the equipment system's combat network and the simulation evaluation of the combat mission reliability, establishes a method for simulating and evaluating the mission reliability of the equipment system considering dynamic reconfiguration and node repair, better evaluates the reliability level of the equipment system design scheme, effectively analyzes the reliability of the equipment system in completing combat missions under different initial combat networks and different attack strategies, and provides theoretical and technical support for the design and evaluation of the equipment system.

The application discloses a kind of service-based kill chain analysis construction methods, belong to the technical field of cooperative combat, including: constructing service resource pool, and set service discovery mechanism;Based on fusion situation set, identify situation switching event, to carry out local update, and construct three-level situation view;Directed hyperedge is constructed, combined with function category constraint, generates directed hypergraph, generates dimensionality reduction state space based on multidimensional constraint, and generates initial combat candidate set;Configuration management node, combined with subtask to the initial combat candidate set sends task invitation information, generates response scheme and carries out adaptation screening, generates initial kill chain, and carries out failure check;Build service twin, deduce the initial kill chain, calculate end execution delay, to carry out elimination reorganization or delay optimization;Build service combination template, and establish efficiency feedback mechanism, cooperatively solve the superimposed influence of frequent situation switching and state space catastrophe, significantly improve kill chain generation real-time performance.

System-of-systems architectures and methods for dynamically and adaptively managing and executing a command and control system across a global cyber enterprise are provided. The system-of-systems architecture integrates, synchronizes and executes with kinetic operations employing an adaptive and dynamic mixing and matching of capabilities for optimal effects in near real time so as to measure and maximize effects across the global cyber enterprise. The methods incorporate execution of a Cyber Operations “CyberOps” Chain of interlocking management cycles for the integration with a kinetic “Kill Chain” to optimize cyber / kinetic integration and mission outcomes. An analytical and software framework enables the on-demand formation of mission-specific dynamic cell groups from various cells stretching across the global cyber enterprise in response to ever-changing faces of cyber threats.

A method for the detection of multi-killchain alerts is disclosed. The method includes receiving, by a computer system, a plurality of alerts indicative of activity within a computer network, wherein a given alert specifies one or more events having attributes, and extracting attributes from events included in the plurality of alerts. The method further includes determining attribute similarity for pairs of events based on whether a given pair of events has common values for one or more attributes and whether attribute values of the given pair of events indicates lateral movement within computers of the computer network. Linked pairs are then identified based on the determined attribute similarity and added to a graph data structure. The method further includes the computer system analyzing the graph data structure to find clusters of events relating to a security attack.

Context-aware security policies and incident identification, via automated cloud graph building with security overlays, are determined and performed by systems and platforms. Graph nodes, of a graph associated with a computing system, that represent resources associated with the computing system and entities associated with the computing system that have respective associations to the resources are generated. Security attributes are determined and assigned to the graph nodes that represent the entities and resources, and static and dynamic connections between the graph nodes are added to the graph. Additionally, possible connections in the graph between the graph nodes are added based on heuristic relational determinations of the graph nodes. From the graph, security incidents and kill chains are identified, context-aware security policies are generated and validated, and scopes and relationships of applications are identified. Accordingly, security actions are taken for the computing system.

The present invention discloses a general complex network attack inference method based on the Bayesian ATT&CK network, which relates to the field of network security technology. Using the kill chain and empirical knowledge as the research basis, it conducts a temporal logic modeling of the tactics in the ATT&CK framework to ensure that the generated attack sequences are logically coherent and reflect the behavior patterns of real complex network attacks; based on the tactical temporal logic sequence, it extends the guidance of expert knowledge on tactical transfer to the guidance of technique transfer, and constructs a technique dependency network; it uses an anonymized dataset from real network attack events and further optimizes the technique dependency network by utilizing the co-occurrence relationship of techniques in the dataset; based on the technique dependency network and the co-occurrence relationship of techniques in the real network attack dataset, the Bayesian ATT&CK network performs structure learning and parameter learning to construct a network model independent of specific threat detection systems, realizing the inference of complex network attacks independent of specific systems.

The invention discloses a method for quickly and dynamically reconstructing an ultra-long-distance air-to-air killing chain, belongs to the technical field of ultra-long-distance air-to-air killing chains, and realizes dynamic recombination of the killing chain by using a self-organizing iterative clustering algorithm. In the execution process of the killing chain, if a reconstruction condition is triggered, all the combat platforms in normal operation are divided into six clusters according to the execution stages of discovery, positioning, tracking, aiming, combat and evaluation, each cluster is divided into different groups according to different loads loaded by the combat platforms, and the loading loads comprise ESM, light thunder and radar; for the combat platforms loaded with the same load, dividing the combat platforms in the same area into the same cluster by taking the current position as a division condition; all the combat platforms are subjected to dimension reduction clustering in sequence. According to the method, the high-dimensional complex calculation degree generated in the killer chain reconstruction process is subjected to dimension reduction processing, the calculation amount is remarkably reduced, and the reconstruction time is shortened.

The invention relates to the technical field of killer chain construction, in particular to an anti-killer chain construction method based on a service-oriented killer chain, and provides the following scheme: target motion prediction is performed based on real-time state information of a to-be-hit target to obtain a predicted path of the target in a preset time, and a probability cloud model is constructed in a three-dimensional tactical space to obtain a predicted path of the target; and a target influence area is determined after tactical environment constraint correction. And screening candidate service objects from the service resource library according to space, time and capability constraints, and mapping the candidate service objects to each killing chain link in combination with the service type killing chain template corresponding to the target. According to the method, rapid reconstruction of the killing chain can be realized under the conditions of target maneuvering, equipment damage or resource replacement, and the flexibility and continuous strike capability of a combat system are improved.

The invention belongs to the technical field of network security, and particularly relates to a CPS attack path reconstruction method and system based on killer chain model clustering. The method comprises the steps of collecting operation data of a CPS information layer and a physical layer, generating feature vectors through time window fusion, dividing feature subspaces based on four stages of a killing chain, clustering data of each stage to obtain candidate clusters, screening high-credibility clusters in combination with time concentration and behavior intensity, and constructing a causal graph according to time proximity and cross-layer correlation. Complete reconstruction of an attack path is realized; the method adapts to CPS cross-layer coupling characteristics, improves the accuracy of attack stage division and path reconstruction, and can provide reliable support for attack traceability and defense strategy formulation.

The invention discloses an urban unmanned aerial vehicle defense-oriented disposal strategy automatic generation system, and the system comprises an initialization module which is used for carrying out initialization; the situation information updating module is used for continuously receiving the situation information and instantiating the incoming target; the killing network construction module is used for sequentially calculating a connection relationship among a target node, an interception equipment node and a detection equipment node in the killing network to form the killing network; the killing chain optimization module is used for monitoring the integrity of the killing chain where each target is located and maintaining the original killing chain or regenerating the killing chain according to the monitoring result; and the self-evolution module is used for realizing iterative optimization updating of artificial neural network parameters in the killing chain optimization module by accumulating actual combat data and a reinforcement learning method, so that the model generates a better unmanned aerial vehicle disposal strategy. According to the technical scheme, the problem that the killing chain is interrupted due to factors such as building shielding in the urban environment can be solved, and rapid and effective maintenance of the killing network based on the real-time situation is ensured.