CN118802353A - A method for constructing a honey array model based on dynamic perception attack graph - Google Patents

Abstract

The invention provides a honey array model construction method based on a dynamic perception attack graph, which comprises the following steps: data acquisition is carried out to acquire related data of network attack and network defense to construct an original data set; generating alarm information according to the original data set, and constructing a dynamic perception attack graph based on the original data set and the alarm information; the static risk collaborative analysis is designed for identifying and evaluating the known risk, the dynamic risk collaborative analysis is designed for monitoring and adjusting the data acquired in real time, and the honey array model based on the dynamic perception attack graph is constructed. By using the method for constructing the honey array model, the dynamic uncertainty of the network and key parameters in an attack graph can be quantified, so that network security defenders can be helped to understand and deal with security threats in the network. The deception is taken as a core target, and the honey array model can be effectively adapted to the dynamic change of the network structure and the flow mode through a static and dynamic defense risk collaborative analysis algorithm, so that potential security threats can be continuously monitored and analyzed.

Description

A method for constructing a honey array model based on dynamic perception attack graph

Technical Field

The present invention relates to the field of network security technology, and in particular to a method for constructing a honey array model based on a dynamic perception attack graph.

Background Art

Deception trap network is an advanced defense network system that uses honeypots to deploy virtual networks or assets to attract attackers to attack them, thereby setting up a line of defense between attackers and the company's real assets. When attackers are lured into the trap, the company's real assets are protected and potential damage is avoided.

After investigation, we learned that there are few existing studies on complex and changeable deception trap networks from the perspective of dynamic quantitative security. However, in the face of the complex and changeable network environment, attack methods and strategies are constantly evolving, and static security analysis methods are often difficult to reflect in a timely manner, resulting in a lag in defense strategies. In addition, deception trap networks need to constantly adjust and optimize honey spots to maintain their attractiveness and confusion to attackers, but the lack of dynamic quantitative analysis tools means that these adjustments cannot be optimized based on scientific quantitative data, which may reduce the effectiveness of defense.

Therefore, it is necessary to provide a defense construction method for deceiving and trapping networks that can perform dynamic quantitative analysis to monitor and evaluate network security situation and improve the efficiency of responding to complex attacks.

Summary of the invention

The purpose of the present invention is to provide a honey array model construction method based on dynamic perception attack graph, so as to provide a honey array model construction method that can perceive and analyze the attacker's behavior path in real time and dynamically adjust the honey array structure to enhance the defense effect of deceiving and trapping the network.

In the first aspect, the method for constructing a honey array model based on a dynamic perception attack graph provided by the present invention includes: collecting data to obtain relevant data on network attacks and network defenses to construct an original data set; analyzing the original data set to extract security events and behavior patterns to generate alarm information, and constructing a dynamic perception attack graph based on the original data set and the alarm information; based on the dynamic perception attack graph, designing a static risk collaborative analysis for identifying and evaluating known risks, and designing a dynamic risk collaborative analysis for monitoring and adjusting the data acquired in real time, and constructing a honey array model based on the dynamic perception attack graph.

The beneficial effect of the method for constructing a honey array model based on a dynamic perception attack graph provided by the present invention is that the introduction of a quantitative scheme to construct a dynamic perception attack graph can quantify the dynamic uncertainty of the network and the key parameters in the attack graph, providing a scientific and quantitative reference strategy for network security defense personnel to help them better understand and respond to security threats in the network. With deception and trapping as the core goal, the honey array model can effectively adapt to the dynamic changes of network structure and traffic patterns through static and dynamic defense risk collaborative analysis algorithms to achieve real-time response to the evolution of network elasticity. These algorithms can not only evaluate security risks in the static state of the network, but also continuously monitor and analyze potential security threats during the dynamic changes of the network, thereby providing a more flexible and adaptable defense method for network security.

In one possible embodiment, data collection is performed to obtain relevant data on network attacks and network defense to construct an original data set, including: collecting data from an intrusion rule library, security intelligence, attack trapping system assets, multi-party threat data logs and vulnerability databases to obtain relevant data on network attacks and network defense regarding attack patterns and defense strategies, potential threats, attack behaviors, threat intelligence and security vulnerabilities; integrating relevant data on network attacks and network defense to construct an original data set.

In another possible embodiment, a dynamic perception attack graph is constructed based on the original data set and the alarm information, including: defining attribute honey points and atomic attack honey points, and constructing the structure of the dynamic perception attack graph according to the state of the attribute honey points, the state of the atomic attack honey points, the relationship between the attribute honey points and their root honey points, the relationship between the attribute honey points and the atomic attack honey points, and the relationship between the attribute honey points and the alarm information; quantifying the parameters in the structure of the dynamic perception attack graph, including: calculating the probability of the atomic attack honey points according to the deception trap success rate and NCR-index of the atomic attack honey points, calculating the probability of the local conditions according to the conditional probability of the attribute honey points, calculating the prior probability of the attribute honey points according to the conditional probability of the attribute honey points, and calculating the posterior probability of the attribute honey points according to the relationship between the attribute honey points and the alarm information; and completing the construction of the dynamic perception attack graph according to the structure of the dynamic perception attack graph and the quantification results of the parameters.

In other possible embodiments, designing a static risk collaborative analysis includes designing a perceptual attack graph for a static defense risk collaborative analysis, specifically including: initializing the attack graph for the static defense risk collaborative analysis; obtaining an assignment for a current deception trap for calculating the probability of an atomic attack honey point in the static defense risk collaborative analysis attack graph; obtaining a static reachable probability assignment for an initial attribute honey point, calculating the local conditional probability and the prior probability of the attribute honey point in the static defense risk collaborative analysis attack graph; and updating the parameters of the static defense risk collaborative analysis attack graph to obtain the perceptual attack graph for the static defense risk collaborative analysis.

Designing dynamic risk collaborative analysis includes designing a perceptual attack graph for dynamic defense risk collaborative analysis, specifically including: initializing the dynamic defense risk collaborative analysis attack graph; obtaining the NCR-index of the current deception trap network for updating the prior probability of attribute honey points in the perceptual attack graph of the static defense risk collaborative analysis; obtaining alarm information for calculating the posterior probability of attribute honey points in the dynamic defense risk collaborative analysis attack graph; updating the parameters of the dynamic defense risk collaborative analysis attack graph to obtain the perceptual attack graph of the dynamic defense risk collaborative analysis.

In the second aspect, the present invention also provides a honey array model construction device based on a dynamic perception attack graph, including: a data acquisition unit, used to perform data acquisition to obtain relevant data on network attacks and network defenses to construct an original data set; a dynamic perception attack graph construction unit, used to analyze the original data set to extract security events and behavior patterns to generate alarm information, and construct a dynamic perception attack graph based on the original data set and the alarm information; a honey array model construction unit, used to design a static risk collaborative analysis for identifying and evaluating known risks according to the dynamic perception attack graph, and design a dynamic risk collaborative analysis for monitoring and adjusting the data acquired in real time, and construct a honey array model based on the dynamic perception attack graph.

Among them, the data collection unit collects data to obtain relevant data of network attacks and network defense to construct the original data set, including: collecting data from the intrusion rule library, security intelligence, attack trapping system assets, multi-party threat data logs and vulnerability database to obtain relevant data of network attacks and network defense about attack patterns and defense strategies, potential threats, attack behaviors, threat intelligence and security vulnerabilities; integrating the relevant data of network attacks and network defense to construct the original data set.

The dynamic perception attack graph construction unit constructs a dynamic perception attack graph based on the original data set and the alarm information, including: defining attribute honey points and atomic attack honey points, and constructing the structure of the dynamic perception attack graph according to the state of the attribute honey points, the state of the atomic attack honey points, the relationship between the attribute honey points and their root honey points, the relationship between the attribute honey points and the atomic attack honey points, and the relationship between the attribute honey points and the alarm information; quantifying the parameters in the structure of the dynamic perception attack graph, including: calculating the probability of the atomic attack honey points according to the deception trap success rate and NCR-index of the atomic attack honey points, calculating the probability of the local conditions according to the conditional probability of the attribute honey points, calculating the prior probability of the attribute honey points according to the conditional probability of the attribute honey points, and calculating the posterior probability of the attribute honey points according to the relationship between the attribute honey points and the alarm information; according to the structure of the dynamic perception attack graph and the quantification results of the parameters, the construction of the dynamic perception attack graph is completed.

The honey array model construction unit designs static risk collaborative analysis, including designing a perceived attack graph for static defense risk collaborative analysis, specifically including: initializing the attack graph for static defense risk collaborative analysis; obtaining the assignment of the current deception trap to calculate the probability of atomic attack honey points in the static defense risk collaborative analysis attack graph; obtaining the static reachable probability assignment of the initial attribute honey points, calculating the local conditional probability and the prior probability of the attribute honey points in the static defense risk collaborative analysis attack graph; updating the parameters of the static defense risk collaborative analysis attack graph to obtain the perceived attack graph for static defense risk collaborative analysis.

The honey array model construction unit designs dynamic risk collaborative analysis, including designing a perception attack graph for dynamic defense risk collaborative analysis, specifically including: initializing the dynamic defense risk collaborative analysis attack graph; obtaining the NCR-index of the current deception trap network for updating the prior probability of attribute honey points in the perception attack graph of the static defense risk collaborative analysis; obtaining alarm information for calculating the posterior probability of attribute honey points in the dynamic defense risk collaborative analysis attack graph; updating the parameters of the dynamic defense risk collaborative analysis attack graph to obtain the perception attack graph for the dynamic defense risk collaborative analysis.

In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for constructing a honey array model based on a dynamic perception attack graph is implemented.

In a fourth aspect, the present invention also provides an electronic device, comprising: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the computer program stored in the memory, so that the electronic device executes the above-mentioned method for constructing a honey array model based on a dynamic perception attack graph.

For the beneficial effects of the second to fourth aspects, reference may be made to the description of the first aspect.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a flow chart of a method for constructing a honey array model based on a dynamic perception attack graph provided by an embodiment of the present invention;

FIG2 is a schematic diagram of an example of a situation in which a honey array model is constructed and deployed according to a honey array model construction method based on a dynamic perception attack graph provided by an embodiment of the present invention;

FIG3 is a schematic diagram of an example structure of a dynamic perception attack graph provided by an embodiment of the present invention;

FIG4 is a schematic diagram of an instantiation deployment of a honey array of a power grid system provided by an embodiment of the present invention;

5 is a schematic diagram of a honey array model construction device based on a dynamic perception attack graph provided by an embodiment of the present invention;

FIG. 6 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention.

DETAILED DESCRIPTION

In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

In view of the problems existing in the prior art, an embodiment of the present invention provides a method for constructing a honey array model based on a dynamic perception attack graph.

This embodiment provides a method for constructing a honey array model based on a dynamic perception attack graph. Referring to Figures 1 to 4, the method includes:

S101: Conduct data collection to obtain relevant data on network attacks and network defense to build an original data set.

In S101, in a possible embodiment, data collection is performed to obtain relevant data of network attacks and network defense to construct an original data set, including: collecting data from an intrusion rule library, security intelligence, attack trapping system assets, multi-party threat data logs and a vulnerability database to obtain relevant data of network attacks and network defense about attack patterns and defense strategies, potential threats, attack behaviors, threat intelligence and security vulnerabilities; integrating relevant data of network attacks and network defense to construct an original data set.

Exemplarily, when collecting data, data is collected from five perspectives: intrusion rule base, security intelligence, attack trapping system assets, multi-party threat data logs, and vulnerability databases. The relevant data on network attacks and network defense obtained from the above five perspectives include: the intrusion rule base provides the latest attack patterns and defense strategies, security intelligence helps identify and prevent potential threats, attack trapping system assets record and analyze attack behaviors, multi-party threat data logs integrate threat intelligence from different sources, and vulnerability databases discover and patch security vulnerabilities in a timely manner. Based on the above-mentioned network attack and network defense related data, a dynamic and comprehensive security protection system can be integrated and constructed.

The dynamic perception attack graph DAA-graph is defined through the probabilistic attack graph, and then the DAA-graph structure is constructed, which can characterize the causal coupling relationship and probabilistic reasoning relationship between the attack steps. Quantifying the parameters in the dynamic perception attack graph can provide a new analysis tool for the honey array model based on the dynamic perception attack graph, so that it can more accurately simulate and predict the behavior pattern of attackers. In turn, the honey array model can monitor abnormal activities in the network in real time, evaluate the potential impact of attacks, and dynamically adjust the defense mechanism to cope with the ever-changing network threats.

S102: Analyze the original data set to extract security events and behavior patterns to generate alarm information, and build a dynamic perception attack graph based on the original data set and the alarm information.

In S102, in a possible embodiment, a dynamic-perceived attack graph is constructed based on the original data set and the alarm information, including: defining attribute honey points and atomic attack honey points, and constructing the structure of the dynamic-perceived attack graph according to the state of the attribute honey points, the state of the atomic attack honey points, the relationship between the attribute honey points and their root honey points, the relationship between the attribute honey points and the atomic attack honey points, and the relationship between the attribute honey points and the alarm information; quantifying the parameters in the structure of the dynamic-perceived attack graph, including: calculating the probability of the atomic attack honey points according to the deception trap success rate and NCR-index of the atomic attack honey points, calculating the probability of the local conditions according to the conditional probability of the attribute honey points, calculating the prior probability of the attribute honey points according to the conditional probability of the attribute honey points, and calculating the posterior probability of the attribute honey points according to the relationship between the attribute honey points and the alarm information; and completing the construction of the dynamic-perceived attack graph according to the structure of the dynamic-perceived attack graph and the quantification results of the parameters.

In one possible embodiment, by analyzing and processing the original data set, key security events and behavior patterns can be extracted and further generated into detailed alarm information, which not only provides real-time threat warnings, but also contains specific details about the attack source, path, and potential impact.

The Dynamic Awareness Attack Graph (DAA-graph) of the present invention is constructed based on a dynamic graph, wherein a dynamic graph refers to a graph that is dynamically updated as the state changes, and is also referred to as a graph sequence or a graph flow.

In a specific embodiment, a dynamic perception attack graph is generated by introducing NCR-index into the probability attack graph. In this embodiment, the definition of the dynamic perception attack graph includes:

Definition 1: Define the attribute honeypot as the honeypot that represents the intrusion behavior used to attract and sense the network in the deception trap network, and assign a weight of 0-1 to the honeypot. If the weight of the attribute honeypot is 1, it means that the probability of the honeypot (Honeypot, _Hi ) being invaded by the attacker is P(H _i ) = 1; if the weight of the attribute honeypot is 0, it means that the probability of the honeypot _Hi not being invaded by the attacker is and

Definition 2: The atomic attack honey point _Xi is defined as the deceptive trap network atomic attack based on the transformation of the precondition attribute honey point _Hpre into the subsequent condition attribute honey point _Hpost , and _Hpre is not equal to _Hpost . The probability of the atomic attack honey point from _Hpre to _Hpost is denoted as P( _Xi ), which is often defined as the probability of successful exploitation of the vulnerability relied on by the network attack to quantify. Obviously, P( _Xi )≥0.

Definition 3: The alarm sweet spot _Ai is defined as whether the intrusion detection system observes that the attribute sweet spot _Hi is successfully occupied by the attacker. When the state of the alarm sweet spot is 1, it means that the attribute sweet spot is detected to be successfully invaded. Otherwise, the state of the alarm sweet spot is 0, indicating that the attribute sweet spot is not detected to be occupied by the attacker. When an attack event is detected, the dynamic perception attack graph presents the alarm sweet spot to clearly identify the specific location of the alarm; otherwise, the alarm sweet spot is hidden to reduce the display scale of the dynamic perception attack graph, thereby improving readability.

Definition 4: The dynamic-aware attack graph is a five-tuple consisting of a honeypoint set and an edge set DAA(G) = {V(G), E(G), W(G), R(G), T(G)}, where:

(1) V(G) represents the set of honey points, including attribute honey points, atomic attack honey points, and alarm honey points, that is, v(G) = {H∪X∪A}. Among them, H = {H _i |i∈[n]} = {H _s }∪{H _t }∪{H _e }, which is the set composed of attribute honey points _Hi . At the initial stage of the attack, H _s represents the set of the attacker's initial attribute honey points; during the attack, H _t represents the set of the intermediate attribute honey points visited during the attack; _He represents the set of the attacker's target attribute honey points; X = {X _i |i∈[m]}, which is the set composed of atomic attack honey points _Xi ; A = {A _i |i∈[m]}, which is the set composed of alarm honey points _Ai .

(2) E(G) represents the set of directed edges, E(G) = {E ₁ (G) ∪ E ₂ (G) ∪ E ₃ (G)}. It means that after the attacker has certain resources or permissions, he chooses a certain atomic honey spot to attack _Ai ; Indicates the reliability of the spoofed network connection used to launch the attack; Indicates an alarm issued by an intrusion detection system when it detects an attack.

(3) W(G) represents the set of weighted values of directed edges, i.e., W(G) = (P(X), N, P(A)). Where, P(X) represents the weight of directed edge E ₁ (G), representing the success probability of atomic attack _Xi from state H _pre to H _post ; N represents NCR-index, which describes the impact of the uncertainty of the deceptive trap network on the attack result. P(A) represents the assignment of a value to directed edge E ₃ , representing the probability that the attack behavior has occurred and an alarm has been issued.

(4) R(G) represents the relationship between the attribute honey point set and the root honey point set, that is, the binary (H _j ,D _j ), where D _j {or, and}, when D _j takes or, it is defined as the "parallel or" of the deceptive trap network, which means that only one root honey point is true, that is, the state attribute honey point H _j can be reached. When D _j takes and, it is defined as the "parallel and" of the deceptive trap network, which means that only when the root honey point is true can the state attribute honey point H _j be reached. The root honey point represents the root point of the honey point.

(5) T(G) represents the local conditional probability distribution (LC-PD). P = {ρ _i ∈ [m]} represents the probability association relationship between the honey points and their root honey points of the deceptive trap network. If the honey point V _i has no root honey point, its probability value is obtained according to the prior knowledge, otherwise ρ _i = P(V _i | Pre(V _i )), where Pre(V _i ) represents the set of root honey points of the honey point V _i .

Exemplarily, the construction methods of probabilistic attack graphs and Bayesian attack graphs are used to construct dynamic perception attack graphs. Specifically, the dynamic perception attack graph is constructed according to the defined attribute honey points and atomic attack honey points. The constructed dynamic perception attack graph includes the state of the attribute honey points, the state of the atomic attack honey points, the relationship between the attribute honey points and their root honey points, and the relationship between the attribute honey points and the atomic attack honey points. Then, alarm honey points are added to the attribute honey points, and the alarm honey points are used to describe the alarm information of the attack behavior. Figure 3 is an example structure of the constructed dynamic perception attack graph, where or and and represent the logical relationship between the attribute honey points and their root honey points, and the arrows represent the set of edges E(G). Then, the relevant parameters of the constructed dynamic perception attack graph are quantified, specifically including: calculating the probability of atomic attack honey points, calculating the probability of local conditions, calculating the prior probability of attribute honey points, and calculating the posterior probability of attribute honey points.

In a specific embodiment, the probability of calculating the atomic attack honey spot based on the success rate of deception trapping of the atomic attack honey spot and the NCR-index satisfies the following formula: P(Xi)=Ni*P(X′ _i ), where P(Xi) represents the probability of the atomic attack honey spot, P(X′ _i )=(S _v /10)×(S _c /10)×(S _u /10)×100%, _Ni represents NCR-index, and NCR-index is defined as the degree of certainty of the network relied on during the network attack, and its value range is [0, 1]. When NCR-index is 0, it means that the network is interrupted or physically isolated, and when NCR-index is 1, it means that the network connection is stable. P(X′ _i ) represents the probability of success of deception trapping, S _v , S _c , and _Su are assigned and quantified according to the CVSS standard, and the specific assignment standards are shown in the following table:

CVSS basic attribute levels and scoring values

The correlation between the attribute honey points in the dynamic perception attack graph needs to take into account the influence of the root honey points, so the relationship between the attribute honey points is correlated. The conditional probability of the attribute honey point _Hi is P( _Hi |Pre( _Hi )), and the specific calculation method is different based on different _Dj . The probability of calculating the local condition based on the conditional probability of the attribute honey point satisfies the following formula: When _Dj takes and, When D _j takes or, The root honey point of the alarm honey point _Ai is a single honey point _Xi . The detection rate and false alarm rate are represented by r and f respectively. Represents the probability distribution of the local conditions of the alarm sweet spot _Ai .

One of the main techniques for collaborative analysis of security risks of static deception traps is the prior probability of attribute honey points _Hi . According to the properties of Bayesian networks, the prior probability of each honey point is the joint probability of the current honey point and all its related root honey points. The prior probability of the attribute honey point calculated based on the conditional probability of the attribute honey point satisfies the following formula: Where P ₁ (H _i ) represents the prior probability of attribute honeypoint H _i .

The posterior probability of the attribute honey point is calculated based on the relationship between the attribute honey point and the alarm information. Specifically, the NCR-index is constantly changing in the real deception trap network scenario. New threat events continue to emerge in the field of network security, and these events continue to affect the network security situation. In order to meet these challenges, it is necessary to continuously update security standards and use posterior probability methods to conduct dynamic risk assessment and analysis. A = {A _i |i∈[m]} represents a set of independent alarm times. Assuming that false alarms, false alarms, missed alarms, etc. are ignored, all intrusion behaviors are discovered. According to the local conditional probability calculation formula of the alarm honey point A _i P(A _i |H _i )＝1; otherwise P(A _i |H _i )＝0. According to the corresponding relationship between A _i and H _i , the evidence set He _evi of successful intrusion is obtained, and the state set to be updated H _update＝ HH _evi . For any H _k ∈Hupdate, H _m ∈H _evi , according to the formula Update the reachability probability of H _k to get the posterior probability of the attribute honey point, where P(H _evi ) = Π _k P(H _k = 1), P ₂ (H _k |H _evi ) represents the posterior probability of the attribute honey point, P(H _evi |H _k ) represents the probability of the evidence set being invaded under the premise of the attribute honey point, P(H _k ) represents the probability of the attribute honey point H _k , and P(H _evi ) represents the probability of the evidence set being invaded. The reachability probability refers to the probability of reachability from one attribute honey point in the network to another attribute honey point.

S103: According to the dynamic perception attack graph, static risk collaborative analysis is designed to identify and evaluate known risks, dynamic risk collaborative analysis is designed to monitor and adjust the data obtained in real time, and a honey array model based on the dynamic perception attack graph is constructed.

In S103, in a possible embodiment, designing a static risk collaborative analysis includes designing a perceptual attack graph for a static defense risk collaborative analysis, specifically including: initializing the static defense risk collaborative analysis attack graph; obtaining an assignment for a current deception trap for calculating the probability of an atomic attack honey point in the static defense risk collaborative analysis attack graph; obtaining a static reachable probability assignment for an initial attribute honey point, calculating the local conditional probability and the prior probability of the attribute honey point in the static defense risk collaborative analysis attack graph; and updating the parameters of the static defense risk collaborative analysis attack graph to obtain the perceptual attack graph for the static defense risk collaborative analysis.

Exemplarily, the perceptual attack graph for the static defense risk collaborative analysis is designed as follows: according to the attack graph DAA(G)={V, E, W, R, T}, the static reachability probability P(H ₀ ) of the initial attribute honey point H ₀ and the current deception trap assigned according to expert experience, an attack graph Static_DAG={V, E, W, R, T, P ₁ } for static defense risk analysis is designed, wherein P ₁ represents the prior probability of the attribute honey point. The specific process includes: initializing the parameters of the static defense risk collaborative analysis attack graph Static_DAG, and copying the honey point set, edge set, weighted value set, and related relationships of DAA(G) to Static_DAG. Obtaining the assignment of the current deception trap, and calculating the probability of the atomic attack honey point in the static defense risk collaborative analysis attack graph according to the formula P(Xi)=Ni*P(X′ _i ). Obtaining the static reachability probability assignment of the initial attribute honey point, the reachability probabilities of the remaining attribute honey points in the static defense risk collaborative analysis attack graph can be obtained by calculation, specifically according to the formula and formula Calculate the reachability probability of the attribute honey point, that is, get the local conditional probability. According to the formula The prior probability P ₁ (H _i ) of each attribute honey point is calculated, and P ₁ (H _i ) is copied to the parameter P ₁ in the static defense risk collaborative analysis attack graph. According to the assignment and calculation results obtained above, the parameters of the static defense risk collaborative analysis attack graph are updated to obtain the perception attack graph of the static defense risk collaborative analysis.

In a possible embodiment, designing a dynamic risk collaborative analysis includes designing a perceptual attack graph for a dynamic defense risk collaborative analysis, specifically including: initializing the dynamic defense risk collaborative analysis attack graph; obtaining the NCR-index of the current deception trap network for updating the prior probability of attribute honey points in the perceptual attack graph for the static defense risk collaborative analysis; obtaining alarm information for calculating the posterior probability of attribute honey points in the dynamic defense risk collaborative analysis attack graph; and updating the parameters of the dynamic defense risk collaborative analysis attack graph to obtain the perceptual attack graph for the dynamic defense risk collaborative analysis.

Exemplarily, the perceptual attack graph for dynamic defense risk collaborative analysis is designed as follows: based on the perceptual attack graph Static_DAG for static defense risk analysis, the NCR-index of the current deception trap network, and the alarm information, an attack graph Dynamic_DAG (V, E, W, R, T, P ₁ , P ₂ ) for static defense risk analysis is designed, wherein P ₂ represents the posterior probability of the attribute honey point. The specific process includes: initializing the parameters of the dynamic defense risk collaborative analysis attack graph Dynamic_DAG, and applying the attribute honey points, attack honey points, edge sets, and related relationships of the perceptual attack graph Static_DAG for static defense risk collaborative analysis to Dynamic_DAG. Obtaining the value N of the NCR-index of the current deception trap network is used to update the prior probability P ₁ of the attribute honey points in the perceptual attack graph for static defense risk collaborative analysis. Obtaining the alarm information to obtain the alarm honey point, according to the formula Calculate the posterior probability P ₂ (H _i ) of the attribute honey point, and copy P ₂ (H _i ) to the parameter P ₂ in the dynamic defense risk collaborative analysis attack graph. According to the assignment and calculation results obtained above, update the parameters of the dynamic defense risk collaborative analysis attack graph to obtain the perception attack graph of the dynamic defense risk collaborative analysis.

The method for constructing a honey array model based on a dynamic perception attack graph of the present invention designs a static and dynamic defense risk collaborative algorithm, so that the honey array model can change with the change of the attack and defense situation, so as to adapt to the dynamic elastic evolution of the deception trap network, so as to ensure the complete accuracy and freshness and effectiveness of the deception trap network. For the deception trap network system that has not yet been put into use, a static defense risk collaborative algorithm is adopted, which can perform risk assessment based on the prior probability of attribute honey points, realize the identification and assessment of known risks, and enable the analysis and prediction of potential security threats before the system is deployed. The prior probability based on the attribute honey point refers to the possibility that an attacker is attracted by a specific attribute honey point and launches an attack without any additional information, and the prior probability of an attacker being attracted by a specific attribute is estimated based on the collected data. Combined with the prior probability and the potential impact, the risk value of each attribute honey point is calculated. Therefore, according to the risk assessment results, the attribute honey points that need to be protected first can be determined, and security resources can be reasonably allocated to protect the attribute honey points that are most likely to be attacked. The activities of the attribute honey points are continuously monitored, and a rapid response plan is formulated to deal with potential attacks.

In the real deception trap network scenario, the network connection status presents a high degree of complexity, and new alarm information continues to emerge or disappear. In order to more accurately analyze the security risks in the network, the dynamic defense risk collaborative algorithm continuously updates the dynamic information of the alarm honey spot as a new consideration condition based on the prior probability and calculates the posterior probability accordingly, so as to monitor and adjust the data obtained in real time.

The honey array model based on the dynamic perception attack graph constructed by the present invention is deployed to the new power network system, which can ensure the security of the equipment at all levels of the new power system and the dynamic, entrapment and robustness of the honey points. For example, referring to Figure 4 of the specification, the instantiation deployment of the honey array of the power grid system implemented by the honey array model based on the dynamic perception attack graph includes: first, according to the security requirements of the internal network of the new power system, the security goals are clarified. Secondly, for the main security goals and protected systems, combined with the system equipment and network protocols under the multi-level of the new power network, the honey array diagram of dynamic perception is designed in layers and segments to ensure that each key area has enough entrapment nodes to detect and defend potential attacks. Multiple honey points are deployed at different locations of the power grid system, including network honey points, host honey points, service honey points, etc., to confuse attackers and collect attack behavior data. The honey array monitors the traffic and behavior in the power grid system in real time, and identifies and extracts malicious traffic features by analyzing traffic information, traffic sampling, feature screening and other means. According to the detection results, an attack and defense game analysis is performed to evaluate the threat level of the attack and the effectiveness of the defense measures. Then, the array transformation engine is used to dynamically adjust the honey array according to the results of the attack and defense game analysis, optimizing the defense strategy and the deployment plan of the honey points. Finally, general and customized array designs are carried out for common and specific environments in the new power network to enrich the trapping node deployment strategy in the power network scenario.

The example results show that the honey array model proposed in the present invention can construct a dynamically evolving deception trap network scenario, add dynamic quantitative analysis of conditions such as alarm information, and more accurately reflect the real-time security risk status of the deception trap network, timely discover attack actions, and use them as new judgment conditions to meet the growing demand for quantitative network security analysis of new power systems, and provide quantitative decision-making references for network security defense personnel.

In summary, the honey array model based on the dynamic perception attack graph proposed in the present invention introduces a quantification scheme to construct a dynamic perception attack graph DAA-graph, which can quantify the dynamic uncertainty of the network and the key parameters in the attack graph. This quantification method can provide a scientific and quantitative reference strategy for network security defense personnel to help them better understand and respond to security threats in the network.

Secondly, the technical solution of the present invention takes deception and trapping as the core goal and designs a set of mechanisms to support the dynamic evolution of the network. By proposing static and dynamic defense risk collaborative analysis algorithms, the honey array model can effectively adapt to the dynamic changes of network structure and traffic patterns to achieve real-time response to the elastic evolution of the network. These algorithms can not only evaluate security risks in the static state of the network, but also continuously monitor and analyze potential security threats during the dynamic changes of the network, thereby providing a more flexible and adaptable defense method for network security.

In addition, the honey array model emphasizes the description of the causal coupling relationship and probabilistic reasoning relationship between network attack steps, and enhances the ability to identify attack paths and attacker behavior patterns in the form of probabilistic attack graphs. This enables the honey array model to not only identify known attack patterns, but also predict and defend against emerging and unknown attack methods.

Referring to Figure 5 of the specification, this embodiment also provides a device for constructing a honey array model based on a dynamic perception attack graph, which is used to implement the above method embodiment. The device includes:

The data collection unit 201 is used to collect data to obtain relevant data of network attacks and network defenses to construct an original data set.

The dynamic perception attack graph construction unit 202 is used to analyze the original data set to extract security events and behavior patterns to generate alarm information, and to construct a dynamic perception attack graph based on the original data set and the alarm information.

The honey array model building unit 203 is used to design static risk collaborative analysis for identifying and evaluating known risks according to the dynamic perception attack graph, design dynamic risk collaborative analysis for monitoring and adjusting the data obtained in real time, and build a honey array model based on the dynamic perception attack graph.

Among them, the data collection unit 201 performs data collection to obtain relevant data of network attacks and network defense to construct an original data set, including: collecting data from an intrusion rule library, security intelligence, attack trapping system assets, multi-party threat data logs and vulnerability databases to obtain relevant data of network attacks and network defense about attack patterns and defense strategies, potential threats, attack behaviors, threat intelligence and security vulnerabilities; integrating relevant data of network attacks and network defense to construct an original data set.

The dynamic perception attack graph construction unit 202 constructs a dynamic perception attack graph based on the original data set and the alarm information, including: defining attribute honey points and atomic attack honey points, and constructing the structure of the dynamic perception attack graph according to the state of the attribute honey points, the state of the atomic attack honey points, the relationship between the attribute honey points and their root honey points, the relationship between the attribute honey points and the atomic attack honey points, and the relationship between the attribute honey points and the alarm information; quantifying the parameters in the structure of the dynamic perception attack graph, including: calculating the probability of the atomic attack honey points according to the deception trap success rate and NCR-index of the atomic attack honey points, calculating the probability of the local conditions according to the conditional probability of the attribute honey points, calculating the prior probability of the attribute honey points according to the conditional probability of the attribute honey points, and calculating the posterior probability of the attribute honey points according to the relationship between the attribute honey points and the alarm information; completing the construction of the dynamic perception attack graph according to the structure of the dynamic perception attack graph and the quantification results of the parameters.

The honey array model construction unit 203 designs static risk collaborative analysis, including designing a perceived attack graph for static defense risk collaborative analysis, specifically including: initializing the attack graph for static defense risk collaborative analysis; obtaining the assignment of the current deception trap to calculate the probability of atomic attack honey points in the static defense risk collaborative analysis attack graph; obtaining the static reachable probability assignment of the initial attribute honey points, calculating the local conditional probability and the prior probability of the attribute honey points in the static defense risk collaborative analysis attack graph; updating the parameters of the static defense risk collaborative analysis attack graph to obtain the perceived attack graph for the static defense risk collaborative analysis.

The honey array model construction unit 203 designs dynamic risk collaborative analysis, including designing a perceptual attack graph for dynamic defense risk collaborative analysis, specifically including: initializing the dynamic defense risk collaborative analysis attack graph; obtaining the NCR-index of the current deception trap network for updating the prior probability of attribute honey points in the perceptual attack graph for the static defense risk collaborative analysis; obtaining alarm information for calculating the posterior probability of attribute honey points in the dynamic defense risk collaborative analysis attack graph; updating the parameters of the dynamic defense risk collaborative analysis attack graph to obtain the perceptual attack graph for the dynamic defense risk collaborative analysis.

All relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

In other embodiments of the present application, an electronic device is disclosed in an embodiment of the present application. As shown in FIG6 , the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more applications (not shown); and one or more computer programs 304. The above components may be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the above memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions, which may be used to execute the steps in FIG1 , FIG5 and the corresponding embodiments.

Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

Each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as flash memory, mobile hard disk, read-only memory, random access memory, disk or optical disk.

The above is only a specific implementation of the embodiment of the present application, but the protection scope of the embodiment of the present application is not limited thereto, and any changes or replacements within the technical scope disclosed in the embodiment of the present application should be included in the protection scope of the embodiment of the present application. Therefore, the protection scope of the embodiment of the present application should be based on the protection scope of the claims.

Claims (12)

1. A method for constructing a honey array model based on a dynamic perception attack graph, characterized by comprising: Conduct data collection to obtain relevant data on network attacks and network defense to build original data sets; Analyze the original data set to extract security events and behavior patterns to generate alarm information, and build a dynamic perception attack graph based on the original data set and the alarm information; According to the dynamic perception attack graph, a static risk collaborative analysis is designed to identify and evaluate known risks, a dynamic risk collaborative analysis is designed to monitor and adjust the data obtained in real time, and a honey array model based on the dynamic perception attack graph is constructed. 2. The method according to claim 1, characterized in that data collection is performed to obtain relevant data of network attacks and network defenses to construct an original data set, including: Collect data from intrusion rule bases, security intelligence, attack trapping system assets, multi-party threat data logs and vulnerability databases to obtain relevant data on network attacks and network defenses regarding attack patterns and defense strategies, potential threats, attack behaviors, threat intelligence and security vulnerabilities; The relevant data of the network attack and network defense are integrated to form an original data set. 3. The method according to claim 1, characterized in that constructing a dynamic perception attack graph based on the original data set and the alarm information comprises: Define attribute honey points and atomic attack honey points, and construct a structure of a dynamic perception attack graph according to the state of the attribute honey points, the state of the atomic attack honey points, the relationship between the attribute honey points and their root honey points, the relationship between the attribute honey points and the atomic attack honey points, and the relationship between the attribute honey points and alarm information; Quantifying the parameters in the structure of the dynamic perception attack graph, including: calculating the probability of the atomic attack honey spot according to the deception trap success rate and NCR-index of the atomic attack honey spot, calculating the probability of the local condition according to the conditional probability of the attribute honey spot, calculating the prior probability of the attribute honey spot according to the conditional probability of the attribute honey spot, and calculating the posterior probability of the attribute honey spot according to the relationship between the attribute honey spot and the alarm information; The construction of the dynamic perception attack graph is completed according to the structure of the dynamic perception attack graph and the quantification results of the parameters. 4. The method according to claim 1 is characterized in that designing a static risk collaborative analysis includes designing a perception attack graph of a static defense risk collaborative analysis, specifically including: Initialize the attack graph for static defense risk collaborative analysis; Obtaining the assignment of the current deception trap is used to calculate the probability of the atomic attack honey spot in the static defense risk collaborative analysis attack graph; Obtain the static reachability probability assignment of the initial attribute honey point, calculate the local conditional probability and the prior probability of the attribute honey point in the static defense risk collaborative analysis attack graph; The parameters of the static defense risk collaborative analysis attack graph are updated to obtain the perceived attack graph of the static defense risk collaborative analysis. 5. The method according to claim 4 is characterized in that designing dynamic risk collaborative analysis includes designing a perception attack graph of dynamic defense risk collaborative analysis, specifically including: Initialize the dynamic defense risk collaborative analysis attack graph; Obtaining the NCR-index of the current deception trap network for updating the prior probability of the attribute honey points in the perception attack graph of the static defense risk collaborative analysis; Acquire alarm information to calculate the posterior probability of attribute honey points in the dynamic defense risk collaborative analysis attack graph; The parameters of the dynamic defense risk collaborative analysis attack graph are updated to obtain the perceived attack graph of the dynamic defense risk collaborative analysis. 6. A device for constructing a honey array model based on a dynamic perception attack graph, characterized in that the device comprises: A data collection unit, used for data collection to obtain relevant data on network attacks and network defenses to construct an original data set; A dynamic perception attack graph construction unit, configured to analyze the original data set to extract security events and behavior patterns to generate alarm information, and to construct a dynamic perception attack graph based on the original data set and the alarm information; The honey array model building unit is used to design static risk collaborative analysis for identifying and evaluating known risks according to the dynamic perception attack graph, design dynamic risk collaborative analysis for monitoring and adjusting the data obtained in real time, and build a honey array model based on the dynamic perception attack graph. 7. The device according to claim 6, characterized in that the data acquisition unit performs data acquisition to obtain relevant data of network attacks and network defenses to construct an original data set, comprising: Collect data from intrusion rule bases, security intelligence, attack trapping system assets, multi-party threat data logs and vulnerability databases to obtain relevant data on network attacks and network defenses regarding attack patterns and defense strategies, potential threats, attack behaviors, threat intelligence and security vulnerabilities; The relevant data of the network attack and network defense are integrated to form an original data set. 8. The device according to claim 6, characterized in that the dynamic perception attack graph construction unit constructs a dynamic perception attack graph based on the original data set and the alarm information, comprising: Define attribute honey points and atomic attack honey points, and construct a structure of a dynamic perception attack graph according to the state of the attribute honey points, the state of the atomic attack honey points, the relationship between the attribute honey points and their root honey points, the relationship between the attribute honey points and the atomic attack honey points, and the relationship between the attribute honey points and alarm information; Quantifying the parameters in the structure of the dynamic perception attack graph, including: calculating the probability of the atomic attack honey spot according to the deception trap success rate and NCR-index of the atomic attack honey spot, calculating the probability of the local condition according to the conditional probability of the attribute honey spot, calculating the prior probability of the attribute honey spot according to the conditional probability of the attribute honey spot, and calculating the posterior probability of the attribute honey spot according to the relationship between the attribute honey spot and the alarm information; The construction of the dynamic perception attack graph is completed according to the structure of the dynamic perception attack graph and the quantification results of the parameters. 9. The device according to claim 6, characterized in that the honey array model building unit designs static risk collaborative analysis, including designing a perception attack graph of static defense risk collaborative analysis, specifically including: Initialize the attack graph for static defense risk collaborative analysis; Obtaining the assignment of the current deception trap is used to calculate the probability of the atomic attack honey spot in the static defense risk collaborative analysis attack graph; Obtain the static reachability probability assignment of the initial attribute honey point, calculate the local conditional probability and the prior probability of the attribute honey point in the static defense risk collaborative analysis attack graph; The parameters of the static defense risk collaborative analysis attack graph are updated to obtain the perceived attack graph of the static defense risk collaborative analysis. 10. The device according to claim 9, characterized in that the honey array model building unit designs dynamic risk collaborative analysis, including designing a perception attack graph of dynamic defense risk collaborative analysis, specifically including: Initialize the dynamic defense risk collaborative analysis attack graph; Obtaining the NCR-index of the current deception trap network for updating the prior probability of the attribute honey points in the perception attack graph of the static defense risk collaborative analysis; Acquire alarm information to calculate the posterior probability of attribute honey points in the dynamic defense risk collaborative analysis attack graph; The parameters of the dynamic defense risk collaborative analysis attack graph are updated to obtain the perceived attack graph of the dynamic defense risk collaborative analysis. 11. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for constructing a honey array model based on a dynamic perception attack graph according to any one of claims 1 to 5 is implemented. 12. An electronic device, comprising: a processor and a memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory so that the electronic device executes the method for constructing a honey array model based on a dynamic perception attack graph according to any one of claims 1 to 5.