基于网络防御知识图谱的0day攻击路径预测方法

孙澄; 胡浩; 杨英杰; 张红旗

doi:10.11959/j.issn.2096-109x.2021101

您当前的位置：

首页 >

文章列表页 >

基于网络防御知识图谱的0day攻击路径预测方法

学术论文 | 更新时间：2024-06-03

- 基于网络防御知识图谱的0day攻击路径预测方法
- Prediction method of 0day attack path based on cyber defense knowledge graph
- 网络与信息安全学报 2022年8卷第1期页码：151-166
- 作者机构：
- 作者简介：
  
  [ "孙澄（1991− ），男，江苏常州人，信息工程大学硕士生，主要研究方向为APT检测跟踪" ]
  [ "胡浩（1989− ），男，安徽池州人，博士，信息工程大学讲师，主要研究方向为网络态势感知" ]
  [ "杨英杰（1971− ），男，河南郑州人，博士，信息工程大学教授，主要研究方向为信息安全" ]
  [ "张红旗（1962− ），男，河北遵化人，博士，信息工程大学教授、博士生导师，主要研究方向为网络安全、移动目标防御、等级保护和信息安全管理" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61902427)
- DOI：10.11959/j.issn.2096-109x.2021101
  中图分类号： TP393.08
- 网络首发：2022-02，
  
  纸质出版：2022-02-15
- 稿件说明：
移动端阅览
孙澄, 胡浩, 杨英杰, 等. 基于网络防御知识图谱的0day攻击路径预测方法[J]. 网络与信息安全学报, 2022,8(1):151-166.

Cheng SUN, Hao HU, Yingjie YANG, et al. Prediction method of 0day attack path based on cyber defense knowledge graph[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 151-166.
孙澄, 胡浩, 杨英杰, 等. 基于网络防御知识图谱的0day攻击路径预测方法[J]. 网络与信息安全学报, 2022,8(1):151-166. DOI： 10.11959/j.issn.2096-109x.2021101.

Cheng SUN, Hao HU, Yingjie YANG, et al. Prediction method of 0day attack path based on cyber defense knowledge graph[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 151-166. DOI： 10.11959/j.issn.2096-109x.2021101.

摘要

针对 0day 漏洞未知性造成的攻击检测难问题，提出了一种基于知识图谱的 0day 攻击路径预测方法。通过从现有关于网络安全领域本体的研究成果及网络安全数据库中抽取“攻击”相关的概念及实体，构建网络防御知识图谱，将威胁、脆弱性、资产等离散的安全数据提炼为互相关联的安全知识。在此基础上，依托知识图谱整合的知识，假设并约束0day漏洞的存在性、可用性及危害性等未知属性，并将“攻击”这一概念建模为知识图谱中攻击者实体与设备实体间存在的一种关系，从而将攻击预测问题转化为知识图谱的链接预测问题。采用基于路径排序算法的知识图谱推理方法挖掘目标系统中可能发生的 0day 攻击，并生成 0day 攻击图。复用分类器输出的预测得分作为单步攻击发生概率，通过计算并比较不同攻击路径的发生概率，预测分析 0day 攻击路径。实验证明，所提方法能够依托知识图谱提供的知识体系，为攻击预测提供较全面的知识支持，降低预测分析对专家模型的依赖，并较好地克服 0day 漏洞未知性对预测分析造成的不利影响，提高了 0day 攻击预测的准确性，并且借助路径排序算法基于图结构这一显式特征进行推理的特点，能够对推理结果形成的原因进行有效反溯，从而一定限度上提高了攻击预测分析结果的可解释性。

Abstract

To solve the difficulty of attack detection caused by the 0day vulnerability

a prediction method of 0day attack path based on cyber defense knowledge graph was proposed.The cyber defense knowledge graph was constructed to refine the discrete security data such as threat

vulnerability and asset into the complete and high-related knowledge format by extracting concepts and entities related to network attack from cyber security ontology research finds and databases.Based on the knowledge integrated by the knowledge graph

assumed and restricted the unknown attributes such as the existence

availability and harmfulness of 0day vulnerabilities

and model the concept of ＆quot;attack＆quot; as a relationship between attacker entities and device entities in the knowledge graph to transform the attack prediction to the link prediction of knowledge graph.According to this

apply path ranking algorithm was applied to mine the potential 0day attack in the target system and construct the 0day attack graph.Predicted the 0day attack path by utilizing the scores output by classifiers as the occurrence probabilities of single step attack and computing the occurrence probabilities of different attack paths.The experimental result shows that with the help of complete knowledge system provided by knowledge graph

the proposed method can reduce the dependence of prediction analysis on expert model and overcome the bad influence of 0day vulnerability to improve the accuracy of 0day attack prediction.And utilizing the characteristic that path ranking algorithm reasons based on the structure of graph can also help to backtrack the reasons of predicting results so as to improve the explainability of predicting.

关键词

Keywords

references

MCQUEEN M A , MCQUEEN T A , BOYER W F , et al . Empirical estimates and observations of 0day vulnerabilities [C ] // 2009 42nd Hawaii International Conference on System Sciences . 2009 .

ZHANG S , CARAGEA D , OU X . An empirical study on using the national vulnerability database to predict software vulnerabilities [C ] // Database and Expert Systems Applications-22nd International Conference , 2011 .

WANG L , JAJODIA S , SINGHAL A , et al . k-zero day safety:measuring the security risk of networks against unknown attacks [J ] . Lecture Notes in Computer Science , 2010 , 11 ( 1 ): 573 - 587 .

WANG L , JAJODIA S , SINGHAL A , et al . k-zero day safety:a network security metric for measuring the risk of unknown vulnerabilities [J ] . IEEE Transactions on Dependable ＆ Secure Computing , 2014 , 11 ( 1 ): 30 - 44 .

ALBANESE M , JAJODIA S , SINGHAL A , et al . An efficient framework for evaluating the risk of zero-day vulnerabilities [C ] // International Conference on E-Business and Telecommunications . 2013 .

YANG Y U , XIA C H , XIAO-YUN H U , , et al . An augmented 0-day attack graph generation method [J ] . DEStech Transaction on Computer Science and Engineering , 2016 ( aice-ncs ).

叶子维 . 基于漏洞与攻击图的网络脆弱性分析关键技术研究 [D ] . 郑州:信息工程大学 , 2019 .

YE Z W . Research on key technology of network weakness analysis based on vulnerability and attack graph [D ] . Zhengzhou:Information Engineering University , 2019 .

AHMADINEJAD S H , JALILI S , ABADI M . A hybrid model for correlating alerts of known and unknown attack scenarios and updating attack graphs [J ] . Computer Networks , 2011 , 55 ( 9 ): 2221 - 2240 .

SUN X , DAI J , LIU P , et al . Towards probabilistic identification of zero-day attack paths [C ] // 2016 IEEE Conference on Communications and Network Security (CNS) . 2016 .

SUN X , DAI J , LIU P , et al . Using bayesian networks for probabilistic identification of zero-day attack paths [J ] . IEEE Transactions on Information Forensics and Security , 2018 : 1 - 10 .

SUN X , DAI J , LIU P , et al . Using bayesian networks to fuse intrusion evidences and detect zero-day attack paths [M ] . Network Security Metrics . 2017 .

SINGH U K , JOSHI C , KANELLOPOULOS D . A framework for zero-day vulnerabilities detection and prioritization [J ] . Journal of Information Security and Applications , 2019 , 46 : 164 - 172 .

杨峻楠 , 张红旗 , 张传富 . 基于不完全信息随机博弈的防御决策方法 [J ] . 网络与信息安全学报 , 2018 , 4 ( 8 ): 12 - 20 .

YANG J N , ZHANG H Q , ZHANG C F . Defense decision-making method based on incomplete information stochastic game [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 8 ): 12 - 20 .

冷强 , 杨英杰 , 常德显 , 等 . 面向网络实时对抗的动态防御决策方法 [J ] . 网络与信息安全学报 , 2019 , 5 ( 6 ): 58 - 66 .

LENG Q , YAGN Y J , CHANG D X , et al . Dynamic defense decision method for network real-time confrontation [J ] . Chinese Journal of Network and Information Security , 2019 , 5 ( 6 ): 58 - 66 .

LAO N , COHEN W W . Relational retrieval using a combination of path-constrained random walks [J ] . Machine Learning , 2010 , 81 ( 1 ): 53 - 67 .

AMIT S . Introducing the knowledge graph:things,not strings [EB ] .

LI A . A practical approach to constructing a knowledge graph for cybersecurity [J ] . Engineering , 2018 , 4 ( 1 ): 53 - 60 .

尚怀军 . 面向漏洞库的网安知识库构建技术的研究与实现 [D ] . 长沙:国防科技大学 , 2018 .

SHANG H J . Research and implementation oftechniqueonconstructionofcybersecurityknowledgebaseforvulnerabilitydatabase [D ] . Chagnsha:National University of Defense Technology , 2018 .

谢敏容 . 网络防御知识图谱构建技术研究与实现 [D ] . 成都:电子科技大学 , 2020 .

XIE M R . Research and implementation of cybersecurity knowledge graph construction technology [D ] . Chengdu:University of Electronic Science and Technology of China , 2020 .

SAHOO S S , HALB W , HELLAMNN S , et al . A survey of current approaches for mapping of relational databases to RDF [R ] . W3C RDB2RDF Incubator Group Report,2009 , 1 : 113 - 130 .

LIN Y , SHEN S , LIU Z , et al . Neural relation extraction with selective attention over instances [C ] // Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics . 2016 .

司成 . 基于本体的网络威胁态势推演与评估技术研究 [D ] . 郑州:信息工程大学 , 2015 .

SI C . Research onnetworkthreatsituationdeductionandevaluationtechnologybasedonontology [D ] . Zhengzhou:Information Engineering University , 2015 .

LAO N , MITCHELL T M , COHEN W W . Random walk inference and learning in alarge scale knowledge base [C ] // Conference on Empirical Methods in Natural Language Processing . DBLP , 2011 .

浏览量

1068

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于知识图谱和污点传播的网络攻击检测方法

基于知识图谱的网络安全事件数据推荐算法

人工智能安全知识图谱构建技术研究

可解释的知识图谱推理方法综述

本体摘要技术综述