CN113486336A

Movatterモバイル変換

Info

Publication number: CN113486336A
Application number: CN202110677366.2A
Authority: CN
Inventors: 孙尚勇
Original assignee: New H3C Security Technologies Co Ltd
Current assignee: New H3C Security Technologies Co Ltd
Priority date: 2021-06-18
Filing date: 2021-06-18
Publication date: 2021-10-08

Abstract

Translated fromChinese

本说明书提供一种预测攻击的方法、装置、网关设备和存储介质，该方法包括：获取拓扑内各设备被攻击的历史参数，所述历史参数包括：预设周期内被攻击的次数和攻击者的设备信息，根据所述历史参数，生成各设备间的攻击矩阵，根据所述攻击矩阵计算获得各设备的威胁指数和脆弱指数，根据所述威胁指数和/或脆弱指数预测各设备的攻击性。通过该方法，可以对设备的攻击性进行预测。

This specification provides a method, device, gateway device and storage medium for predicting an attack. The method includes: acquiring historical parameters of each device in the topology being attacked, the historical parameters including: the number of attacks in a preset period and the number of attackers device information, generate an attack matrix between devices according to the historical parameters, calculate and obtain the threat index and vulnerability index of each device according to the attack matrix, and predict the aggressiveness of each device according to the threat index and/or vulnerability index . Through this method, the aggressiveness of the device can be predicted.

Description

Method, device, gateway equipment and storage medium for predicting attack

Technical Field

The present disclosure relates to the field of communications technologies, and in particular, to a method and an apparatus for predicting an attack, a gateway device, and a storage medium.

Background

The internet brings great convenience to our lives, but faces various attacks and threats, and how to effectively and timely discover which devices are dangerous devices which are easy to attack other devices and which devices are fragile devices which are easy to attack by other devices is of great importance to maintaining network security. In reality, in terms of considering the security of the devices, only the number of attacks on the devices is often considered, which devices are easy to attack other devices are not considered, and the attack relationship among the devices is not considered, so that the devices which initiate attacks cannot be stopped, vulnerable devices which are easy to attack by other devices cannot be effectively protected in time, and the attack situation among the devices cannot be effectively predicted.

Disclosure of Invention

The disclosure provides a method, a device, a gateway device and a storage medium for predicting attacks, which can predict the aggressiveness of the device.

The present disclosure provides a method of predicting an attack, the method comprising:

acquiring the attacked historical parameters of each device in the topology, wherein the historical parameters comprise: presetting the attacked times and equipment information of an attacker in a period;

generating an attack matrix among the devices according to the historical parameters;

calculating and obtaining a threat index and a vulnerability index of each device according to the attack matrix;

and predicting the aggressiveness of each device according to the threat index and/or the vulnerability index.

Optionally, the obtaining of the attacked historical parameters of each device in the topology includes:

and collecting log data of each device, and acquiring attacked historical parameters of each device from the log data.

Optionally, the generating an attack matrix between the devices according to the historical parameters includes:

generating a directed graph among the devices according to the historical parameters;

and converting the directed graph into an attack matrix, wherein the row vector of the attack matrix represents the times of attacking other equipment by each equipment, and the column vector represents the times of attacking other equipment by each equipment.

Optionally, the calculating and obtaining the threat index and the vulnerability index of each device according to the attack matrix includes:

determining a threat index of each device according to the sum of the row vectors of the attack matrix;

and determining the vulnerability index of each device according to the sum of the column vectors of the attack matrix.

Optionally, the predicting the aggressiveness of each device according to the threat index and/or the vulnerability index includes:

setting a threat threshold and a vulnerability threshold;

determining whether a threat index and/or a vulnerability index of a target device of the devices exceeds the threat threshold and/or the vulnerability threshold;

if yes, predicting that the target equipment is strong in aggressivity;

and if not, predicting that the target equipment is weak in aggressivity.

The present disclosure also provides a device for predicting attacks, the device comprising:

an obtaining module, configured to obtain a history parameter of each attacked device in the topology, where the history parameter includes: presetting the attacked times and equipment information of an attacker in a period;

the calculation module is used for generating an attack matrix among the devices according to the historical parameters;

the calculation module is further used for calculating and obtaining a threat index and a vulnerability index of each device according to the attack matrix;

and the prediction module is used for predicting the aggressiveness of each device according to the threat index and/or the vulnerability index.

Optionally, the obtaining module is specifically configured to collect log data of each device, and obtain an attacked history parameter of each device from the log data.

Optionally, the computing module is specifically configured to generate a directed graph among the devices according to the historical parameters;

Optionally, the computing module is specifically configured to determine a threat index of each device according to a sum of row vectors of the attack matrix;

Optionally, the prediction module is specifically configured to set a threat threshold and a vulnerability threshold;

if yes, predicting that the target equipment is strong in aggressivity;

and if not, predicting that the target equipment is weak in aggressivity.

The present disclosure also provides a network management device, which includes: a memory, a processor and a program stored on the memory and executable on the processor, the program implementing any of the above method steps when executed by the processor.

The present disclosure also provides a computer readable storage medium having a program stored thereon, which when executed by a processor, performs any of the method steps described above.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present specification and together with the description, serve to explain the principles of the specification.

Fig. 1 is a schematic flowchart of a method for predicting an attack according to an embodiment of the present disclosure.

Fig. 2 is a schematic diagram of a network topology according to an embodiment of the present disclosure.

Detailed Description

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present specification. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the specification, as detailed in the appended claims.

The terminology used in the description herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the description. As used in this specification and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used herein to describe various information, these information should not be limited to these terms. These terms are only used to distinguish one type of information from another. For example, the first information may also be referred to as second information, and similarly, the second information may also be referred to as first information, without departing from the scope of the present specification. The word "if" as used herein may be interpreted as "at … …" or "when … …" or "in response to a determination", depending on the context.

The present disclosure provides a method of predicting an attack, as shown in fig. 1, the method comprising:

s101, acquiring attacked historical parameters of each device in the topology, wherein the historical parameters comprise: presetting the attacked times and equipment information of an attacker in a period;

s102, generating an attack matrix among the devices according to the historical parameters;

s103, calculating and obtaining a threat index and a vulnerability index of each device according to the attack matrix;

s104, predicting the aggressiveness of each device according to the threat index and/or the vulnerability index.

In this embodiment, the foregoing steps may be executed by the network management device, specifically, in step S101, the network management device may acquire data information of each device within a control range of the network management device through the log collector, and analyze the data information of each device according to a predefined analysis rule, so as to obtain an attacked history parameter of each device.

In general, the log information of the attacked device includes information of the attacking device (for example, information such as a device number and an address of the attacking device), and the log information of the attacking device does not include information of the attacked device, so that the history parameters obtained by analyzing the data information include: and presetting the attacked times and the equipment information of the attacker in the period. The preset period may be determined by an administrator, and in this embodiment, the preset period may be one hour.

In this embodiment, in order to count the information of the initiating attacking device and the information of the attacked device and visually show the relationship between the attacking device and the attacked device, a directed graph may be constructed according to the history parameters, as shown in fig. 2, V1, V2, V3, V4, V5, V6, and V7 are vertices of the directed graph, respectively represent device 1,device 2,device 3,device 4,device 5,device 6, anddevice 7, and arrows are edges of the directed graph, which represent directions in which one device attacks another device. The numbers on the arrows indicate the number of times one device attacks another device, the in-arrows at the vertices indicate the number of times one device is attacked by another device, and the out-arrows at the vertices indicate the number of times one device attacks another device.

According to the content in fig. 2, an attack matrix between devices is generated, as shown in the following matrix:

in the matrix, the row vector represents a device V_iNumber of attacks on other devices, column vector device V of matrix_iThe number of attacks by other devices, since the device is unlikely to attack itself, the values of the main diagonal elements of the matrix are all 0.

In step S103, the threat index and the vulnerability index of each device may be obtained based on the attack matrix, and specifically, the threat index of each device may be determined according to the sum of the row vectors of the attack matrix, and the vulnerability index of each device may be determined according to the sum of the column vectors of the attack matrix.

In practical application, the threat index of each device is determined by using the sum of the row vectors of the attack matrix, and the vulnerability index of each device is determined according to the sum of the column vectors of the attack matrix through the following formula.

The formula I is as follows:

formula one for calculationThreat index, wherein A_iFor representing the threat index of a certain device, n representing n devices, d_ijIs the weight of the directed graph, representing the device V_iAttack device V_jThe number of times. Device V_iThe threat level of (c) is the sum of the ith row of the matrix.

The formula II is as follows:

equation two is used to calculate the vulnerability index, where B_iFor indicating the vulnerability index of a certain device, n for n devices, d_jiIs the weight of the directed graph, representing the device V_iIs subjected to equipment V_jThe number of attacks. Device V_iIs the sum of the ith column of the matrix.

In practical application, whether the corresponding device is strong or weak may be determined by taking the threat index or the vulnerability index as a reference, and of course, whether the corresponding device is strong or weak may also be determined by taking the threat index and the vulnerability index together, and a more accurate prediction result may be obtained by determining the two parameters together.

In this embodiment, to implement automatic early warning, an administrator may set a threat threshold and a vulnerability threshold in a management device applying the scheme, and when a threat index and/or a vulnerability index of a certain device is greater than the threat threshold and/or the vulnerability threshold (the threat index is greater than the threat threshold and/or the vulnerability index is greater than the vulnerability threshold), the device is considered to have a strong possibility of attack, and the device is considered to be strong in aggressiveness; otherwise, the possibility of the attack of the device is considered to be weak.

According to the embodiment, the obtained historical parameters of each device can be used for predicting the aggressiveness of each device, and if the system detects that a certain device is strong in aggressiveness, an alarm can be output to prompt an administrator that the certain device is strong in aggressiveness and needs to be monitored intensively.

Based on the same concept as the above method embodiments, the embodiments of the present disclosure further provide an attack prediction apparatus, which includes:

if yes, predicting that the target equipment is strong in aggressivity;

and if not, predicting that the target equipment is weak in aggressivity.

Based on the foregoing embodiments, the present disclosure further provides a network management device, where the network management device can obtain a topology map of a managed network, and the network management device includes: a memory, a processor and a program stored on the memory and executable on the processor, which when executed by the processor implements the various embodiments described above.

The present disclosure also provides a computer-readable storage medium having a program stored thereon, which when executed by a processor, implements the above-described embodiments.

The foregoing description has been directed to specific embodiments of this disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.

Other embodiments of the present description will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This specification is intended to cover any variations, uses, or adaptations of the specification following, in general, the principles of the specification and including such departures from the present disclosure as come within known or customary practice within the art to which the specification pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the specification being indicated by the following claims.

It will be understood that the present description is not limited to the precise arrangements described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

The above description is only a preferred embodiment of the present disclosure, and should not be taken as limiting the present disclosure, and any modifications, equivalents, improvements, etc. made within the spirit and principle of the present disclosure should be included in the scope of the present disclosure.