CN114598502A - Attack path risk detection method, electronic device and readable storage medium - Google Patents

Abstract

The invention discloses an attack path risk detection method, an electronic device and a readable storage medium. The attack path risk detection method comprises the following steps: acquiring a topology relationship between various network devices; determining a target network device according to the topology relationship Corresponding attack path; determine the relevant network equipment on the attack path where the target network equipment is located; obtain attribute information of the relevant network equipment and the target network equipment, and determine the target network equipment and all relevant network equipment according to the attribute information The security score of the relevant network device; according to the security score of the target network device and the relevant network device on each attack path, a risk path is determined in each attack path. The present invention determines the security score according to the attribute information of the network equipment, and determines the risk value of each attack path according to the security score, thereby determining the risk path and achieving the purpose of finding the risk path before the attack occurs.

Description

Attack path risk detection method, electronic device and readable storage medium

technical field

The present invention relates to the field of network security, and in particular, to an attack path risk detection method, an electronic device and a readable storage medium.

Background technique

More and more attention is paid to network security, and there are more and more related network security technologies and devices. In order to enhance network security, some security devices are usually added to the local area network, but they are still easily broken by hackers. Most technologies and devices trace the source after being attacked, or intercept when attacked, without discovering the possible risk paths in the network before the attack occurs.

The above content is only used to assist the understanding of the technical solutions of the present invention, and does not mean that the above content is the prior art.

SUMMARY OF THE INVENTION

The main purpose of the present invention is to provide an attack path risk detection method, which aims to perform a security score according to the attribute information of network equipment, and find possible risk paths according to the security score, so as to achieve the purpose of finding risk paths before an attack occurs. .

In order to achieve the above object, the present invention provides a method for detecting an attack path risk. The method for detecting an attack path risk includes the following steps:

Obtain the topology relationship between various network devices;

Determine the attack path corresponding to the target network device according to the topological relationship;

Determine the relevant network devices on the attack path where the target network device is located;

Obtain attribute information of the relevant network device and the target network device, and determine the security score of the target network device and the relevant network device according to the attribute information, wherein the attribute information includes device function, device version , the device model, and the apps installed on the device;

A risk path is determined in each attack path according to the security scores of the target network device and the related network device on each attack path.

Further, the step of determining a risk path in each attack path according to the security score of the target network device and the related network device on each attack path includes:

Obtain the risk value of each attack path according to the security score of the target network device and the related network device on each attack path;

The risk path is determined according to the risk value.

Further, the step of determining the risk path according to the risk value includes:

Obtain the attack path with the smallest risk value or the risk value less than the preset threshold;

The risk path is determined according to an attack path with a minimum risk value or a risk value smaller than a preset threshold.

Further, the step of determining the risk path according to the attack path with the smallest risk value or the risk value less than a preset threshold includes:

When the number of attack paths with the minimum risk value or the risk value less than the preset threshold is at least two, determine the risk path according to the number of network devices on the attack path with the minimum risk value or the risk value less than the preset threshold;

When the number of attack paths with the smallest risk value or the risk value smaller than the preset threshold is single, the attack path with the smallest risk value or the risk value smaller than the preset threshold is used as the risk path.

Further, the step of obtaining the risk value of each attack path according to the security score of the target network device and the relevant network device on each attack path includes:

Determine the total score value of the attack path according to the security scores of the target network device and the related network device in the same attack path;

The risk value of the attack path is determined according to the total score and the number of devices on the attack path.

Further, the step of determining the risk value of the attack path according to the total score and the number of devices on the attack path includes:

Divide the total score of each attack path by the number of devices on the attack path to obtain the average score corresponding to the attack path;

The risk value is determined based on the average score.

Further, after the step of determining a risk path in each attack path according to the security score of the target network device and the related network device on each attack path, the method further includes:

The risk path is highlighted in the topology map corresponding to the topology relationship.

In addition, in order to achieve the above object, the present invention provides an electronic device, the electronic device includes a memory, a processor, and an attack path risk detection program stored on the memory and executable on the processor, the attack path risk detection program When the path risk detection program is executed by the processor, the steps of any one of the attack path risk detection methods described above are implemented.

In addition, in order to achieve the above object, the present invention provides a readable storage medium, on which an attack path risk detection program is stored, and when the attack path risk detection program is executed by a processor, any of the above-mentioned items are implemented. The steps of the attack path risk detection method described above.

In the technical scheme of the present invention, the topology relationship between each network device is obtained; the attack path corresponding to the target network device is determined according to the topology relationship; the relevant network devices on the attack path where the target network device is located are determined; attribute information of the network device and the target network device, and determine the security score of the target network device and the related network device according to the attribute information, wherein the attribute information includes device function, device version, device model and The application installed on the device; according to the security score of the target network device and the related network device on each attack path, determine the risk path in each attack path. In this way, the present invention determines the security score of the target network device and the related network device according to the attribute information of the target network device and the related network device, and determines the risk value of each attack path according to the security score and the number of network devices on the attack path. The risk value determines the risk path, so as to achieve the purpose of finding the risk path before the attack occurs.

Description of drawings

1 is a schematic diagram of a device structure of a hardware operating environment involved in an embodiment of the present invention;

FIG. 2 is a schematic flowchart of an embodiment of an attack path risk detection method according to the present invention;

FIG. 3 is a schematic flow chart of the refinement of step S500 in the attack path risk detection method of the present invention;

FIG. 4 is a schematic flow chart of the refinement of step S520 in the attack path risk detection method of the present invention;

FIG. 5 is a schematic diagram of a refinement flow of step S510 in the attack path risk detection method of the present invention.

The realization, functional characteristics and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments.

Detailed ways

It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

The main technical scheme of the present invention is:

Obtain the topology relationship between various network devices;

Determine the attack path corresponding to the target network device according to the topological relationship;

Determine the relevant network devices on the attack path where the target network device is located;

Obtain attribute information of the relevant network device and the target network device, and determine the security score of the target network device and the relevant network device according to the attribute information, wherein the attribute information includes device function, device version , the device model, and the apps installed on the device;

A risk path is determined in each attack path according to the security scores of the target network device and the related network device on each attack path.

In related technologies, most technologies and devices trace the source after being attacked, or intercept when attacked, and do not discover possible risk paths in the network before the attack occurs.

In the technical scheme of the present invention, the topology relationship between each network device is obtained; the attack path corresponding to the target network device is determined according to the topology relationship; the relevant network devices on the attack path where the target network device is located are determined; attribute information of the network device and the target network device, and determine the security score of the target network device and the related network device according to the attribute information, wherein the attribute information includes device function, device version, device model and The application installed on the device; according to the security score of the target network device and the related network device on each attack path, determine the risk path in each attack path. In this way, the present invention determines the security score of the target network device and the related network device according to the attribute information of the target network device and the related network device, and determines the risk value of each attack path according to the security score and the number of network devices on the attack path. The risk value determines the risk path, so as to achieve the purpose of finding the risk path before the attack occurs.

As shown in FIG. 1 , FIG. 1 is a schematic diagram of a hardware operating environment of a terminal involved in an embodiment of the present invention.

As shown in FIG. 1 , the terminal may include: a processor 1001 , such as a CPU, a network interface 1004 , a user interface 1003 , a memory 1005 , and a communication bus 1002 . Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a touch screen and/or keys, etc., and the optional user interface 1003 may also include a standard wired interface and a wireless interface. Optionally, the network interface 1004 may include a standard wired interface, a wireless interface (eg, non-vol at i l e memory), such as a disk storage. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001 .

Those skilled in the art can understand that the structure of the terminal shown in FIG. 1 does not constitute a limitation on the terminal, and may include more or less components than the one shown, or combine some components, or arrange different components.

As shown in FIG. 1 , the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an attack path risk detection program.

In the terminal shown in FIG. 1 , the network interface 1004 is mainly used to connect to the background server and perform data communication with the background server; the user interface 1003 is mainly used to connect to the client (client) and perform data communication with the client; and the processor 1001 can be used to invoke the attack path risk detection program stored in memory 1005 and perform the following operations:

Obtain the topology relationship between various network devices;

Determine the attack path corresponding to the target network device according to the topological relationship;

Determine the relevant network devices on the attack path where the target network device is located;

Obtain attribute information of the relevant network device and the target network device, and determine the security score of the target network device and the relevant network device according to the attribute information, wherein the attribute information includes device function, device version , the device model, and the apps installed on the device;

A risk path is determined in each attack path according to the security scores of the target network device and the related network device on each attack path.

Further, the processor 1001 can call the attack path risk detection program stored in the memory 1005, and also perform the following operations:

Obtain the risk value of each attack path according to the security score of the target network device and the related network device on each attack path;

The risk path is determined according to the risk value.

Further, the processor 1001 can call the attack path risk detection program stored in the memory 1005, and also perform the following operations:

Obtain the attack path with the smallest risk value or the risk value less than the preset threshold;

The risk path is determined according to an attack path with a minimum risk value or a risk value smaller than a preset threshold. Further, the processor 1001 can call the attack path risk detection program stored in the memory 1005, and also perform the following operations:

When the number of attack paths with the minimum risk value or the risk value less than the preset threshold is at least two, determine the risk path according to the number of network devices on the attack path with the minimum risk value or the risk value less than the preset threshold;

When the number of attack paths with the smallest risk value or the risk value smaller than the preset threshold is single, the attack path with the smallest risk value or the risk value smaller than the preset threshold is used as the risk path.

Further, the processor 1001 can call the attack path risk detection program stored in the memory 1005, and also perform the following operations:

Determine the total score value of the attack path according to the security scores of the target network device and the related network device in the same attack path;

The risk value of the attack path is determined according to the total score and the number of devices on the attack path.

Further, the processor 1001 can call the attack path risk detection program stored in the memory 1005, and also perform the following operations:

Divide the total score of each attack path by the number of devices on the attack path to obtain the average score corresponding to the attack path;

The risk value is determined based on the average score.

Further, the processor 1001 can call the attack path risk detection program stored in the memory 1005, and also perform the following operations:

The risk path is highlighted in the topology map corresponding to the topology relationship.

As shown in FIG. 2, in an embodiment of the present invention, the attack path risk detection method includes the following steps:

Step S100, obtaining the topology relationship between each network device;

In this embodiment, the topology relationship between each network device is determined by manually setting or scanning all devices. A corresponding topology map is drawn according to the topology relationship between each network device.

Step S200, determining an attack path corresponding to the target network device according to the topology relationship;

In this embodiment, after the target network device is determined, all attack paths of the target network device are found through in-depth traversal according to the topology relationship between each network device.

Step S300, determining the relevant network devices on the attack path where the target network device is located;

In this embodiment, the devices on the attack path include the target network device and related network devices. Since the risk value corresponding to the attack path needs to be determined, the security scores of all devices on each attack path need to be determined. Therefore, when determining the target network device After all attack paths have been identified, related network devices other than the target network device on each attack path need to be determined.

Step S400: Obtain attribute information of the relevant network device and the target network device, and determine the security score of the target network device and the relevant network device according to the attribute information, wherein the attribute information includes device functions , device version, device model, and installed apps on the device;

In this embodiment, after determining the network devices on each attack path, that is, the target network device and the related network device, the attribute information of the target network device and the related network device is obtained. It is assumed that the attribute information is obtained from the information input in the interface, and the attribute information can also be determined by scanning each network device. The attribute information includes device function, device version, device model, and installed applications of the device. Through the attribute information, the security score of the target network device and the related network device is determined according to a preset calculation method. The higher the security score is, the more secure the corresponding network device is and is not easily broken.

Step S500: Determine a risk path in each attack path according to the security scores of the target network device and the related network device on each attack path.

In this embodiment, after determining the security scores of each network device on each of the attack paths, the security scores of the target network devices and all related network devices on each of the attack paths are added to obtain each The total score corresponding to the attack path. Determine the number of network devices on each of the attack paths, including target network devices and related network devices. The total score of each attack path is divided by the number of network devices on the attack path to obtain an average score corresponding to the attack path, which is used as the risk value of the attack path. Determine the attack path with the smallest risk value or the attack path with the risk value less than the preset threshold as the risk path. When the number of attack paths with the minimum risk value or the risk value less than the preset threshold is at least two, the risk path is determined according to the number of network devices on the attack path with the minimum risk value or the risk value less than the preset threshold.

To sum up, in the technical solution of the present invention, the topology relationship between each network device is obtained; the attack path corresponding to the target network device is determined according to the topology relationship; the relevant network devices on the attack path where the target network device is located are determined ; Obtain the attribute information of the relevant network equipment and the target network equipment, and determine the security score of the target network equipment and the relevant network equipment according to the attribute information, wherein the attribute information includes device functions, equipment version, device model, and installed applications on the device; according to the security score of the target network device and the related network device on each attack path, determine the risk path in each attack path. In this way, the present invention determines the security score of the target network device and the related network device according to the attribute information of the target network device and the related network device, and determines the risk value of each attack path according to the security score and the number of network devices on the attack path. The risk value determines the risk path, so as to achieve the purpose of finding the risk path before the attack occurs.

As shown in FIG. 3, in an embodiment of the present invention, the step S500 includes:

Step S510, obtaining the risk value of each attack path according to the security score of the target network device and the relevant network device on each attack path;

Step S520, determining the risk path according to the risk value.

In this embodiment, after obtaining the security scores of the target network device and the related network devices on each attack path, the security scores corresponding to all network devices on the same attack path are added to obtain the total score of the attack path. points. Get the number of network devices on each attack path, including target network devices and related network devices. Divide the total score of each of the attack paths by the corresponding number of network devices to obtain an average score, which is used as the risk value of the attack path. more likely. Among the attack paths of the target network device, the attack path with the smallest risk value or the risk value less than the preset threshold is used as the risk path. When the number of attack paths with the smallest risk value or the risk value less than the preset threshold is at least two, the risk path is determined according to the number of network devices on the attack path with the smallest risk value or the risk value less than the preset threshold. In this way, by obtaining the security scores of the network devices in all attack paths of the target network device, the risk value corresponding to each attack path is determined, and the risk path is determined according to the risk value, so as to find the risk path before the attack occurs.

As shown in FIG. 4 , in an embodiment of the present invention, the step S520 includes:

Step S521, acquiring the attack path with the smallest risk value or the risk value less than a preset threshold;

Step S522: Determine the risk path according to the attack path with the smallest risk value or the risk value is less than a preset threshold.

In this embodiment, after the risk values of all attack paths of the target network device are determined, the risk paths are determined according to the risk values. Compare the risk values of all the attack paths, and if the risk values of at least two attack paths are the smallest or less than the preset threshold, determine the number of network devices on each of the attack paths with the smallest risk or less than the preset threshold , take the attack path with a small number of network devices as the risk path; if there is only one attack path with the smallest risk value or less than the preset threshold, the attack path with the smallest risk value or less than the preset threshold is taken as the risk path. In this way, by comparing the risk value of the risk path corresponding to the target network device, the purpose of finding the risk path before the attack occurs is achieved.

Further, in an embodiment of the present invention, the step S522 includes:

When the number of attack paths with the minimum risk value or the risk value less than the preset threshold is at least two, determine the risk path according to the number of network devices on the attack path with the minimum risk value or the risk value less than the preset threshold;

When the number of attack paths with the smallest risk value or the risk value smaller than the preset threshold is single, the attack path with the smallest risk value or the risk value smaller than the preset threshold is used as the risk path.

In this embodiment, after comparing the risk values of all attack paths of the target network device, an attack path with the smallest risk value or an attack path with a risk value smaller than a preset threshold is determined. When the attack path with the smallest risk value or the number of attack paths with the risk value less than the preset threshold is single, the attack path with the smallest risk value or the attack path with the risk value less than the preset threshold is used as the risk path; when the attack path with the smallest risk value is the risk path When the number of paths or attack paths with a risk value less than a preset threshold is at least two, determine the attack path corresponding to the risk value, and determine the number of network devices in the attack path, including the target network device and related network devices, Compare the number of network devices in multiple attack paths, and determine the attack path with the smallest number of network devices as the risk path. In this way, when at least two attack paths are found according to the risk value, the number of network devices in the attack paths is determined, and the attack path with a smaller number is used as the risk path to achieve the purpose of finding the risk path before the attack occurs.

As shown in FIG. 5, in an embodiment of the present invention, the step S510 includes:

Step S511, determining the total score of the attack path according to the security scores of the target network device and the related network device in the same attack path;

Step S512: Determine the risk value of the attack path according to the total score and the number of devices on the attack path.

In this embodiment, after finding all attack paths to attack the target network device through deep traversal and according to the topology relationship between network devices, according to the attribute information of the target network device and the related network devices in each of the attack paths, A security score for the target network device and associated network devices in each of the attack paths is determined. The security scores of the network devices on the same attack path are added together, including the security score of the target network device and the security scores of the related network devices in the attack path, to obtain the total score value of the attack path. Determine the number of network devices in each of the attack paths. The risk value of the attack path is determined according to the total score and the number of network devices on the attack path. In this way, the total score of the attack path is determined by the security score of each network device in each attack path, the number of devices on the attack path is determined, and the attack path is determined according to the total score corresponding to the attack path and the number of devices In order to determine the risk path according to the risk value, the purpose of finding the risk path before the attack occurs.

Further, in an embodiment of the present invention, the step S512 includes:

Divide the total score of each attack path by the number of devices on the attack path to obtain the average score corresponding to the attack path;

The risk value is determined based on the average score.

In this embodiment, the total score value of the attack path is determined according to the obtained security score of network devices in each attack path, and the number of network devices on the attack path is determined. Divide the total score of each attack path by the number of network devices in the attack path to obtain an average score corresponding to the attack path. The average score is used as the risk value of the attack path. The lower the risk value is, the easier it is to successfully attack the target network device through the attack path. In this way, by calculating the total score value corresponding to the attack path and determining the corresponding number of devices, the risk value corresponding to the attack path is obtained, thereby determining the risk path and achieving the purpose of finding the risk path before the attack occurs.

Further, in an embodiment of the present invention, after the step S500, the method further includes:

The risk path is highlighted in the topology map corresponding to the topology relationship.

In this embodiment, after determining the topology relationship between each network device, a corresponding topology map is drawn according to the topology relationship. After the risk path is determined, the risk path is highlighted in the topology map, eg, the risk path is highlighted in red. In this way, by highlighting the risk path in the topology diagram, the user is reminded that the target network device is most likely to be attacked through the risk path, so that the user can carry out targeted analysis of the network link by adding a security device to the risk path and other methods. Optimization and protection.

In addition, in order to achieve the above object, the present invention provides an electronic device, the electronic device includes a memory, a processor, and an attack path risk detection program stored on the memory and executable on the processor, the attack path risk detection program When the path risk detection program is executed by the processor, the steps of any one of the attack path risk detection methods described above are implemented.

In addition, in order to achieve the above object, the present invention provides a readable storage medium, on which an attack path risk detection program is stored, and when the attack path risk detection program is executed by a processor, any of the above-mentioned items are implemented. The steps of the attack path risk detection method described above.

The above-mentioned serial numbers of the embodiments of the present invention are only for description, and do not represent the advantages or disadvantages of the embodiments.

From the description of the above embodiments, those skilled in the art can clearly understand that the method of the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is better implementation. Based on such understanding, the technical solutions of the present invention can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products are stored in a storage medium (such as ROM/RAM) as described above. , magnetic disk, optical disc), including several instructions to make a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present invention.

The above are only preferred embodiments of the present invention, and are not intended to limit the scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present invention, or directly or indirectly applied in other related technical fields , are similarly included in the scope of patent protection of the present invention.

Claims (9)

1. an attack path risk detection method, is characterized in that, described attack path risk detection method comprises the following steps: Obtain the topology relationship between various network devices; Determine the attack path corresponding to the target network device according to the topological relationship; Determine the relevant network devices on the attack path where the target network device is located; Obtain attribute information of the relevant network device and the target network device, and determine the security score of the target network device and the relevant network device according to the attribute information, wherein the attribute information includes device function, device version , the device model, and the apps installed on the device; A risk path is determined in each attack path according to the security scores of the target network device and the related network device on each attack path. 2 . The attack path risk detection method according to claim 1 , wherein the risk is determined in each attack path according to the security score of the target network device and the related network device on each attack path. 3 . The steps of the path include: Obtain the risk value of each attack path according to the security score of the target network device and the related network device on each attack path; The risk path is determined according to the risk value. 3. The attack path risk detection method according to claim 2, wherein the step of determining the risk path according to the risk value comprises: Obtain the attack path with the smallest risk value or the risk value less than the preset threshold; The risk path is determined according to an attack path with a minimum risk value or a risk value smaller than a preset threshold. 4. The attack path risk detection method according to claim 3, wherein the step of determining the risk path according to an attack path with a minimum risk value or a risk value less than a preset threshold comprises: When the number of attack paths with the minimum risk value or the risk value less than the preset threshold is at least two, determine the risk path according to the number of network devices on the attack path with the minimum risk value or the risk value less than the preset threshold; When the number of attack paths with the smallest risk value or the risk value smaller than the preset threshold is single, the attack path with the smallest risk value or the risk value smaller than the preset threshold is used as the risk path. 5 . The attack path risk detection method according to claim 2 , wherein, according to the security score of the target network device and the related network device on each attack path, obtain each of the attack paths. 6 . The VaR steps include: Determine the total score value of the attack path according to the security scores of the target network device and the related network device in the same attack path; The risk value of the attack path is determined according to the total score and the number of devices on the attack path. 6. The attack path risk detection method according to claim 5, wherein the step of determining the risk value of the attack path according to the total score and the number of devices on the attack path comprises: Divide the total score of each attack path by the number of devices on the attack path to obtain the average score corresponding to the attack path; The risk value is determined based on the average score. 7 . The attack path risk detection method according to claim 1 , wherein the risk is determined in each attack path according to the security score of the target network device and the related network device on each attack path. 8 . After the steps of the path, also include: The risk path is highlighted in the topology map corresponding to the topology relationship. 8. An electronic device, characterized in that the electronic device comprises a memory, a processor, and an attack path risk detection program stored on the memory and executable on the processor, the attack path risk detection program The steps of implementing the attack path risk detection method according to any one of claims 1 to 7 when executed by the processor. 9. A readable storage medium, wherein an attack path risk detection program is stored on the readable storage medium, and when the attack path risk detection program is executed by a processor, any one of claims 1 to 7 is implemented. The steps of the attack path risk detection method described in item.

Images