Apparatus for inferring cyberattack path based on attention, and apparatus and method for training intelligent attack path prediction model
Disclosed herein are an apparatus and method for inferring a cyberattack path based on attention. The apparatus includes memory in which at least one program is recorded and a processor for executing the program. The program generates test data required for generating an intelligent attack graph and generates an attack graph based on an intelligent attack path prediction model.
1. An apparatus for training an intelligent attack path prediction model, comprising:
memory in which at least one program is recorded; and
a processor for executing the program,
wherein the program performs generating and collecting a virtual network topology and host asset information required for predicting cyberattack vulnerabilities in a computer network system;
extracting at least one of global feature data and specific feature data from the collected network topology and host asset information; and
training a neural network model for predicting attack vulnerabilities in the network system by using at least one of the extracted global feature data and specific feature data as training data,
wherein the extracting at least one of the global feature data and the specific feature data includes
reading a CVE (Common Vulnerabilities and Exposures) file, generated by reflecting a vulnerability level of a software component, and generating asset dictionaries for encoding intelligent attack graph learning data;
extracting feature data required for model training from preconstructed intelligent attack graph learning data;
generating global feature data for each topology to be used for model training; and
generating positive attack path data and negative attack path data with which the intelligent attack path prediction model is to be trained,
wherein the asset dictionaries include a service dictionary, a port dictionary, and a product dictionary, and
wherein generating the global feature data for each topology to be used for model training includes
forming a service vector, a port vector, and a product vector;
forming N channels corresponding to a number of hosts;
assigning a service, a port, and a product, among software components, read from a service list to dimensions of respective vectors;
concatenating an OS (Operating System), service, product, and port vectors in an order in which the OS (Operating System), service, product, and port vectors are listed so as to form a matrix for each host; and
concatenating the N channels so as to form a tensor.
2. The apparatus of claim 1 , wherein generating and collecting the virtual network topology and the host asset information includes
generating the virtual network topology and the asset information required for predicting the cyberattack vulnerabilities in the computer network system;
generating an edge between hosts in order to generate an attack graph, calculating a vulnerability score of each of the hosts, and storing the vulnerability score in an attack graph database;
generating a connectivity matrix for representing a state of connection between the hosts in the network topology;
generating an attack path using a function of generating a possible attack path using vulnerabilities based on a result of identification of assailable vulnerabilities and components, which are identified by receiving all possible paths between two hosts in the network; and
constructing an intelligent-attack-graph learning database for training an attack vulnerability inference neural network model.
3. The apparatus of claim 2 , wherein generating the virtual network topology and the asset information performs at least one of
generating a network assets dictionary including a timestamp field for identifying a dictionary creation time, a system_states field for storing system state information of a network host, and a topology field for storing topology information of the network system;
generating a graph object for generating a mock topology using a graph tool;
randomly selecting a number of subnets within a range between predefined maximum and minimum numbers of subnets and assigning a router node to a graph;
updating the network assets dictionary with router information;
updating the network assets dictionary with subnet information;
updating the network assets dictionary with router-to-router link information and host-to-router link information; and
reading a CVE file, containing information about vulnerabilities in selected OSs and services, and assigning an OS and a service to each host in the topology by selecting the OS and the service.
4. The apparatus of claim 1 , wherein extracting the feature data comprises
extracting host IP addresses, host connection information, host asset information, and a labeled attack path pertaining to a network for each network topology by referring to a topology table, a service table, and an attack path table of an intelligent-attack-graph learning database.
5. The apparatus of claim 1 , wherein the attack path data is configured with global feature data, upper triangular topology matrix data, specific feature data, and upper triangular specific matrix data.
6. The apparatus of claim 5 , wherein generating the positive attack path data and the negative attack path data comprises
forming a negative attack path list by retrieving an index of a pair of hosts corresponding to a negative attack path, which is represented as an element value ‘1’ in an upper triangular topology matrix and an element value ‘0’ at a same position in a specific matrix.
7. The apparatus of claim 1 , wherein:
training the neural network model includes preprocessing the training data, and
preprocessing the training data includes
reading a predetermined number of pieces of positive attack path data and negative attack path data from a generated attack path data file;
labeling a positive attack path and a negative attack path with different values;
dividing all attack paths into training data and validation data;
standardizing global feature data of the attack path data; and
substituting a specific feature value, which represents an attack path in the attack path data as a host index, with a global feature value of a corresponding host in the topology.
8. The apparatus of claim 7 , wherein the neural network model includes
an input layer configured with four fully-connected (dense) layers, each having 512 dimensions, so as to respectively process global feature data, upper triangular topology matrix data, specific feature data, and upper triangular specific matrix data in the attack path data;
a hidden layer configured with a 1024-dimensional fully-connected layer; and
an output layer configured with a two-dimensional fully-connected layer.
9. An apparatus for inferring a cyberattack path based on attention, comprising:
memory in which at least one program is recorded; and
a processor for executing the program,
wherein the program performs
generating test data required for generating an intelligent attack graph; and
generating an attack graph based on an intelligent attack path prediction model,
wherein the intelligent attack path prediction model is a neural network model pretrained for predicting attack vulnerabilities in a network system by using at least one of extracted global feature data and specific feature data as training data from a collected virtual network topology and host asset information,
wherein the program performs extracting at least one of the global feature data and the specific feature data,
wherein the extracting at least one of the global feature data and the specific feature data includes
reading a CVE (Common Vulnerabilities and Exposures) file, generated by reflecting a vulnerability level of a software component, and generating asset dictionaries for encoding intelligent attack graph learning data;
extracting feature data required for model training from preconstructed intelligent attack graph learning data;
generating global feature data for each topology to be used for model training; and
generating positive attack path data and negative attack path data with which the intelligent attack path prediction model is to be trained,
wherein the asset dictionaries include a service dictionary, a port dictionary, and a product dictionary, and
wherein generating the global feature data for each topology to be used for model training includes
forming a service vector, a port vector, and a product vector;
forming N channels corresponding to a number of hosts;
assigning a service, a port, and a product, among software components, read from a service list to dimensions of respective vectors;
concatenating an OS (Operating System), service, product, and port vectors in an order in which the OS (Operating System), service, product, and port vectors are listed so as to form a matrix for each host; and
concatenating the N channels so as to form a tensor.
10. The apparatus of claim 9 , wherein generating the test data includes
generating a new topology using a network simulator;
extracting a network topology and asset information and storing the network topology and the asset information in a database; and
generating an attack graph by applying the new topology to a predictive attack graph generation model and storing the attack graph in a database.
11. The apparatus of claim 9 , wherein generating the attack graph based on the intelligent attack path prediction model includes
extracting global features from the test data; and
generating a number of pieces of test attack path data equal to a number of connections between hosts.
12. A method for training an intelligent attack path prediction model, comprising:
generating and collecting a virtual network topology and host asset information required for predicting cyberattack vulnerabilities in a computer network system;
extracting at least one of global feature data and specific feature data from the collected network topology and host asset information; and
training a neural network model for predicting attack vulnerabilities in the network system by using at least one of the extracted global feature data and specific feature data as training data,
wherein the extracting at least one of the global feature data and the specific feature data includes
reading a CVE (Common Vulnerabilities and Exposures) file, generated by reflecting a vulnerability level of a software component, and generating asset dictionaries for encoding intelligent attack graph learning data;
extracting feature data required for model training from preconstructed intelligent attack graph learning data;
generating global feature data for each topology to be used for model training; and
generating positive attack path data and negative attack path data with which the intelligent attack path prediction model is to be trained,
wherein the asset dictionaries include a service dictionary, a port dictionary, and a product dictionary, and
wherein generating the global feature data for each topology to be used for model training includes
forming a service vector, a port vector, and a product vector;
forming N channels corresponding to a number of hosts;
assigning a service, a port, and a product, among software components, read from a service list to dimensions of respective vectors;
concatenating an OS (Operating System), service, product, and port vectors in an order in which the OS (Operating System), service, product, and port vectors are listed so as to form a matrix for each host; and
concatenating the N channels so as to form a tensor.
13. The method of claim 12 , wherein generating and collecting the virtual network topology and the host asset information includes
generating the virtual network topology and the asset information required for predicting the cyberattack vulnerabilities in the computer network system;
generating an edge between hosts in order to generate an attack graph, calculating a vulnerability score of each of the hosts, and storing the vulnerability score in an attack graph database;
generating a connectivity matrix for representing a state of connection between the hosts in the network topology;
generating an attack path using a function of generating a possible attack path using vulnerabilities based on a result of identification of assailable vulnerabilities and components, which are identified by receiving all possible paths between two hosts in the network; and
constructing an intelligent-attack-graph learning database for training an attack vulnerability inference neural network model.
14. The method of claim 13 , wherein generating the virtual network topology and the asset information performs at least one of
generating a network assets dictionary including a timestamp field for identifying a dictionary creation time, a system_states field for storing system state information of a network host, and a topology field for storing topology information of the network system;
generating a graph object for generating a mock topology using a graph tool;
randomly selecting a number of subnets within a range between predefined maximum and minimum numbers of subnets and assigning a router node to a graph;
updating the network assets dictionary with router information;
updating the network assets dictionary with subnet information;
updating the network assets dictionary with router-to-router link information and host-to-router link information; and
reading a CVE file, containing information about vulnerabilities in selected OSs and services, and assigning an OS and a service to each host in the topology by selecting the OS and the service.
15. The method of claim 12 , wherein the attack path data is configured with global feature data, upper triangular topology matrix data, specific feature data, and upper triangular specific matrix data.
16. The method of claim 15 , wherein generating the positive attack path data and the negative attack path data comprises
forming a negative attack path list by retrieving an index of a pair of hosts corresponding to a negative attack path, which is represented as an element value ‘1’ in an upper triangular topology matrix and an element value ‘0’ at a same position in a specific matrix.
17. The method of claim 12 , wherein:
training the neural network model includes preprocessing the training data, and
preprocessing the training data includes
reading a predetermined number of pieces of positive attack path data and negative attack path data from a generated attack path data file;
labeling a positive attack path and a negative attack path with different values;
dividing all attack paths into training data and validation data;
standardizing global feature data of the attack path data; and
substituting a specific feature value, which represents an attack path in the attack path data as a host index, with a global feature value of a corresponding host in the topology.
18. The method of claim 17 , wherein the neural network model includes
an input layer configured with four fully-connected layers, each having 512 dimensions, so as to respectively process global feature data, upper triangular topology matrix data, specific feature data, and upper triangular specific matrix data in the attack path data;
a hidden layer configured with a 1024-dimensional fully-connected layer; and
an output layer configured with a two-dimensional fully-connected layer.