Research on Cyber Attack Modeling and Attack Path Discovery
Tianjiaojiao Chen, Huixiang Zhang, Tianluo Liu, Renjie Li · 2022
With the rapid development of information technology, the cyber security situation has become increasingly serious. Nowadays, cyber attacks have generally developed into multi-stage and multi-step cyberattack campaigns. As a kind of attack scene representation from the perspective of an attacker, the cyber attack model can comprehensively describe the cyber attack behavior in a complex and changeable environment. And the cyber attack model is one of the commonly used tools for cyber attack analysis and response. For enhancing network security, it is of great significance to establish a cyber attack model that is oriented to cyberattack campaigns and can be used to discover the complete attack paths. Therefore, in this paper, a cyber attack modeling method is proposed. First, we propose a meta-asset model to model asset classes, and propose to model network scenarios by instantiating network assets and combining dependency tree models, network topology and connectivity models. Then, a meta-attack model is proposed to define attack patterns, which uses behavior trees to describe the prerequisites and consequences of the attack. Finally, an ant colony optimization (ACO) algorithm adapted to the models is designed to discover the attack paths. The experimental results show that the proposed model has good descriptive capability and extensibility, and can discover potential attack paths by combining with the ACO algorithm.