Method for creating safe closed-loop process based on MITRE ATT&CK

Abstract

The invention provides a method for creating a safety closed-loop process based on MITRE ATT&CK, which comprises the following steps: 1) obtaining data to obtain an MITREATT&CK framework; 2) obtainingan opponent attack plan; 3) simulating an attack according to the opponent attack plan to obtain a simulated attack determination result; and 4) constructing an improvement plan according to a resultdetermined by the simulation attack. The MITRE ATT&CK provides a framework of a structure for researching and analyzing attacks. The threat modeling method and model suite of the matrix for each stage of the hand life cycle comprise changes of several main operating systems such as Windows, MacOS and Linux. It can provide context for describing attacks and help identify. An attack chain with a real simulation environment and upper and lower texts is created among an available data source, an MITREATT & CK matrix and a workflow of an analyst, so as to understand the defense capability gap.

Description

technical field [0001] The invention relates to a method for creating a security closed loop, in particular to a method for creating a security closed loop process based on MITER ATT&CK. Background technique [0002] Implement effective iterative defenses against industry adversaries, defense postures, and security operations, enabling visibility into the environment and reducing the workload of security teams by filling gaps in defense. Gaining valuable sample input, adversary simulation plans, attack simulations, search and report tables, and alert maintenance prioritization are all solid foundations on which to build a defensive system. Understand the techniques, tactics, and procedures an adversary may use, simulate planning guidelines and linkages between adversary groups for an integrated, productive security strategy. [0003] When the behavior of the attacker is not seen and there is no attack alarm, these can be used to formulate the defense and alarm environment b...

AI Technical Summary

Problems solved by technology

There is no standardized format, so people cannot share their work with others

The analysis efficiency is low, and there are certain errors in the accuracy of human judgment

Images