An Integrated Formal Description Method for Network Attacks

As the complexity and concealment of network attacks are increasing day by day, construction of a comprehensive and effective defense system calls for modeling and formal description of the scenes, techniques and processes of network attacks. Integrating MITRE ATT&CK and MAL (Meta Attack Language) can be a good orientation for current research on network attack description method. This paper proposes a formal description method for network attacks, in which the assets in an information system and the attackers' techniques summarized in the ATT&CK Matrix serve as the vocabulary and an extended MAL serves as the syntax. First, this method differentiates various instances of the same asset category and involves formal description of the attack scene, including the hosts, network environment and their configurations. Second, this method uses a more reasonable classification system for the assets of an information system and a more simplified set of MAL symbols. As is verified by our experiment, this method can generate a comprehensive and clear formal description for the attack scene, attack techniques and attack process of a network attack on a real-world information system, which brings the description level of this kind of integrated method from attacker strategies to network nodes, and can be a guide to defense construction for a real-world information system.