攻击技战术双层关联建模的个性化风险评估方法OA

Guided by the MITRE ATT&CK framework,modeling and assessing cybersecurity risks by modeling at-tackers'tactical objectives and technical methods through attack graphs have become one of the key approaches to counter-ing complex multi-step attack threats.However,as attack scenarios and attack chains grow increasingly intricate,existing ATT&CK-based attack path modeling and risk assessment methods exhibit certain limitations.On the one hand,current at-tack path modeling processes only consider direct transition relationships between attack techniques within the ATT&CK framework,overlooking tactical-level attack semantics and weakening the ability to impose high-level semantic constraints on complex multi-stage attack paths.On the other hand,attack graph-based risk quantification methods relying on generic vulnerability characteristics overlook differences in organizational focus on critical assets,resulting in assessment outcomes that lack personalized asset adaptation.To address these challenges,this paper proposes a personalized risk assessment meth-od based on dual-layer association modeling of attack techniques and tactics.First,a dual-layer association model is con-structed to capture potential relationships between techniques and tactics.Combined with the Viterbi algorithm,this model infers the evolution paths of attack tactics,introducing tactical-level stage constraints during path inference.Subsequently,a customized threat quantification model is developed by integrating attack behavior attributes with asset-specific characteris-tics.Through a forward algorithm,state transition probabilities are coupled with threat quantification metrics to achieve ho-listic network security risk assessment.Experimental results demonstrate that the proposed method outperforms existing mainstream assessment models in both path modeling and risk evaluation capabilities in real-world network environments.Compared with competing approaches,the proposed method achieves an average improvement of 48.95%in comprehensive risk assessment accuracy,validating its effectiveness and practical value in complex attack scenarios.