An Intranet Defense Capability Assessment Method for Network Security Solutions Based on ATT&CK Framework

Faced with the growing threat of intranet attacks and numerous network security solutions, the defensive capabilities of network security solutions need to be evaluated in order to reasonably select a network security solution. However, the existing assessment of the defense capability of network security solutions mainly focuses on anti-DDoS devices, and lacks the assessment of the defense capability of the intranet, and it is complicated to obtain the values of assessment indicators during the assessment process. In addition, it is also difficult to obtain ideas for defense improvement of network security solutions. In the face of this situation, we propose an intranet defense capability assessment method for network security solutions based on the ATT&CK framework from an attack perspective. This method introduces the ATT&CK framework into the assessment of the intranet defense capability of network security solutions, constructs an indicator system with comprehensiveness and good scalability, and involves tactics, techniques and sub-technologies in the enterprise framework used by 138 APT organizations in the ATT&CK framework as objective data for indicator assignment, balancing the influence of attackers’ subjective experiences and preferences on the assessment results, and this method can easily obtain ideas to improve the intranet defense capability of network security solutions. The effectiveness of the proposed evaluation method is verified by conducting simulation experiments at a network range.