Method and device for testing anti-escape capability of network intrusion prevention system, and tester

Abstract

The invention provides a method and device for testing the anti-escape capability of a network intrusion prevention system, and a tester. The method comprises the steps of: judging whether escape combinations, which are not traversed and matched with a protocol of an attack flow, exist or not, and if not, counting and outputting the number of generated escape combinations and the success and failure number; if the escape combinations, which are not traversed, exist, generating a single escape combination, which is not traversed; on the basis of a self-built protocol stack, performing layer-by-layer encapsulation and variation on an attack code according to the single escape combination, and generating test attack flow data; and, testing the attack flow data by utilizing a target drone, judging a test result, if escape fails, judging whether escape combination actions and subsequent actions, which are not traversed, exist or not, if escape is successful, generating and outputting the smallest escape combination, and judging whether escape combination actions and subsequent actions, which are not traversed, exist or not. Automatic detection of the anti-escape test onto an IPS is realized; the test efficiency is increased; and the test cost is reduced.

Description

technical field [0001] The invention relates to the technical field of computer networks, in particular to a network intrusion prevention system anti-escape ability testing method, device and testing machine for testing computer network intrusion prevention systems based on automatic combination. Background technique [0002] Intrusion Prevention System (Intrusion Prevention System, hereinafter referred to as IPS) is a computer network security facility and a supplement to antivirus software (Antivirus Programs) and firewall (Packet Filter, Application Gateway). After the development of IPS is completed, case source testing is required. At present, security testing for IPS mainly includes two parts: functional testing and penetration testing. When performing a penetration test on the IPS, it is necessary to check the anti-attack and evasion capability of the service port, that is, add specific evasion measures to the attack traffic that the IPS can identify, change the origi...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the embodiment of the present invention provides a network intrusion prevention system anti-escape ability testing method, device and testing machine to solve the problems caused by manual or semi-automatic detection of IPS in the prior art. Time-consuming, labor-intensive, and low-efficiency detection problems

Images