Network defense system risk assessment method based on bypass attack simulation

Abstract

The embodiment of the invention provides a network defense system risk assessment method and device based on bypass attack simulation. The method comprises the steps that a management platform sends an attack instruction to an attack simulation initiating unit; the attack simulation initiating unit generates detection flow according to the attack instruction and sends the detection flow to the corresponding attack receiving unit; the attack receiving unit receives and identifies the detection flow generated and sent by the attack simulation initiating unit; and the management platform evaluates the network security risk condition according to the detection flow generated and sent by the attack simulation initiating unit and the detection flow received and identified by the attack receiving unit. In this way, under the condition that actual asset intrusion is not organized, the processes of extranet boundary breakthrough, intranet asset vulnerability utilization, transverse movement, host intrusion and data leakage rectification attack are covered, and the same network depth system risk assessment effect as asset intrusion assessment can be achieved.

Description

technical field [0001] The present disclosure relates to the field of network security, in particular to the technical field of network defense system risk assessment based on side channel attack simulation. Background technique [0002] In the existing network defense system risk assessment methods, the method of artificially attacking the constructed simulated environment or conducting a small-scale attack penetration test on the actual network environment is generally used to evaluate the threat resistance capability of the defense system; Perform post-event analysis on the operation result logs of similar security technical means to evaluate the network risk level, such as IPS, WAF, FW and other security protection equipment logs, threat traffic detection, APT detection, XDR and other detection and response systems. [0003] However, for the simulated environment constructed, it is difficult to completely simulate the actual network environment, and building a simulated ...

AI Technical Summary

Problems solved by technology

[0003]However, for the simulated environment constructed, it is difficult to completely simulate the actual network environment, and building a simulated environment will consume a lot of manpower, material resources and time, generally only for small Simulate a relatively simple environment / scenario; it is difficult for users to accept attacks on the actual network environment, and it is likely to cause damage to systems and assets in the actual network environment; and for post-event analysis, it cannot meet the needs of pre-assessment

Images