Equipment protection performance detection method and device, equipment and storage medium

Abstract

The invention relates to the technical field of computers, and discloses an equipment protection performance detection method and device, equipment and a storage medium, and the method comprises the steps: obtaining the protection condition information of website security equipment on a simulation attack when the simulation attack on the website security equipment is finished, the simulation attack is triggered by the attack server by using attack cases sent by different ports through a plurality of coroutine tasks; determining protection success information based on the protection condition information and the source information of the attack case; and determining the protection performance of the website security equipment according to the protection success information. According to the method and the device, when the simulation attack on the website security equipment is finished, the protection performance of the website security equipment is detected through the protection success information determined by the protection condition information and the source information of the attack case, so that the protection performance of the website security equipment can be determined in time, the risk that the website security equipment is attacked is effectively reduced, and the safety of the website security equipment is improved. And normal business requirements are met.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, equipment and storage medium for detecting equipment protection performance. Background Art

[0002] At present, in order to find out the security vulnerabilities in the network and system more quickly to meet normal business needs, the existing technology simulates the attack scenarios of website security equipment through Breach and Attack Simulation (BAS) tools to evaluate the protection capabilities of website security equipment against external attacks, and can immediately repair potential vulnerabilities before attackers use various tactics, techniques and processes in the attack life cycle to break through the vulnerabilities.

[0003] However, the above method does not have the ability to detect protection performance. When the configuration of the server where the website security device is located changes, the protection performance of the website security device will also change accordingly. Once the attacker discovers that the protection performance of the website security device has decreased, the website security device will still be at risk of being attacked, resulting in the inability to meet normal business needs.

[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present invention is to provide a device protection performance detection method, device, equipment and storage medium, aiming to solve the technical problem that the existing technology does not have the ability to detect protection performance and cannot detect the protection performance before the attacker finds the protection performance upper limit of the website security device. The website security device is still at risk of being attacked, resulting in the inability to meet normal business needs.

[0006] To achieve the above object, the present invention provides a method for detecting equipment protection performance, the method comprising the following steps:

[0007] At the end of the simulated attack on the website security device, obtaining protection information of the website security device against the simulated attack, wherein the simulated attack is triggered by an attack case sent by the attack server through multiple coroutine tasks using different ports;

[0008] Determining protection success information based on the protection situation information and the source information of the attack use case;

[0009] The protection performance of the website security device is determined according to the protection success information.

[0010] Optionally, the step of determining the protection success information based on the protection situation information and the source information of the attack use case includes:

[0011] Determine the time range in which the website security device is subjected to the simulated attack according to the protection situation information;

[0012] Obtaining the system logs generated by the website security device within the time range;

[0013] querying an alarm log in the system log according to the source information of the attack use case, wherein the alarm log is generated when the website security device successfully protects against the simulated attack;

[0014] The protection success information of the website security device is determined based on the query result.

[0015] Optionally, the step of querying the alarm log in the system log according to the source information of the attack use case includes:

[0016] Determining identification information of the simulated attack according to source information of the attack use case;

[0017] Detecting whether the identification information is a proxy server address;

[0018] If so, query the target system log in the system log that matches the proxy server address, and use the target system log as an alarm log.

[0019] Optionally, after the step of detecting whether the identification information is a proxy server address, the step further includes:

[0020] If not, obtaining a request header of the attack use case and determining request identification information in the request header;

[0021] The system log is queried for a target system log that matches the request identification information, and the target system log is used as an alarm log.

[0022] Optionally, the step of determining the protection success information of the website security device based on the query result includes:

[0023] Determine the number of successful protections of the website security device according to the number of alarm logs;

[0024] The number of successful protections is used as the successful protection information of the website security device.

[0025] Optionally, the step of determining the protection performance of the website security device according to the protection success information includes:

[0026] Determine the total number of attack use cases of the simulated attack according to the source information;

[0027] Determining the duration of the website security device being attacked by the simulated attack;

[0028] The protection performance of the website security device is determined by the total number of attack use cases, the attack duration, and the protection success information.

[0029] Optionally, the step of determining the protection performance of the website security device according to the protection success information, the total number of attack use cases, and the attack duration includes:

[0030] Determine the throughput of the website security device according to the total number of attack cases and the attack duration;

[0031] Determine the protection rate of the website security device under the throughput based on the total number of attack use cases and the protection success information;

[0032] The protection performance of the website security device is determined according to the protection rate.

[0033] Optionally, after the step of determining the protection performance of the website security device according to the protection rate, the method further includes:

[0034] Detecting whether the protection rate reaches a preset standard protection rate;

[0035] If the preset standard protection rate is not reached, it is determined that the protection performance is at risk;

[0036] Performance adjustment information is fed back to the target person based on the determination result of the protection rate, so that the target person adjusts the protection performance based on the performance adjustment information.

[0037] In addition, to achieve the above-mentioned purpose, the present invention also proposes a device protection performance detection method, which is applied to attack a server, and the method includes:

[0038] Determine the attack cases that the website security device of the target website can prevent from the preset attack case library;

[0039] The attack use case is sent to the target website using different ports through multiple coroutine tasks, so that the target website determines the protection performance of the website security device based on the simulated attack triggered by the attack use case.

[0040] Optionally, the step of sending the attack use case to the target website using different ports through multiple coroutine tasks includes:

[0041] Detect whether the current mode of sending the attack case is a proxy mode;

[0042] If it is the proxy mode, create a coroutine task with the same number of proxy server addresses;

[0043] The attack use case is sent to the proxy server using the ports corresponding to the addresses of the proxy servers through multiple coroutine tasks, so that the proxy server forwards the attack use case to the target website.

[0044] Optionally, if the proxy mode is used, before the step of creating a coroutine task with the same number of proxy server addresses, the step further includes:

[0045] Determine whether to use proxy mode to send the attack case according to the current configuration information;

[0046] If the proxy mode is used, multiple proxy server addresses and ports corresponding to each proxy server address are applied to the proxy server according to the current configuration information.

[0047] Optionally, after the step of detecting whether the current mode of sending the attack case is a proxy mode, the method further includes:

[0048] If it is not the proxy mode, multiple coroutine tasks are created;

[0049] Add request identification information to the request header of the attack use case to obtain an updated attack use case;

[0050] The updated attack use case is sent to the target website using different local ports through multiple coroutine tasks.

[0051] In addition, to achieve the above-mentioned purpose, the present invention also proposes a device for detecting equipment protection performance, the device comprising:

[0052] A simulated attack protection module, used for obtaining protection information of the website security device against the simulated attack when the simulated attack on the website security device ends, wherein the simulated attack is triggered by an attack case sent by the attack server through multiple coroutine tasks using different ports;

[0053] A protection information determination module, used to determine protection success information based on the protection situation information and the source information of the attack use case;

[0054] A protection performance detection module is used to determine the protection performance of the website security device according to the protection success information.

[0055] In addition, to achieve the above-mentioned purpose, the present invention also proposes a device for detecting equipment protection performance, the device comprising:

[0056] An attack case determination module is used to determine the attack cases that can be prevented by the website security device of the attack target from a preset attack case library;

[0057] An attack case sending module is used to send the attack case to the target website using different ports through multiple coroutine tasks, so that the target website determines the protection performance of the website security device based on the simulated attack triggered by the attack case.

[0058] In addition, to achieve the above-mentioned purpose, the present invention also proposes a device for detecting equipment for protecting performance, the device comprising: a memory, a processor, and a device protection performance detection program stored on the memory and executable on the processor, the device protection performance detection program being configured to implement the device protection performance detection method described above and the steps of the device protection performance detection method applied to attacking a server.

[0059] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a device protection performance detection program is stored. When the device protection performance detection program is executed by a processor, the device protection performance detection method described above and the steps of the device protection performance detection method applied to attacking a server are implemented.

[0060] The present invention provides a device protection performance detection method, device, equipment and storage medium. The method obtains the protection status information of the website security device against the simulated attack at the end of the simulated attack on the website security device. The simulated attack is triggered by the attack use case sent by the attack server through multiple coroutine tasks using different ports; then the protection success information is determined based on the protection status information and the source information of the attack use case; finally, the protection performance of the website security device is determined according to the protection success information. At the end of the simulated attack on the website security device, the present invention further detects the protection performance of the website security device through the protection success information determined by the protection status information and the source information of the attack use case. Compared with the prior art, which does not have the ability to detect the protection performance and cannot detect the protection performance before the attacker finds the upper limit of the protection performance of the website security device, the above method of the present invention can timely detect the protection performance of the website security device through the protection success information after the end of the simulated attack, effectively reducing the risk of the website security device being attacked and meeting normal business needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 A schematic diagram of the structure of a device protection performance detection device for a hardware operating environment involved in an embodiment of the present invention;

[0062] Figure 2 It is a schematic diagram of the process of the first embodiment of the device protection performance detection method of the present invention;

[0063] Figure 3This is a schematic diagram of an application scenario in the first embodiment of the device protection performance detection method of the present invention;

[0064] Figure 4 It is a flow chart of the second embodiment of the device protection performance detection method of the present invention;

[0065] Figure 5 It is a flow chart of the third embodiment of the device protection performance detection method of the present invention;

[0066] Figure 6 A schematic diagram of a flow chart of an embodiment of a method for detecting device protection performance of an attack server according to the present invention;

[0067] Figure 7 It is a structural block diagram of the first embodiment of the equipment protection performance detection device of the present invention;

[0068] Figure 8 This is a structural block diagram of the second embodiment of the equipment protection performance detection device of the present invention.

[0069] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0070] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0071] Reference Figure 1 , Figure 1 It is a schematic diagram of the structure of the equipment protection performance detection equipment of the hardware operating environment involved in the embodiment of the present invention.

[0072] like Figure 1As shown, the device protection performance detection device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0073] Those skilled in the art will understand that Figure 1 The structure shown in does not constitute a limitation on the equipment protection performance testing equipment, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0074] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a device protection performance detection program.

[0075] exist Figure 1 In the device protection performance testing device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the device protection performance testing device of the present invention can be set in the device protection performance testing device, and the device protection performance testing device calls the device protection performance testing program stored in the memory 1005 through the processor 1001, and executes the device protection performance testing method provided by the embodiment of the present invention.

[0076] The embodiment of the present invention provides a method for detecting the protection performance of an equipment. Figure 2 , Figure 2 It is a flow chart of the first embodiment of the equipment protection performance detection method of the present invention.

[0077] In this embodiment, the device protection performance detection method includes the following steps:

[0078] Step S10: When the simulated attack on the website security device ends, the protection status information of the website security device against the simulated attack is obtained, wherein the simulated attack is triggered by an attack case sent by the attack server through multiple coroutine tasks using different ports.

[0079] It should be noted that the execution subject of the method of this embodiment can be a computing service device with equipment protection performance detection, network communication and program running functions, such as a mobile phone, a tablet computer, a personal computer, etc., and can also be other electronic devices that achieve the same or similar functions. The following is an explanation of this embodiment and the following embodiments using the above-mentioned equipment protection performance detection device (referred to as the detection device).

[0080] It is understandable that the above-mentioned website security devices can be devices deployed in user websites to prevent external attacks, such as intrusion prevention systems (IPS), intrusion detection systems (IDS) and WAF application firewalls.

[0081] It should be noted that the above-mentioned attack server may be an external server, such as a cloud, that launches a simulated attack on the user's website.

[0082] It is understandable that the above protection status information may be information generated during the process of the website security device protecting against simulated attacks, that is, information related to the protection process of the website security device, which may include the duration of the protection against simulated attacks or the number of successfully protected simulated attacks.

[0083] It should be noted that the above-mentioned simulated attacks have the same tools and strategies as actual attacks, but unlike actual attacks, simulated attacks are intended to evaluate the effectiveness of website security devices and do not actually cause damage to user websites.

[0084] In a specific implementation, a BAS tool can be deployed in the above-mentioned attack server, and the BAS tool can be used to select any attack case that can be prevented by the website security device, and then the attack case is sent to the user website through multiple coroutine tasks using different ports, wherein each coroutine task sends the same attack case, and the attack case can trigger a simulated attack on the user website when it arrives at the user website. When the above-mentioned website security device detects multiple simulated attacks, it can intercept each simulated attack, and when the detection device detects that the simulated attack launched by the attack server on the website security device has ended, it can obtain the website security device's protection information for this round of simulated attacks.

[0085] For ease of understanding, refer to Figure 3 This is for illustration only, but not for limitation. Figure 3This is a schematic diagram of an application scenario in the first embodiment of the device protection performance detection method of the present invention. Figure 3 In the example, the AES local server is used as the detection device, the AES cloud service is used as the attack server, the WAF / IPS is used as the website security device, and the user's official website is used as the user's website. The above-mentioned AES local service can communicate with the AES cloud service. When the user needs to evaluate the effectiveness of the WAF / IPS, the AES local service can initiate a simulated attack request to the AES cloud service. When the AES cloud service receives the simulated attack request, the BAS tool can be used to initiate a simulated attack on the official website through the Network Address Translator (NAT), that is, the NAT device. When the AES local server detects that the simulated attack on the WAF / IPS has ended, it can obtain the protection status information of the WAF / IPS against the simulated attack.

[0086] Step S20: Determine protection success information based on the protection situation information and the source information of the attack use case.

[0087] It should be noted that the above-mentioned source information may be information related to the attack case sent by the attack server, and may include the number of attack cases or identification information identifying the attack case, etc.

[0088] It is understandable that the above-mentioned protection success information may be information generated when the above-mentioned website security device successfully protects, and may include the number of simulated attacks that are successfully protected.

[0089] In a specific implementation, the above-mentioned detection device can determine the duration of the device security device being subjected to a simulated attack based on the protection status information obtained, and then obtain the source information of the attack use cases within the duration, determine the number of simulated attacks successfully protected by the website security device based on the source information, and use the number of successfully protected simulated attacks as protection success information.

[0090] Step S30: Determine the protection performance of the website security device according to the protection success information.

[0091] In a specific implementation, the above-mentioned detection device can determine the protection rate of the website security device in this round of simulated attacks based on the protection success information, that is, the number of successfully protected simulated attacks and the total number of simulated attacks, and use the protection rate as the protection performance of the website security device, thereby avoiding the situation where the protection performance of the website security device cannot be known after the simulated attack is over.

[0092] It should be understood that the above-mentioned detection equipment can feed back the protection performance, that is, the protection rate, as the upper limit of the protection performance to the user system, so as to determine the protection performance before the attacker finds the upper limit of the protection performance of the website security device, and detect whether the protection rate is lower than the preset standard value. If it is lower than the preset standard, the user may be prompted to adjust the security protection device so that the protection performance reaches the preset standard value, thereby avoiding changes in the configuration of the server where the website security device is located, which reduces the protection performance of the website security device and cannot be adjusted in time, thereby effectively reducing the risk of the website security device being attacked.

[0093] In addition, users can use scheduled tasks to batch monitor the security protection performance of the company's website servers on a daily basis, that is, the protection performance of the website security equipment, or obtain the protection performance of the website security equipment on a regular basis, so as to promptly discover potential risks and adjust security protection rules and strategies to improve the protection performance of the website security equipment and reduce the risk of attacks.

[0094] This embodiment obtains the protection status information of the website security device against the simulated attack at the end of the simulated attack on the website security device. The simulated attack is triggered by the attack use case sent by the attack server through multiple coroutine tasks using different ports; then the protection success information is determined based on the protection status information and the source information of the attack use case; finally, the protection performance of the website security device is determined according to the protection success information. At the end of the simulated attack on the website security device, this embodiment further detects the protection performance of the website security device through the protection success information determined by the protection status information and the source information of the attack use case. Compared with the prior art, which does not have the ability to detect the protection performance and cannot detect the protection performance before the attacker finds the upper limit of the protection performance of the website security device, the above method of this embodiment can timely detect the protection performance of the website security device through the protection success information after the end of the simulated attack, effectively reducing the risk of the website security device being attacked and meeting normal business needs.

[0095] refer to Figure 4 , Figure 4 It is a flow chart of the second embodiment of the equipment protection performance detection method of the present invention.

[0096] Based on the above first embodiment, in this embodiment, step S20 includes:

[0097] Step S201: Determine the time range in which the website security device is subjected to the simulated attack according to the protection situation information.

[0098] In a specific implementation, the detection device may determine the time period when the website security device is subjected to the simulated attack from the protection status information of the website security device against each simulated attack, and extract the time range formed by the time period.

[0099] Step S202: Obtain the system log generated by the website security device within the time range.

[0100] It should be noted that the above system log may record information about hardware, software and system problems in the system, and the system log may also monitor events occurring in the system.

[0101] In a specific implementation, the detection device can obtain the system log generated in the time service to further filter out the alarm log from the system log. The alarm log is generated when the website security device successfully intercepts the simulated attack. In addition, the generated alarm log will record the identification information in the source information of the attack case.

[0102] Step S203: querying the alarm log in the system log according to the source information of the attack use case, wherein the alarm log is generated when the website security device successfully defends against the simulated attack.

[0103] In a specific implementation, the above-mentioned detection device can extract identification information from the source information of the attack use case, and then use the identification information as a query condition to query the above-mentioned system log, query the target system log that records the identification information, and use the target system log as an alarm log.

[0104] Furthermore, in this embodiment, the step of querying the alarm log in the system log according to the source information of the attack use case includes:

[0105] Step S2031: Determine identification information of the simulated attack according to source information of the attack use case.

[0106] In a specific implementation, the detection device may extract identification information of the simulated attack from the source information of the attack use case, so as to query the alarm log through the identification information.

[0107] Step S2032: Detect whether the identification information is a proxy server address.

[0108] In a specific implementation, the above-mentioned attack server can directly send attack use cases to the user website to trigger a simulated attack, or forward the attack use cases to the user website through a proxy server to trigger a simulated attack. If the attack server forwards the attack use cases through the proxy server, the proxy server address for forwarding each attack use case is different, and the proxy server address can be used as the identification information of the attack use case. If the attack server is directly forwarded through the local port, the attack server address is unique, so the attack server address cannot be used as identification information. That is, the attack server sends the attack use case in different ways, and the identification information will also be different. Therefore, the above-mentioned detection device needs to detect whether the identification information is the proxy server address.

[0109] Step S2033: If yes, query the target system log in the system log that matches the proxy server address, and use the target system log as an alarm log.

[0110] In a specific implementation, when the detection device detects that the identification information is a proxy server address, it can use the proxy server address corresponding to each attack use case as a query condition and extract all system logs that record the proxy server address as alarm logs.

[0111] It should be understood that in the scenario where the attack server uses a proxy server to forward the attack use case to trigger a simulated attack, if the website security device successfully intercepts any simulated attack, it will generate a system log recording the proxy server address corresponding to any simulated attack. For simulated attacks that are not intercepted, no system log recording the proxy server address will be generated. Therefore, the system log containing the proxy server address can be used as an alarm log.

[0112] Furthermore, in this embodiment, after step S2032, the following steps are further included:

[0113] Step S2033': If not, obtain the request header of the attack use case, and determine the request identification information in the request header.

[0114] In a specific implementation, when the above-mentioned attack server does not use a proxy server to forward the attack case, in order to enable the detection device to identify the simulated attack and ensure that the detection device can determine the protection performance of the website security device, a globally unique request identification information can be added to the request header of the attack case, such as the http request header. The request identification information corresponding to different attack cases is different to distinguish each attack case. Therefore, after detecting that the identification information is not the proxy server address, the above-mentioned detection device can obtain the request header of the attack case and extract the request identification information from the request header.

[0115] Step S2034': query the system log for a target system log that matches the request identification information, and use the target system log as an alarm log.

[0116] In a specific implementation, the detection device may use the request identification information corresponding to each attack case as a query condition, and extract all system logs that record the request identification information as alarm logs.

[0117] It should be understood that in the scenario where the attack server directly sends an attack use case through the local port to trigger a simulated attack, if the website security device successfully intercepts any simulated attack, it will generate a system log recording the request identification information corresponding to any simulated attack. For simulated attacks that are not intercepted, no system log recording their request identification information will be generated. Therefore, the system log containing the request identification information can be used as an alarm log.

[0118] Step S204: Determine the protection success information of the website security device based on the query result.

[0119] In the specific implementation, since the alarm log records the identification information of the attack use case, that is, the proxy server address or request identification information, an alarm log can represent that the website security device successfully intercepts a simulated attack. Therefore, the protection success information of the website security device can be determined by the number of attack logs queried.

[0120] Furthermore, in this embodiment, step S204 includes:

[0121] Step S2041: Determine the number of successful protections of the website security device according to the number of alarm logs.

[0122] In a specific implementation, the detection device may count the number of alarm logs queried, and use the number of alarm logs as the number of simulated attacks successfully intercepted by the website security device, that is, use the number of alarm logs as the number of successful protections of the website security device.

[0123] Step S2042: Use the number of successful protections as successful protection information of the website security device.

[0124] In a specific implementation, the above-mentioned number of successful protections can represent the number of simulated attacks successfully intercepted by the website security device, so the above-mentioned detection device can directly use the number of successful protections as the successful protection information of the website security device.

[0125] This embodiment determines the time range in which the website security device is subjected to a simulated attack through protection situation information; obtains the system log generated by the website security device within the time range; queries the alarm log in the system log according to the source information of the attack use case; and determines the protection success information of the website security device based on the query result. In this embodiment, when the identification information is a proxy server address, the alarm log is queried through the proxy server address; when the identification information is not a proxy server address, the alarm log is queried by requesting the identification information, so that the alarm log generated when the website security device is successfully protected can be accurately queried, thereby improving the accuracy of determining the protection success information.

[0126] refer to Figure 5 , Figure 5 It is a flow chart of the third embodiment of the equipment protection performance detection method of the present invention.

[0127] Based on the above second embodiment, in this embodiment, step S30 includes:

[0128] Step S301: Determine the total number of attack cases of the simulated attack according to the source information.

[0129] In a specific implementation, since the simulated attack on the website security device is triggered by an attack use case, the above-mentioned detection device can determine the total number of each simulated attack from the source information of the attack use case, and the total number of simulated attacks can be used as the total number of attack use cases.

[0130] Step S302: Determine the duration of the simulated attack on the website security device.

[0131] In a specific implementation, after determining the time range in which the website security device is subjected to the simulated attack, the detection device may use the duration corresponding to the time range as the total duration in which the website security device is subjected to the simulated attack.

[0132] Step S303: Determine the protection performance of the website security device according to the total number of attack use cases, the attack duration, and the protection success information.

[0133] In a specific implementation, the above-mentioned detection device can determine the throughput of the website security device and the protection rate at this throughput based on the total number of attack use cases determined above, the duration of the network attack, and the number of protection successes in the protection success information, and use the protection rate as the protection performance of the website security device.

[0134] Furthermore, in this embodiment, step S303 includes:

[0135] Step S3031: Determine the throughput of the website security device according to the total number of attack use cases and the attack duration.

[0136] In a specific implementation, the detection device can determine the number of attack cases received by the website security device in a unit time by the total number of attack cases and the attack duration, and use the number of attack cases received in the unit time as the throughput of the website security device. For example, if the total number of attack cases is N and the attack duration is T, the throughput is N / T.

[0137] Step S3032: Determine the protection rate of the website security device under the throughput based on the total number of attack use cases and the protection success information.

[0138] In a specific implementation, the above-mentioned detection device can determine the number of successful protections of the website security device through the above-mentioned protection success information, and then determine the protection rate of the website security device under the above-mentioned throughput through the total number of attack use cases and the number of successful protections. For example, if the total number of attack use cases is N, the attack duration is T, and the number of successful protections is P, then when the throughput is N / T, the protection rate is P / N.

[0139] Step S3033: Determine the protection performance of the website security device according to the protection rate.

[0140] In a specific implementation, the above detection device may use the protection rate under the above throughput as the protection performance of the website security device.

[0141] Furthermore, in this embodiment, after step S3033, the following steps are further included:

[0142] Step S3034: Detect whether the protection rate reaches a preset standard protection rate.

[0143] The purpose of the required number is that the above-mentioned preset standard protection rate can be the minimum standard that the protection rate of website security equipment should reach while meeting business needs.

[0144] In a specific implementation, in addition to feeding back the above protection performance to the user system and having the user system adjust the protection performance of the website security device according to the protection rate, in order to improve the adjustment efficiency of the website security device, the detection device may also directly compare the above protection rate with the preset standard protection rate to detect whether the above protection rate reaches the above preset standard protection rate.

[0145] Step S3035: If the preset standard protection rate is not reached, it is determined that there is a risk in the protection performance.

[0146] In a specific implementation, when the detection device detects that the protection rate does not reach the preset standard protection rate, that is, the protection rate is lower than the preset standard protection rate, it can be determined that the protection performance of the website security device is at risk and cannot meet business needs. Correspondingly, if it is detected that the protection rate reaches the preset standard protection rate, it is determined that the protection performance of the website security device is normal and can meet business needs.

[0147] Step S3036: Feedback performance adjustment information to the target person based on the determination result of the protection rate, so that the target person adjusts the protection performance based on the performance adjustment information.

[0148] In a specific implementation, when the detection device determines that there is a risk in the protection performance of the website security device, it can feedback the performance adjustment information to the target personnel, so that the target personnel can know that there is a risk in the protection performance of the website security device, and adjust the security protection rules and policies to make the protection rate of the website security device reach the above-mentioned preset standard protection rate, reduce the risk of attack, and thus meet business needs.

[0149] In addition, after determining the throughput, the detection device may also compare the throughput with a preset standard throughput. If the throughput is lower than the preset standard throughput, the throughput of the website security device is determined to be abnormal, and the abnormal throughput information may be fed back to the target personnel so that the target personnel can adjust the website security device to make its throughput reach the preset standard throughput. The preset standard throughput is the minimum standard that the throughput of the website security device should reach under the premise of meeting business needs.

[0150] This embodiment determines the total number of attack cases of the simulated attack through source information; determines the duration of the simulated attack on the website security device; and determines the protection performance of the website security device through the total number of attack cases, the attack duration, and the protection success information. This embodiment can determine the throughput of the website security device through the total number of attack cases and the attack duration, and can determine the protection rate of the website security device under the throughput based on the total number of attack cases and the protection success information, thereby accurately detecting the protection performance of the website security device, and at the same time being able to detect whether there is a risk in the protection performance based on the protection rate, and when there is a risk, feedback the performance adjustment information to the target personnel, who can adjust the protection performance of the website security device, effectively improving the equipment adjustment efficiency.

[0151] The embodiment of the present invention also proposes a method for detecting equipment protection performance, referring to Figure 6 , Figure 6 The present invention is a flow chart of an embodiment of a method for detecting device protection performance applied to attack servers.

[0152] In this embodiment, the method is applied to attack a server, and the method includes:

[0153] Step S10': determining the attack use cases that the website security device of the target website can prevent from the preset attack use case library.

[0154] It should be noted that the execution subject of the method of this embodiment can be a computing service device with equipment protection performance detection, network communication and program running functions, such as a mobile phone, a tablet computer, a personal computer, etc., and can also be other electronic devices that achieve the same or similar functions. The following uses the above-mentioned attack server to illustrate this embodiment and the following embodiments.

[0155] It is understandable that the above-mentioned preset attack case library can be a database for storing attack cases that can be prevented by the website security device. The attacks that can be prevented by the website security device include SQL injection, XSS cross-site scripting, remote overflow attack, file inclusion, Bash vulnerability attack, remote command execution, directory traversal, sensitive file access and command / code injection, etc. This embodiment does not limit this.

[0156] In addition, the target website may be a user website where the website security device is deployed.

[0157] In a specific implementation, a BAS tool may be deployed in the above-mentioned attack server, and the BAS tool may be used to select an attack case that can be prevented by any website security device from the above-mentioned preset attack case library.

[0158] Step S20': sending the attack use case to the target website using different ports through multiple coroutine tasks, so that the target website determines the protection performance of the website security device based on the simulated attack triggered by the attack use case.

[0159] In a specific implementation, the attack server may create multiple coroutine tasks, each of which uses a different port, and then each coroutine task uses its own port to send the attack use case to the target website to trigger a simulated attack on the target website, wherein the attack use cases sent by each coroutine task are the same. After the website security device of the target website detects the simulated attack, it can protect the simulated attack. Accordingly, when the simulated attack on the website security device ends, the website security device can further detect the protection performance of the website security device through the protection success information determined by the protection situation information and the source information of the attack use case.

[0160] This embodiment determines the attack use cases that can be prevented by the website security device of the target website from a preset attack use case library; uses different ports to send the attack use cases to the target website through multiple coroutine tasks, so that the target website determines the protection performance of the website security device based on the simulated attack triggered by the attack use cases, thereby enabling the target website to detect the protection performance of the website security device in a timely manner, effectively reducing the risk of the website security device being attacked and meeting normal business needs.

[0161] Furthermore, in this embodiment, the step of sending the attack use case to the target website using different ports through multiple coroutine tasks includes:

[0162] Step S201': Detect whether the current mode of sending the attack case is a proxy mode.

[0163] It should be noted that the above-mentioned proxy mode may be a mode of using a proxy server to send attack use cases.

[0164] In a specific implementation, in order to hide the IP address of the attack server, the attack server can be configured to use a proxy server to forward the attack case to the target website. Therefore, the above-mentioned attack server can detect whether the current mode of sending the attack case is the proxy mode.

[0165] Step S202': If it is the proxy mode, create a coroutine task with the same number of proxy server addresses.

[0166] In a specific implementation, when the attack server detects that the current mode of sending the attack case is the proxy mode, it can determine the number of applied proxy server addresses, and then create a coroutine task that is consistent with the number of proxy server addresses.

[0167] Furthermore, in this embodiment, before step S202', the following steps are further included:

[0168] Determine whether to use the proxy mode to send the attack use case according to the current configuration information.

[0169] In a specific implementation, the above-mentioned attack server can read the mode information of sending the attack case from the current configuration information, and then determine whether the current mode is the proxy mode based on the mode information.

[0170] If the proxy mode is used, multiple proxy server addresses and ports corresponding to each proxy server address are applied to the proxy server according to the current configuration information.

[0171] In a specific implementation, when the attack server detects that the mode of sending the attack case is the proxy mode, it can apply to the proxy server for several proxy server addresses and the ports corresponding to each proxy server address according to the content in the read configuration information.

[0172] Step S203 ′: sending the attack case to the proxy server using the port of each proxy server through multiple coroutine tasks, so that the proxy server forwards the attack case to the target website.

[0173] In a specific implementation, the above-mentioned attack server can use the ports corresponding to the proxy server addresses through the created coroutine tasks to send attack use cases to the proxy server, and the proxy server forwards the attack use cases to the target website, triggering a simulated attack on the target website. Since a coroutine task uses a proxy server address and a port to send the attack use case, the proxy server address can be used as identification information to identify the simulated attack, so that the detection equipment of the target website can identify the simulated attacks in the simulated attack scenario, and then determine the protection success information based on the identified simulated attacks.

[0174] Furthermore, in this embodiment, after step S201', the following steps are further included:

[0175] Step S202": If it is not the proxy mode, create multiple coroutine tasks.

[0176] In a specific implementation, when the attack server detects that the mode for sending the attack case is not the proxy mode, it cannot use the proxy server address and the port corresponding to the proxy server address to send the attack case, but uses the local port to send the attack case. At this time, multiple coroutine tasks can be directly created.

[0177] Step S203": adding request identification information to the request header of the attack use case to obtain an updated attack use case.

[0178] In a specific implementation, in order to enable the detection device of the target website to identify the simulated attack, the above-mentioned attack server may add a request header identifier in the request header of the attack case, such as the http request header, to update the attack case. The attack case carrying the request header identifier information is the updated attack case.

[0179] Step S204": sending the updated attack use case to the target website using different local ports through multiple coroutine tasks.

[0180] In a specific implementation, the above-mentioned attack use case can be sent to the target website through multiple coroutine tasks using different local ports, triggering a simulated attack on the target website. Accordingly, the detection device of the target website can identify each simulated attack in the simulated attack scenario through the request identification information in the attack use case, and then determine the protection success information based on the identified simulated attack.

[0181] In this embodiment, when the mode for sending attack cases is the proxy mode, the attack cases are sent to the proxy server through multiple coroutine tasks using the ports corresponding to the addresses of each proxy server, and the proxy server forwards the attack cases to the target website. When the mode for sending attack cases is not the proxy mode, the updated attack cases are sent to the target website through multiple coroutine tasks using different local ports. The target website can accurately identify the simulated attack based on the proxy server address or request identification information to determine the protection success information, and then can accurately determine the protection performance of the website security identification based on the protection success information, effectively improving the detection accuracy of the protection performance.

[0182] In addition, an embodiment of the present invention also proposes a storage medium, on which a device protection performance detection program is stored. When the device protection performance detection program is executed by a processor, the device protection performance detection method described above and the steps of the protection performance detection method applied to attacking a server are implemented.

[0183] Reference Figure 7 , Figure 7 This is a structural block diagram of the first embodiment of the equipment protection performance detection device of the present invention.

[0184] like Figure 7 As shown, the equipment protection performance detection device proposed in the embodiment of the present invention includes:

[0185] The simulated attack protection module 501 is used to obtain the protection status information of the website security device against the simulated attack when the simulated attack on the website security device ends. The simulated attack is triggered by an attack use case sent by the attack server through multiple coroutine tasks using different ports.

[0186] The protection information determination module 502 is used to determine the protection success information based on the protection situation information and the source information of the attack use case.

[0187] The protection performance detection module 503 is used to determine the protection performance of the website security device according to the protection success information.

[0188] This embodiment obtains the protection status information of the website security device against the simulated attack at the end of the simulated attack on the website security device. The simulated attack is triggered by the attack use case sent by the attack server through multiple coroutine tasks using different ports; then the protection success information is determined based on the protection status information and the source information of the attack use case; finally, the protection performance of the website security device is determined according to the protection success information. At the end of the simulated attack on the website security device, this embodiment further detects the protection performance of the website security device through the protection success information determined by the protection status information and the source information of the attack use case. Compared with the prior art, which does not have the ability to detect the protection performance and cannot detect the protection performance before the attacker finds the upper limit of the protection performance of the website security device, the above-mentioned device of this embodiment can timely detect the protection performance of the website security device through the protection success information after the end of the simulated attack, effectively reducing the risk of the website security device being attacked and meeting normal business needs.

[0189] As an implementation mode, the protection information determination module 502 is also used to determine the time range in which the website security device is subjected to the simulated attack based on the protection situation information; obtain the system log generated by the website security device within the time range; query the alarm log in the system log based on the source information of the attack use case, and the alarm log is generated when the website security device successfully protects against the simulated attack; and determine the protection success information of the website security device based on the query result.

[0190] As an implementation method, the protection information determination module 502 is also used to determine the identification information of the simulated attack based on the source information of the attack use case; detect whether the identification information is a proxy server address; if so, query the target system log in the system log that matches the proxy server address, and use the target system log as an alarm log.

[0191] As an implementation method, the protection information determination module 502 is also used to, if not, obtain the request header of the attack use case and determine the request identification information in the request header; query the target system log in the system log that matches the request identification information, and use the target system log as an alarm log.

[0192] As an implementation mode, the protection information determination module 502 is further used to determine the number of successful protections of the website security device according to the number of alarm logs; and use the number of successful protections as the successful protection information of the website security device.

[0193] As an implementation mode, the protection performance detection module 503 is also used to determine the total number of attack cases of the simulated attack based on the source information; determine the attack duration of the website security device being subjected to the simulated attack; and determine the protection performance of the website security device through the total number of attack cases, the attack duration and the protection success information.

[0194] As an implementation mode, the protection performance detection module 503 is also used to determine the throughput of the website security device through the total number of attack use cases and the attack duration; determine the protection rate of the website security device under the throughput based on the total number of attack use cases and the protection success information; and determine the protection performance of the website security device according to the protection rate.

[0195] As an implementation mode, the protection performance detection module 503 is also used to detect whether the protection rate reaches a preset standard protection rate; if the preset standard protection rate is not reached, it is determined that there is a risk in the protection performance; based on the determination result of the protection rate, performance adjustment information is fed back to the target person, so that the target person adjusts the protection performance based on the performance adjustment information.

[0196] In addition, the embodiment of the present invention also provides a device for detecting equipment protection performance, referring to Figure 8 , Figure 8 This is a structural block diagram of the second embodiment of the equipment protection performance detection device of the present invention.

[0197] like Figure 8 As shown, the equipment protection performance detection device proposed in the embodiment of the present invention includes:

[0198] The attack case determination module 501' is used to determine the attack cases that can be prevented by the website security device of the attack target from the preset attack case library.

[0199] The attack case sending module 502' is used to send the attack case to the target website using different ports through multiple coroutine tasks, so that the target website determines the protection performance of the website security device based on the simulated attack triggered by the attack case.

[0200] This embodiment determines the attack use cases that can be prevented by the website security device of the target website from a preset attack use case library; uses different ports to send the attack use cases to the target website through multiple coroutine tasks, so that the target website determines the protection performance of the website security device based on the simulated attack triggered by the attack use cases, thereby enabling the target website to detect the protection performance of the website security device in a timely manner, effectively reducing the risk of the website security device being attacked and meeting normal business needs.

[0201] As an implementation mode, the attack case sending module 502' is also used to detect whether the current mode of sending the attack case is the proxy mode; if it is the proxy mode, create a coroutine task consistent with the number of proxy server addresses; send the attack case to the proxy server through multiple coroutine tasks using the port corresponding to each proxy server address, so that the proxy server forwards the attack case to the target website.

[0202] As an implementation mode, the attack case sending module 502' is also used to determine whether to use the proxy mode to send the attack case according to the current configuration information; if the proxy mode is used, apply to the proxy server for multiple proxy server addresses and ports corresponding to each proxy server address according to the current configuration information.

[0203] As an implementation mode, the attack case sending module 502' is also used to create multiple coroutine tasks if it is not the proxy mode; add request identification information in the request header of the attack case to obtain an updated attack case; and send the updated attack case to the target website using different local ports through multiple coroutine tasks.

[0204] The specific implementation of the equipment protection performance detection device of the present invention can refer to the above-mentioned method embodiments, which will not be repeated here.

[0205] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0206] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0207] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0208] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for detecting equipment protection performance, It is characterized in that The method comprises: At the end of the simulated attack on the website security device, obtaining protection information of the website security device against the simulated attack, wherein the simulated attack is triggered by an attack case sent by the attack server through multiple coroutine tasks using different ports; Determining protection success information based on the protection situation information and the source information of the attack use case; The protection performance of the website security device is determined according to the protection success information.

2. The equipment protection performance detection method according to claim 1, It is characterized in that The step of determining the protection success information based on the protection situation information and the source information of the attack use case comprises: Determine the time range in which the website security device is subjected to the simulated attack according to the protection situation information; Obtaining the system logs generated by the website security device within the time range; querying an alarm log in the system log according to the source information of the attack use case, wherein the alarm log is generated when the website security device successfully protects against the simulated attack; The protection success information of the website security device is determined based on the query result.

3. The equipment protection performance detection method according to claim 2, It is characterized in that The step of querying the alarm log in the system log according to the source information of the attack use case includes: Determining identification information of the simulated attack according to source information of the attack use case; Detecting whether the identification information is a proxy server address; If so, query the target system log in the system log that matches the proxy server address, and use the target system log as an alarm log.

4. The equipment protection performance detection method according to any one of claims 1 to 3, It is characterized in that The step of determining the protection performance of the website security device according to the protection success information includes: Determine the total number of attack use cases of the simulated attack according to the source information; Determining the duration of the website security device being attacked by the simulated attack; The protection performance of the website security device is determined by the total number of attack use cases, the attack duration, and the protection success information.

5. The equipment protection performance detection method according to claim 4, It is characterized in that The step of determining the protection performance of the website security device through the protection success information, the total number of attack use cases, and the attack duration includes: Determine the throughput of the website security device according to the total number of attack cases and the attack duration; Determine the protection rate of the website security device under the throughput based on the total number of attack use cases and the protection success information; The protection performance of the website security device is determined according to the protection rate.

6. A method for detecting equipment protection performance, It is characterized in that The method is applied to attack a server, and the method comprises: Determine the attack cases that the website security device of the target website can prevent from the preset attack case library; The attack use case is sent to the target website using different ports through multiple coroutine tasks, so that the target website determines the protection performance of the website security device based on the simulated attack triggered by the attack use case.

7. A device for detecting equipment protection performance, It is characterized in that The device comprises: A simulated attack protection module, used for obtaining protection information of the website security device against the simulated attack when the simulated attack on the website security device ends, wherein the simulated attack is triggered by an attack case sent by the attack server through multiple coroutine tasks using different ports; A protection information determination module, used to determine protection success information based on the protection situation information and the source information of the attack use case; A protection performance detection module is used to determine the protection performance of the website security device according to the protection success information.

8. A device for detecting equipment protection performance, It is characterized in that The device comprises: An attack case determination module is used to determine the attack cases that can be prevented by the website security device of the attack target from a preset attack case library; An attack case sending module is used to send the attack case to the target website using different ports through multiple coroutine tasks, so that the target website determines the protection performance of the website security device based on the simulated attack triggered by the attack case.

9. A device for testing the protective performance of equipment, It is characterized in that The device includes: a memory, a processor, and a device protection performance detection program stored in the memory and executable on the processor, wherein the device protection performance detection program is configured to implement the steps of the device protection performance detection method as described in any one of claims 1 to 5 or claim 6.

10. A storage medium, It is characterized in that The storage medium stores a device protection performance detection program, which, when executed by a processor, implements the steps of the device protection performance detection method as described in any one of claims 1 to 5 or claim 6.

Images