Target range platform for network security exercises

Abstract

This application discloses a target range platform for network security exercises, comprising: a heterogeneous virtualization environment construction module for constructing a locally virtualized target machine environment; a traffic recording and review module; and a console module. The heterogeneous virtualization environment construction module includes a construction submodule and a routing and forwarding submodule. The construction submodule is used to construct the target machine environment using hybrid virtualization technology. The target machine environment includes several target machines and several network devices. The target machines and network devices, as well as the target machines themselves, are connected via virtual communication links, forming a virtual network topology with an undirected graph structure. The routing and forwarding submodule is also used to achieve network isolation between the target machine environment and the external network by responding to outbound routing blocking policies. This enables localized deployment of the target machine environment and isolates external network connections during network security exercises, eliminating the need for traffic backhaul and reducing the risk of data leakage.

Description

Technical Field

[0001] This application generally relates to the field of cybersecurity technology. More specifically, this application relates to a test range platform for cybersecurity drills. Background Technology

[0002] Currently, existing network range platforms mainly adopt a centralized web-based online model, where the range platform is deployed on the service provider's cloud, and users access it remotely via a browser. In this model, the range platform's training environment is uniformly built and managed in the cloud, and all attack traffic, business data, and operation logs generated by users locally must be transmitted back to the SaaS backend via the Internet for storage, analysis, and display.

[0003] However, the aforementioned centralized online web model carries the risk of traffic leakage. Specifically, the training traffic in this model needs to be transmitted to the cloud backend via the internet. Attack loads and business data are mixed in the public network link, which may be illegally intercepted by backbone network TAP devices, intermediate nodes, or third parties. Therefore, because the traffic return path crosses the user's controllable boundaries, sensitive data is at risk of leakage.

[0004] Therefore, there is an urgent need to provide a target range platform for cybersecurity drills in order to solve the above problems. Summary of the Invention

[0005] In order to at least address one or more of the technical problems mentioned above, this application proposes a range platform for cybersecurity exercises in several aspects to overcome the deficiencies described in the background art above.

[0006] In a first aspect, this application provides a target range platform for network security drills, comprising: a heterogeneous virtualization environment construction module for constructing a locally virtualized target machine environment; a traffic recording and review module for collecting drill data and reviewing the drill process; a console module for unified management of the target range platform; and a drill presentation module for visually presenting the drill process of the target range platform. The heterogeneous virtualization environment construction module includes a construction submodule and a routing and forwarding submodule. The construction submodule is used to construct the target machine environment using hybrid virtualization technology. The target machine environment includes several target machines and several network devices, wherein the target machines and the network devices, and the target machines themselves, are connected via virtual communication links, collectively forming an undirected graph-structured virtual network topology. The routing and forwarding submodule is used for interaction within the target machine environment and between the target machine environment and the external network; wherein, the routing and forwarding submodule is also used to achieve network isolation between the target machine environment and the external network by responding to the outbound routing blocking policy.

[0007] In some embodiments, each target machine and network device constructed by the construction submodule is configured with: one or more internal network interface cards (NICs) connected to the routing and forwarding submodule via sockets to carry attack and defense exercise traffic; and one external network interface card (NIC) connected to the host machine's physical NIC via bridging to communicate with the external network or the console module.

[0008] In some embodiments, the routing and forwarding submodule is further configured to: respond to ARP requests from the target machine and the network device, and maintain an IP-MAC mapping table for the target machine and the network device; maintain the MAC addresses and connection relationships of the target machine and the network device using a routing mechanism, wherein broadcast forwarding is performed when a data frame with an unknown destination address is received, and directed forwarding is performed when a data frame with a known destination address is received; act as a DHCP server to assign IP addresses to the accessing target machine and the network device; enable the target machine and the network device to access the external network through NAT translation; dynamically allocate network bandwidth to different target machines and network devices through a bandwidth limiting function, and adjust priorities according to a policy; VLAN tags are used to logically isolate different virtual networks within the target machine environment; an access policy based on a whitelist is used for intranet interaction within the target machine environment.

[0009] In some embodiments, the traffic recording and replay module includes: a first capture submodule, used to capture Ethernet frames forwarded by the routing and forwarding submodule in real time; a storage submodule, used to add timestamps to the Ethernet frames and store them in a database; and a playback submodule, used to replay the Ethernet frames in timestamp order and / or export them as pcap files.

[0010] In some embodiments, the traffic recording and replay module further includes a second capture submodule for capturing behavioral data via a WAF virtual device and a lightweight situational awareness probe, wherein the behavioral data includes attack behavior data and defense behavior data; the storage submodule adds timestamps to the Ethernet frames and the behavioral data based on the following tagging rules: , For time-series event logs; This represents the event association mapping function. Represents an Ethernet frame. Data representing attack behavior, This represents the sequential relationship of defensive behavior data over time.

[0011] The storage submodule stores the Ethernet frames and the behavioral data based on the following storage rules: For any Ethernet frame With behavioral state data The storage rules are specified as follows: ,in To allow for time deviation, This indicates a status that has been stored or written to the log. Represents a timestamp.

[0012] In some embodiments, the console module includes: a drill scenario selection submodule, used to provide attack and defense scenario templates, the attack and defense scenario templates including at least one of penetration testing, APT attack simulation, intranet lateral penetration, and domain penetration; a status monitoring submodule, used to display the operating status of the target machine and the network device, intranet traffic statistics and CPU / memory usage information; and a user permission management submodule, used to set user operation permissions.

[0013] In some embodiments, the target range platform further performs the following method: when the exercise scenario selection submodule receives the target exercise scenario template selected by the user, it determines whether the host machine meets the download requirements of the target exercise scenario template according to a preset deployment judgment function; if it does, it obtains the image file corresponding to the target exercise scenario template; it verifies the image file; if the verification passes, it uses an orchestration engine to download the image file and the template file to the host machine; the heterogeneous virtualization environment construction module constructs a local virtualized target machine environment corresponding to the target exercise scenario based on the image file and the template file.

[0014] In some embodiments, the exercise presentation module visualizes the exercise scenario by performing the following steps: abstracting internet-side assets, near-source internal networks, routers, firewalls, and virtual target machine nodes as game units; generating corresponding target machines and network devices through virtualization technology and mapping them to the game units; using a TileMap to express the network topology and location between the target machines and network devices; converting attack and defense actions into game events and displaying the game events on the TileMap using corresponding representations, wherein the game events include at least one of attack initiation, penetration, lateral movement, vulnerability exploitation, traffic propagation, and defense blocking, and the representations include at least one of highlighted links, arrow trajectories, and particle explosion effects; and visually displaying the current status of each target machine and network device on the TileMap, wherein the current status includes at least one of idle, under attack, intruded, and defense response.

[0015] In some embodiments, the target range platform further includes an attack and defense behavior recording module, used for multi-dimensional behavior collection and data storage during attack and defense exercises; wherein, the multi-dimensional behavior collection includes: attack behavior collection, which captures in real time the attack instructions and operation records initiated by users or attack scripts, wherein the attack instructions and operation records each include at least one of the actions such as command execution, vulnerability exploitation, and lateral movement; defense behavior collection, which records the defense measures and response strategies automatically triggered by the platform or triggered by the user, wherein the defense measures and response strategies each include at least one of the actions such as firewall rule changes, traffic blocking, isolation actions, and alarm events; the data storage includes: target status recording, which records the log changes, system call information, and process status of the target machine during the attack and defense process; multi-source data association storage, which associates and stores the attack instructions, defense responses, and virtual machine log data with the time-series data generated by the traffic recording and review module; and visual review, which visualizes and replays the causal relationship between the data obtained from the attack behavior collection, the defense behavior collection, and the target status recording in the exercise presentation module.

[0016] In some embodiments, the target range platform further performs the following method: when the console module receives a user's target machine environment deployment request, it obtains the image file corresponding to the target machine environment scenario selected by the user; verifies the image file; if the verification passes, it determines the incremental package of the image file through a differential incremental update function; downloads the incremental package to the host machine based on the download speed determined by the bandwidth allocation function; and the heterogeneous virtualization environment construction module constructs the locally virtualized target machine environment corresponding to the target machine environment scenario based on the incremental package.

[0017] The target range platform for cybersecurity exercises described above achieves isolation between the target environment and the external network through the coordinated efforts of the target machine environment local virtualization capabilities provided by the construction submodule and the outbound blocking strategies of the routing and forwarding submodule. On one hand, by deploying the target environment in a local virtualized environment, a basic isolation is formed between the target environment and the real network environment at either the physical or virtualization level. On the other hand, the outbound blocking strategies of the routing and forwarding submodule proactively intercept and control outbound traffic at the network level. Ultimately, this fundamentally solves the inherent defects of existing centralized web-based online modes, such as the leakage of exercise traffic and the transmission and leakage of sensitive data across controllable boundaries, achieving localized closed-loop management and security isolation of the attack and defense exercise environment. Attached Figure Description

[0018] The above and other objects, features, and advantages of exemplary embodiments of this application will become readily understood by reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of this application are illustrated by way of example and not limitation, and the same or corresponding reference numerals denote the same or corresponding parts, wherein: Figure 1 This application shows a schematic diagram illustrating the structure of a range platform for cybersecurity drills according to some embodiments of the present application. Figure 2 This illustration shows the interaction between various virtual devices constructed by a range platform for cybersecurity drills according to some embodiments of this application; Figure 3 This application illustrates a network architecture diagram within a target machine environment constructed by a range platform for cybersecurity exercises, according to some embodiments of this application. Figure 4 This document illustrates the interaction diagrams of various virtual devices constructed by a range platform for cybersecurity drills according to some embodiments of this application. Figure 5 An exemplary flowchart illustrating methods performed by a range platform for cybersecurity drills according to some embodiments of this application is shown. Figure 6 An exemplary flowchart illustrating methods performed by a range platform for cybersecurity drills according to some embodiments of this application is shown. Figure 7 An exemplary flowchart illustrating methods performed by a range platform for cybersecurity drills according to some embodiments of this application is shown. Figure 8 An exemplary flowchart illustrating methods performed by a range platform for cybersecurity drills according to some embodiments of this application is shown. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] It should be understood that the terms "comprising" and "including" used in the specification and claims of this application indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0021] It should also be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application. As used in this specification and claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this specification and claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations.

[0022] As used in this specification and claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0023] The specific embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0024] Exemplary application scenarios Currently, existing network range platforms mainly adopt a centralized web-based online model, where the range platform is deployed on the service provider's cloud, and users access it remotely via a browser. In this model, the range platform's training environment is uniformly built and managed in the cloud, and all attack traffic, business data, and operation logs generated by users locally must be transmitted back to the SaaS backend via the Internet for storage, analysis, and display.

[0025] However, the aforementioned centralized online web model carries the risk of traffic leakage. Specifically, the training traffic in this model needs to be transmitted to the cloud backend via the internet. Attack loads and business data are mixed in the public network link, which may be illegally intercepted by backbone network TAP devices, intermediate nodes, or third parties. Therefore, because the traffic return path crosses the user's controllable boundaries, sensitive data is at risk of leakage.

[0026] Exemplary application scheme It should be noted that the target range platform for network security exercises provided in this application includes, but is not limited to, target machines, network devices, routing devices, and attack machines. The relationships between these devices can be found by referring to... Figure 2 As shown.

[0027] In view of this, embodiments of this application provide a range platform for cybersecurity drills, such as... Figure 1As shown, it includes a heterogeneous virtualization environment construction module for building a local virtualized target machine environment; a traffic recording and review module for collecting exercise data and reviewing the exercise process; a console module for unified management of the target range platform; and an exercise presentation module for visually presenting the exercise process of the target range platform.

[0028] Furthermore, the heterogeneous virtualization environment construction module includes a construction submodule and a routing and forwarding submodule. The construction submodule is used to construct a target machine environment through hybrid virtualization technology. The target machine environment includes several target machines and several network devices, wherein the target machines and the network devices, as well as the target machines themselves, are connected through virtual communication links to form a virtual network topology with an undirected graph structure. The routing and forwarding submodule is used for interaction within the target machine environment and between the target machine environment and the external network. The routing and forwarding submodule is also used to achieve network isolation between the target machine environment and the external network by responding to outbound routing blocking policies.

[0029] Specifically, the set of virtual machines built by the construction submodule is Its communication link set is Then the entire virtual network can be represented as an undirected graph. That is, the target environment, where each vertex Represents a target machine or network device, with each edge , , This indicates its virtual link. As an example, the network architecture within the target machine environment built by the construction submodule is as follows: Figure 3 As shown.

[0030] Based on the target range platform for network security exercises disclosed in the above embodiments, it achieves isolation between the target machine environment and the external network through the coordinated operation of the target machine environment local virtualization construction capability provided by the construction submodule and the outbound blocking strategy of the routing and forwarding submodule. On the one hand, by deploying the target machine environment in a local virtualization environment, a basic isolation is formed from the real network environment at the physical or virtualization level; on the other hand, through the outbound blocking strategy of the routing and forwarding submodule, outbound traffic is actively intercepted and controlled at the network level. Ultimately, this fundamentally solves the essential defects of the existing centralized Web online mode, such as the leakage of exercise traffic and the leakage of sensitive data across controllable boundaries, and realizes local closed-loop management and security isolation of the attack and defense exercise environment.

[0031] In some embodiments, the outbound routing blocking strategy is as follows: The set of nodes on the external network is defined as... It represents the set of network nodes outside the target machine environment, that is, external entities that may interact with the target machine environment via the network. The definition specifies the collection of target machines and network devices within the target machine environment. Node set with external network The traffic forwarding matrix between them is , , , ,in: Indicates that virtual machines are allowed. With external nodes communication; This indicates that communication is prohibited; The platform stipulates the following initial conditions: .

[0032] In some embodiments, the construction submodule is used to build a locally virtualized target machine environment based on QEMU (Quick Emulator) and Docker container virtualization technology. It can be understood that the virtual machine built based on QEMU (Quick Emulator) and Docker container virtualization technology serves as the target machine and network device.

[0033] In some embodiments, each target machine and network device constructed by the construction submodule is configured with: one or more internal network interface cards (NICs), which are connected to the routing and forwarding submodule via sockets to carry attack and defense exercise traffic; and an external network interface card (NIC), which is connected to the host machine's physical NIC via bridging to communicate with the external network or the console module.

[0034] Furthermore, each target machine and network device built by the construction submodule is equipped with multiple intranet interface cards (NICs), which can be used to collaboratively build a multi-level intranet architecture and achieve local isolation and segmented management of complex topologies.

[0035] In some embodiments, the routing and forwarding submodule is also used for: It responds to ARP requests from target machines and network devices, and maintains IP-MAC mapping tables for target machines and network devices, thereby enabling automatic resolution and dynamic management of Layer 2 addresses of network nodes and improving the automation level of network communication. A routing mechanism is used to maintain the MAC addresses and connection relationships of target machines and network devices. When a data frame with an unknown destination address is received, broadcast forwarding is performed, and when a data frame with a known destination address is received, targeted forwarding is performed. This reduces redundant broadcast traffic and improves data forwarding efficiency and network resource utilization while ensuring network connectivity. As a DHCP server, it assigns IP addresses to connected target machines and network devices, avoiding the tedious operation and address conflict problems caused by manually configuring IP addresses, and simplifying the network deployment process of the target machine environment. By using NAT (Network Address Translation), the target machine and network devices can access the external network. While enabling communication between the target machine environment and the external network, the internal network structure is hidden, thereby improving the security of the target machine environment. By dynamically allocating network bandwidth to different target machines and network devices through bandwidth limiting functions and adjusting priorities according to policies, fine-grained control and reasonable scheduling of network bandwidth can be achieved to ensure the service quality of critical services. By using VLAN tags to logically isolate different virtual networks within the target machine environment, traffic from different virtual networks can be effectively isolated, thereby improving network security and topology flexibility. The whitelist-based access policy enables intranet interaction within the target machine environment, thereby strictly restricting access permissions, preventing unauthorized access and lateral movement, and enhancing the security protection capabilities of the target machine environment. At the same time, it supports the targeted forwarding of legitimate traffic such as security updates and specific resource acquisition in special scenarios, achieving strong isolation while also ensuring necessary communication flexibility.

[0036] In some embodiments, the routing and forwarding submodule is also used to further combine VLAN tags and bandwidth limiting functions to logically divide different training groups or experimental scenarios within the target machine environment, avoid mutual interference, and ensure the stability and controllability of the network environment.

[0037] Specifically, let the set of virtual machines be... The training group or experimental scenario set is Define the VLAN tag set as Establish a mapping function between virtual machines and VLAN tags. Through this allocation mapping function, each virtual machine is assigned a corresponding VLAN tag according to its experimental scenario, achieving logical isolation. It is understood that the virtual machine referred to in this application refers to a virtual entity, i.e., a virtual device, constructed by the construction submodule to constitute the target machine environment, including but not limited to target machines, network devices, routing devices, and attack machines. Further details will not be elaborated upon below.

[0038] Furthermore, set up a virtual machine. Available bandwidth is each The maximum allowed bandwidth is Define bandwidth allocation constraints: At the same time, the bandwidth limit for each virtual machine can be set to... This is to ensure that different groups or scenarios do not interfere with each other and to maintain a stable network environment.

[0039] Based on the above operations, the bandwidth of virtual machines exceeding the maximum bandwidth limit of VLANs can be compressed proportionally, thereby ensuring logical isolation and fair resource allocation.

[0040] Therefore, the routing and forwarding submodule of this application embodiment, as a network communication hub between the target machine environment and the external network, can realize the automated deployment, efficient forwarding, fine control and security isolation of the network inside the target machine environment, while controllably opening up the communication channel with the external network, providing flexible, stable and reliable network infrastructure support for security drills.

[0041] In some embodiments, the traffic recording and replay module includes: a first capture submodule for capturing Ethernet frames forwarded by the routing and forwarding submodule in real time; a storage submodule for adding timestamps to the Ethernet frames and storing them in a database; and a playback submodule for replaying the Ethernet frames in timestamp order and / or exporting them as pcap files. It is understood that exporting pcap files allows the captured Ethernet frames to continue to be used by third-party analysis tools.

[0042] Furthermore, in some embodiments, the capture first submodule can capture Ethernet frames forwarded by the routing and forwarding submodule in real time based on the socket.

[0043] The first sub-module captures traffic data, which cannot parse application layer business semantics, nor can it identify security-related information such as network attack behavior and device malfunction. The data dimension is single and can only meet the basic traffic retention and simple communication tracing needs.

[0044] Therefore, in some embodiments, the traffic recording and review module further includes a second capture submodule, used to capture behavioral data through a WAF (Virtual Web Application Firewall Device) and a lightweight cybersecurity situational awareness probe. This behavioral data includes behaviors and their corresponding states. For example, attack behavior data includes command execution, vulnerability exploitation, lateral movement, and privilege escalation, with corresponding states including successful execution, failed execution, and interception. Thus, the first and second capture submodules constitute a two-layer acquisition plane, working together to ultimately achieve comprehensive data retention encompassing traffic, behavior, and state, fully addressing the data limitations of single traffic acquisition.

[0045] Furthermore, in some embodiments, the behavioral data captured by the second submodule includes attack behavior data and defense behavior data.

[0046] In some embodiments, the set of nodes within the target environment is assumed to be The attack behavior data set is The defensive behavior data set is Ethernet frame set is , ,in For source and destination nodes, For timestamps, This refers to the message size.

[0047] The storage submodule adds timestamps to Ethernet frames and behavioral data based on the following tagging rules: , For time-series event logs; This represents the event association mapping function. Represents Ethernet frame, Data representing attack behavior, This represents the sequential relationship of defensive behavior data over time.

[0048] The storage submodule stores Ethernet frames and behavioral status data based on the following storage rules: For any Ethernet frame With behavioral state data Define storage rules: ,in To allow for time deviation, This indicates a status that has been stored or written to the log. Represents a timestamp.

[0049] Based on the above operations, it can be ensured that the captured Ethernet frames and behavioral data correspond to each other in terms of timing and storage, thereby ensuring the correct order of traffic and behavioral data during subsequent review.

[0050] In some embodiments, the storage submodule is further configured to associate and map the captured behavioral data with the corresponding Ethernet frames, so that during subsequent review, the corresponding behavioral events can be traced back through the Ethernet frames, achieving bidirectional tracing and cross-validation. This association mapping function can be expressed as: .

[0051] Therefore, this application embodiment constructs a dual-layer acquisition and storage mechanism that deeply integrates raw frame data and semantic behavior data through traffic recording and review modules. On the one hand, the first capture submodule preserves complete Ethernet frame-level network evidence; on the other hand, the second capture submodule introduces WAF virtual devices and lightweight situational awareness probes, supplementing high-dimensional semantic data such as application-layer attack behavior, defense behavior, and device status. The two are precisely aligned in the time dimension and bidirectionally correlated in the storage structure, ultimately achieving full-dimensional data retention integrating traffic, behavior, and status, comprehensively addressing the data shortcomings of single traffic acquisition, and providing traceable, analyzable, and verifiable review data support for network security exercises.

[0052] In some embodiments, the console module includes: a drill scenario selection submodule, used to provide attack and defense scenario templates, the attack and defense scenario templates including at least one of penetration testing, APT attack simulation, intranet lateral penetration, and domain penetration; a status monitoring submodule, used to display the operating status of target machines and network devices, intranet traffic statistics and CPU / memory usage information; and a user permission management submodule, used to set user operation permissions.

[0053] Therefore, in this embodiment of the application, the console module enables users to quickly deploy exercise scenarios, monitor target machine status in real time, and flexibly manage user permissions based on a visual interface, thereby achieving centralized control of the entire process of security exercises.

[0054] In some embodiments, the range platform for cybersecurity drills in this application also includes an attack and defense behavior recording module, used for multi-dimensional behavior collection and data storage during attack and defense drills.

[0055] Specifically, multi-dimensional behavior collection includes: attack behavior collection, which captures in real time the attack instructions and operation records initiated by users or attack scripts, and the attack instructions and operation records include at least one of the actions such as command execution, vulnerability exploitation, and lateral movement; and defense behavior collection, which records the defense measures and response strategies automatically triggered by the platform or triggered by the user, and the defense measures and response strategies include at least one of the actions such as firewall rule changes, traffic blocking, isolation actions, and alarm events. Data storage includes: target status recording, which records the log changes, system call information and process status of the target machine during the attack and defense process; multi-source data association storage, which associates and stores attack commands, defense responses and virtual machine log data with time-series data generated by the traffic recording and review module; and visual review, which visualizes and replays the causal relationship between the data obtained from the attack behavior collection, defense behavior collection and target status recording in the exercise presentation module.

[0056] In some embodiments, the exercise presentation module visualizes the exercise scenario by performing the following steps: abstracting Internet-side assets, near-source internal networks, routers, firewalls, and virtual target machine nodes as game units; generating corresponding target machines and network devices through virtualization technology and mapping them to the game units; and using a TileMap to express the network topology and location between the target machines and network devices. Attack and defense actions are transformed into game events, and the game events are displayed on the TileMap in a corresponding manner. The game events include at least one of attack initiation, penetration, lateral movement, vulnerability exploitation, traffic propagation, and defense blocking. The display manner includes at least one of highlighted links, arrow trajectories, and particle explosion effects. The current status of each target machine and network device is visualized on the TileMap, and the current status includes at least one of idle, under attack, intruded, and defense response.

[0057] In some embodiments, the target range platform further includes a version detection module for updating the image file version corresponding to different target machine environment scenarios.

[0058] To further understand the interaction relationships between the virtual devices constructed by the range platform in this application embodiment, please refer to... Figure 4 The diagram shows the system interaction of the various virtual devices built on the test range platform.

[0059] Therefore, this application embodiment achieves refined recording and reliable evidence storage of the entire attack and defense exercise process through the attack and defense behavior recording module. This module not only collects behavioral data such as attack commands and defense responses, but also deeply integrates target state changes with traffic time-series data, forming a complete evidence chain from attack initiation and defense response to target state change, providing a solid data foundation for post-exercise debriefing analysis, responsibility identification, and protection strategy optimization.

[0060] The following describes the target machine environment deployment method 100 for a network security exercise range platform disclosed in any of the above embodiments. It can be understood that the heterogeneous virtualization environment construction module of the range platform is used to build a locally virtualized target machine environment. Its construction process relies on pre-prepared target machine environment image files for quickly instantiating virtual machines or containers, thereby achieving automated deployment. For example... Figure 5 As shown, method 100 includes steps S101 to S105.

[0061] Step S101: When the console module receives the user's target machine environment deployment request, it obtains the image file corresponding to the target machine environment scenario selected by the user. In this embodiment, the image file is obtained from a remote image repository, and each image file obtained from the remote image repository... All come with hashes With digital signatures .

[0062] Step S102: Verify the image file; In this embodiment, the image file undergoes hash verification and digital signature verification sequentially; only when both verifications pass is the verification considered successful. Only then will the verification pass.

[0063] Step S103: If the verification passes, determine the incremental package of the image file using the differential incremental update function; In this embodiment, the image file is deduplicated using a differential incremental update function to obtain an incremental package, thereby reducing the download size and improving download efficiency.

[0064] Specifically, let the mirror set be Each image file Defined as a quadruple ,in For mirror identification, This is the default configuration. For resource needs, For dependency collection. Define the local image repository as... This includes removable media or local area network repositories; remote image repositories are... The target machine environment scenario selected by the user is Based on this, we can define a deduplicated set: This represents content that already exists in the local mirror repository and does not need to be downloaded again. Then, a differential incremental update function is used. Based on the image set corresponding to the target machine environment With the deduplication set Determine the incremental packet as This allows for the deduplication of image files, and the incremental package satisfies... .

[0065] In some implementations, if the verification fails, the local download of the image file is terminated and rolled back.

[0066] Step S104: Based on the download speed determined by the bandwidth allocation function, download the incremental packet to the host machine; In this embodiment, the bandwidth allocation function is: ,in This is the maximum number of concurrent downloads. Total bandwidth quota This represents the current number of concurrent tasks. This limits the maximum download speed for a single task, ensuring that the current download process does not affect other services.

[0067] Step S105: The heterogeneous virtualization environment construction module constructs the local virtualized target machine environment corresponding to the target machine environment scenario based on the incremental package.

[0068] Therefore, the method 100 of this application embodiment achieves efficient, secure, and reliable automated deployment of the target machine environment through the coordinated operation of three major mechanisms: image verification, differential incremental update, and bandwidth allocation. Specifically, hash verification and digital signature verification ensure the integrity and source credibility of the image file, preventing image tampering or malicious code injection; the differential incremental update function significantly reduces the amount of network data transmitted through deduplication, improving deployment efficiency; and the bandwidth allocation function dynamically adjusts the download speed, avoiding resource contention for other platform services during image download. The combined effect of these mechanisms ensures both security and efficiency in the target machine environment deployment process.

[0069] In some embodiments, the range platform for cybersecurity drills in any of the above embodiments also executes method 200, such as... Figure 6 As shown, method 200 includes steps S201 to S204.

[0070] Step S201: Compress the base image files corresponding to each target machine environment scenario, and download the compressed base image files and / or incremental packages to the local image repository associated with the host machine; In this embodiment, the base image file refers to the base image used to construct the underlying runtime environment of the target machine environment. It may include an operating system image and / or a pre-configured basic runtime environment image, and typically does not contain vulnerability configurations, service configurations, or attack / defense orchestrations specific to the current target exercise scenario. The difference between the base image file and the incremental package is that the base image file provides the basic runtime carrier required for target machine environment deployment, while the incremental package records scenario differences relative to the base image file. By storing the base image file and the incremental package separately, the base image file can be reused, reducing the overhead of repeated downloads and storage, thereby supporting rapid deployment and offline reuse of target machine environment scenarios.

[0071] In some embodiments, the qemu-img convert command provided by the QEMU virtualization platform can be used to compress the image file, for example: qemu-img convert -O qcow2 -c raw_image.qcow2 compressed_image.qcow2.

[0072] Step S202: When the console module receives the user's target machine environment deployment request again, from the... The local image repository retrieves the compressed base image file and / or incremental package corresponding to the target machine environment scenario selected by the user; In this embodiment, the image files required for deployment in the target machine environment scenario include a base image file and / or incremental packages, which can be represented as follows: It is understandable that the base image file is essential for deploying the target machine environment, while incremental packages are not mandatory and can be obtained by users as needed. By pre-caching the base image file and incremental packages locally, when users need to redeploy the target machine environment, the range platform can complete the target machine image download, deployment, drills, and replays in a standalone or local area network (LAN) environment without relying on the external internet, thereby reducing deployment and maintenance costs and preventing the leakage of attack traffic.

[0073] Step S203: Verify the base image file and / or the incremental package; In this embodiment, the compressed base image file and incremental package All come with hashes With digital signatures The base image file and / or incremental package are sequentially subjected to hash verification and digital signature verification. Verification is considered successful only if both verifications pass. Only then will the verification pass.

[0074] Step S204: If the verification passes, download the compressed base image file and / or incremental package to the host machine based on the download speed determined by the bandwidth allocation function; The bandwidth allocation function is the same as or similar to the description of step S104 above, and will not be repeated here.

[0075] Step S205: The heterogeneous virtualization environment construction module constructs the locally virtualized target machine environment corresponding to the target machine environment scenario based on the compressed base image file and / or the incremental package.

[0076] Therefore, the method 200 of this application embodiment achieves offline deployment and rapid reuse of the target machine environment through the coordinated operation of four major mechanisms: local cache pre-setting, offline acquisition, integrity verification and bandwidth control.

[0077] In some embodiments, the range platform for cybersecurity drills in any of the above embodiments also executes method 300, such as... Figure 7 As shown, method 300 includes steps S301 to S304.

[0078] Step 301: After the target machine and network devices built by the heterogeneous virtualization environment construction module have started up completely for the first time and completed the initialization operation, QEMU is triggered to save a snapshot to obtain a snapshot file. The snapshot operation includes recording memory, CPU state, and device context, and the initialization operation includes domain joining, service loading, and network configuration. Step S302, the snapshot file With the corresponding image file Binding to establish mapping relationships ; In this embodiment, establishing a mapping relationship between snapshot files and corresponding image files can ensure the consistency between snapshot files and image files.

[0079] Step S303: When the user requests to start the target machine and / or network device, locate the target snapshot file that matches the target machine and / or network device. And load the memory state corresponding to the target snapshot file; Step S304: Transfer the target snapshot file via QEMU. Write to the host machine memory to restore the state of the CPU, registers, and I / O devices, and take over the execution flow again.

[0080] Therefore, through the method 300 of this application embodiment, when the user re-enables the target machine and / or network device, the target machine and / or network device can directly enter the "initialized" state, avoiding the re-execution of the BIOS / Kernel / service startup process, and achieving second-level availability of the target machine and network device.

[0081] In some embodiments, the range platform for cybersecurity drills provided in any of the above embodiments further performs the following version update method, wherein the method can be executed by the version detection module of the range platform: firstly, requesting the version number of the range platform from a remote update server via a secure channel. The secure channel can be HTTPS or an encrypted API; further, if the version number... Greater than the current version number of the test range platform Then the current version of the test range platform will be used. Updated to version number The corresponding version.

[0082] Furthermore, in some embodiments, the version update employs a differential update mechanism: assuming the full installation package size is... The differential patch size is Theoretical optimization objective: , This means minimizing the patch file size while ensuring that the platform version correctly transitions to the latest version after the patch is applied.

[0083] In some embodiments, the downloaded version number is also checked before updating the version. The corresponding update package undergoes security verification. Specifically, the update package includes a hash. and digital signatures The verification method for the update package includes: performing a SHA256 hash operation on the update package to obtain a local hash. If the hash included with the update package With local hash Same, and for digital signatures If the signature verification passes, the verification is successful; otherwise, the verification fails, the update package is discarded, and the rollback is initiated.

[0084] Therefore, the version update method provided in this application embodiment can realize secure, fast, and low-bandwidth online upgrades of the test range platform, effectively reducing update costs and operational risks, and ensuring that the platform always runs on the latest stable version.

[0085] In some embodiments, the range platform for cybersecurity drills in any of the above embodiments also executes method 400, such as... Figure 8 As shown, method 400 includes steps S401 to S405.

[0086] Step S401: When the exercise scenario selection submodule receives the target exercise scenario template selected by the user, it determines whether the host machine meets the download requirements of the target exercise scenario template according to the preset deployment judgment function. Specifically, let the set of attack and defense scenarios supported by the test range platform be . Each scene A template element set is defined as consisting of several template elements. Each template element It can be represented as a quadruple: They represent: Image ID; : A set of configuration parameters, such as IP address, network interface card (NIC), VLAN, service port, startup script, etc. Resource requirement vectors (CPU, memory, disk, bandwidth) can be represented as follows: ; : A set of dependencies, which are dependencies on other template elements or external simulation services. Therefore, the target training scenario... It can be defined as an ordered collection of template elements: .

[0087] Based on the above representation of the target training scenario, the deployment decision function is expressed as:

[0088] in Represents the host environment resource vector , Represents template element In the environment Check whether the dependencies are met, such as whether the required simulation services and network plugins are available.

[0089] Step S402: If satisfied, obtain the image file corresponding to the target training scenario template; Step S403: Verify the image file; In this embodiment, each template element Version number included With signature And store the hash value in the template metadata. Used to verify download integrity and prevent tampering.

[0090] Step S404: If the verification passes, the image file is downloaded to the host machine using the orchestration engine; In this embodiment, the orchestration engine uses scene sequences. As input, generate a sequence of deployment actions. Each action It can be represented as The orchestration engine must satisfy dependency order and resource quota constraints.

[0091] Step S405: The heterogeneous virtualization environment construction module constructs the local virtualized target machine environment corresponding to the target training scenario based on the image file.

[0092] Therefore, through the standardized description and deployment determination mechanism of the exercise scenario template based on the method 400 of this application embodiment, the precise, controllable and automated deployment of the exercise scenario is realized.

[0093] While numerous embodiments of this application have been shown and described herein, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Many modifications, alterations, and alternatives will arise for those skilled in the art without departing from the spirit and intent of this application. It should be understood that various alternatives to the embodiments of this application described herein may be employed in the practice of this application. The appended claims are intended to define the scope of protection of this application and therefore cover equivalents or alternatives within the scope of these claims.

Claims

1. A range platform for network security exercises, characterized by, include: The heterogeneous virtualization environment building module is used to build a local virtualized target machine environment; The traffic recording and review module is used to collect exercise data and review the exercise process; The console module is used for unified management of the target range platform; The exercise presentation module is used to visually present the exercise process of the target range platform; wherein, The heterogeneous virtualization environment construction module includes a construction submodule and a routing and forwarding submodule; The construction submodule is used to construct the target machine environment through hybrid virtualization technology. The target machine environment includes several target machines and several network devices, wherein the target machines and the network devices are connected, and the target machines are connected to each other through virtual communication links, forming a virtual network topology with an undirected graph structure. The routing and forwarding submodule is used for interaction within the target machine environment and between the target machine environment and the external network. The routing and forwarding submodule is also used to achieve network isolation between the target machine environment and the external network by responding to the outbound network blocking policy.

2. The target range platform according to claim 1, characterized in that, Each target machine and network device constructed by the construction submodule is configured with: One or more intranet network cards are connected to the routing and forwarding submodule via sockets to carry the attack and defense exercise traffic; An external network interface card (NIC) is connected to the host machine's physical NIC via a bridge connection for communication with the external network or the console module.

3. The target range platform according to claim 1, characterized in that, The routing and forwarding submodule is also used for: Respond to ARP requests from the target machine and the network device, and maintain the IP-MAC mapping table between the target machine and the network device; A routing mechanism is used to maintain the MAC addresses and connection relationships between the target machine and the network device. When a data frame with an unknown destination address is received, broadcast forwarding is performed, and when a data frame with a known destination address is received, directed forwarding is performed. As a DHCP server, it assigns IP addresses to the target machines and network devices that connect to the network. The target machine and the network device can access the external network through NAT translation. Network bandwidth is dynamically allocated to different target machines and network devices through a bandwidth limiting function, and priority is adjusted according to the policy; VLAN tags are used to logically isolate different virtual networks within the target machine environment; The target machine environment's intranet interaction is performed based on a whitelist-based access policy.

4. The target range platform according to claim 1, characterized in that, The traffic recording and review module includes: The first capture submodule is used to capture Ethernet frames forwarded by the routing and forwarding submodule in real time. The storage submodule is used to add timestamps to the Ethernet frames and store them in the database; The playback submodule is used to replay the Ethernet frames in timestamp order and / or export them as pcap files.

5. The target range platform according to claim 1, characterized in that, The traffic recording and review module also includes a second capture sub-module, which is used to capture behavioral data through WAF virtual devices and lightweight situational awareness probes, wherein the behavioral data includes attack behavior data and defense behavior data. The storage submodule adds timestamps to the Ethernet frames and the behavioral data based on the following tagging rules: , For time-series event logs; This represents the event association mapping function. Represents an Ethernet frame. Data representing attack behavior, This represents the sequential relationship of defensive behavior data over time. The storage submodule stores the Ethernet frames and the behavioral data based on the following storage rules: For any Ethernet frame With behavioral state data The storage rules are specified as follows: ,in To allow for time deviation, This indicates the status that has been stored or written to the log. Represents a timestamp.

6. The target range platform according to claim 1, characterized in that, The console module includes: The exercise scenario selection submodule is used to provide attack and defense scenario templates, which include at least one of penetration testing, APT attack simulation, internal network lateral penetration, and domain penetration. The status monitoring submodule is used to display the operating status of the target machine and the network device, intranet traffic statistics, and CPU / memory usage information. The user permission management submodule is used to set user operation permissions.

7. The target range platform according to claim 6, characterized in that, The test range platform performs the following method: When the exercise scenario selection submodule receives the target exercise scenario template selected by the user, it determines whether the host machine meets the download requirements of the target exercise scenario template according to the preset deployment judgment function; If the conditions are met, obtain the image file corresponding to the target training scenario template; Verify the image file; If the verification passes, the orchestration engine will download the image file and template file to the host machine. The heterogeneous virtualization environment construction module constructs a local virtualized target machine environment corresponding to the target training scenario based on the image file.

8. The target range platform according to claim 1, characterized in that, The exercise presentation module visualizes the exercise scenario by performing the following steps: Internet-side assets, near-source internal networks, routers, firewalls, and virtual target nodes are abstracted as game units; The corresponding target machines and network devices are generated using virtualization technology and mapped to the game units; Use a TileMap to represent the network topology and location between the target machine and network devices; The attack and defense actions are transformed into game events, and the game events are displayed on the TileMap in a corresponding manner. The game events include at least one of attack initiation, penetration, lateral movement, vulnerability exploitation, traffic propagation and defense blocking. The manner of display includes at least one of highlighted links, arrow trajectories and particle explosion effects. The current status of each target machine and network device is visualized on the TileMap, wherein the current status includes at least one of idle, under attack, intrusion, and defense response.

9. The target range platform according to any one of claims 1-8, characterized in that, It also includes an attack and defense behavior recording module, used for multi-dimensional behavior collection and data storage during attack and defense drills; among which, The multi-dimensional behavior collection includes: Attack behavior collection involves capturing attack commands and operation records initiated by users or attack scripts in real time. The attack commands and operation records include at least one of the following actions: command execution, vulnerability exploitation, lateral movement, etc. Defense behavior collection records defense measures and response strategies automatically triggered by the platform or triggered by the user. The defense measures and response strategies include at least one of firewall rule changes, traffic blocking, isolation actions, and alarm events. The data storage includes: Target status recording records the log changes, system call information, and process status of the target machine during the attack and defense process; Multi-source data association storage associates and stores attack commands, defense responses, and virtual machine log data with time-series data generated by the traffic recording and review module. The visual debriefing allows for the visual replay of the causal relationships between the data obtained from the attack behavior collection, the defense behavior collection, and the target status record within the exercise presentation module.

10. A target range platform according to any one of claims 1-9, characterized in that, The test range platform performs the following method: When the console module receives a user's target machine environment deployment request, it obtains the image file corresponding to the target machine environment scenario selected by the user. Verify the image file; If the verification passes, the incremental package of the image file is determined using the differential incremental update function; Based on the download speed determined by the bandwidth allocation function, the incremental packet is downloaded to the host machine; The heterogeneous virtualization environment construction module constructs a locally virtualized target machine environment corresponding to the target machine environment scenario based on the incremental package.

Images