Method, device, electronic device, system and storage medium for preventing network attacks

Abstract

The embodiment of the present invention discloses a method, device, electronic device, system and storage medium for preventing network attacks. The method for preventing network attacks includes: obtaining a business script from a control terminal; generating a control instruction for each controlled terminal according to the business script; sending a control instruction to the corresponding controlled terminal, so as to control the corresponding controlled terminal to obtain a target item from a target server through the control instruction and feed back the acquisition result of the target item to the control terminal, and the acquisition result is used to determine the ability of the target server to prevent network attacks. The embodiment of the present invention can detect the ability of the target server to prevent network attacks by simulating network attacks. If the prevention ability does not meet the standard, the corresponding risk control strategy can be upgraded, thereby effectively preventing network attacks and improving the ability of the target server to prevent network attacks.

Description

Technical Field

[0001] The present invention relates to risk control technology, and in particular to a method, device, electronic device, system and storage medium for preventing network attacks. Background Art

[0002] In order to promote consumption and increase sales, enterprises or businesses will hold some marketing activities, such as issuing some red envelopes, coupons, etc., in order to benefit consumers. However, these red envelopes, coupons, etc. are easily targeted by the cybercrime industry, which attacks the server through illegal means to collect these red envelopes and coupons, making it impossible for normal consumers to collect them, which seriously infringes on the interests of normal consumers and businesses. In the process of realizing the present invention, the inventor found that there is currently no effective means to prevent such network attacks. Summary of the invention

[0003] The embodiments of the present invention provide a method, device, electronic device, system and storage medium for preventing network attacks, which can effectively prevent network attacks and enhance the ability of a target server to prevent network attacks.

[0004] In a first aspect, an embodiment of the present invention provides a method for preventing network attacks, the method comprising:

[0005] Get the business script from the control end;

[0006] Generate control instructions for each controlled terminal according to the business script;

[0007] The control instruction is sent to the corresponding controlled end, so as to control the corresponding controlled end to obtain the target item from the target server through the control instruction and feed back the acquisition result of the target item to the control end, and the acquisition result is used to determine the ability of the target server to prevent network attacks.

[0008] In a second aspect, an embodiment of the present invention provides another method for preventing network attacks, the method comprising:

[0009] Sending a service script to a group control server, so that the group control server generates a control instruction for each controlled terminal according to the service script and sends the control instruction to the corresponding controlled terminal;

[0010] receiving control results fed back by each controlled terminal, wherein each controlled terminal obtains a target object from a target server according to a corresponding control instruction;

[0011] The control result is displayed so that the administrator can determine the target server's ability to prevent network attacks based on the control result.

[0012] In a third aspect, an embodiment of the present invention provides a device for preventing network attacks, the device comprising:

[0013] The acquisition module is used to obtain the business script from the control end;

[0014] A generating module, used for generating control instructions for each controlled terminal according to the business script;

[0015] The control module is used to send the control instruction to the corresponding controlled end, so as to control the corresponding controlled end to obtain the target item from the target server through the control instruction and feed back the acquisition result of the target item to the control end, and the acquisition result is used to determine the ability of the target server to prevent network attacks.

[0016] In a fourth aspect, an embodiment of the present invention provides another device for preventing network attacks, the device comprising:

[0017] A sending module, used to send a service script to a group control server, so that the group control server generates a control instruction for each controlled terminal according to the service script and sends the control instruction to the corresponding controlled terminal;

[0018] A receiving module, used to receive control results fed back by each controlled terminal, wherein each controlled terminal obtains a target object from a target server according to a corresponding control instruction;

[0019] The display module is used to display the control result so that the administrator can determine the ability of the target server to prevent network attacks based on the control result.

[0020] In a fifth aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for preventing network attacks as described in any one of the embodiments of the present invention is implemented.

[0021] In a sixth aspect, an embodiment of the present invention further provides a control system, comprising a controlled end, a target server, a group control server for executing any of the methods for preventing network attacks described in the embodiments of the present invention, and a control end for executing any of the methods for preventing network attacks described in the embodiments of the present invention.

[0022] In a seventh aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method for preventing network attacks as described in any one of the embodiments of the present invention.

[0023] In an embodiment of the present invention, a business script can be obtained from the control end, and a control instruction can be generated for each controlled end according to the business script, and the control instruction can be sent to the corresponding controlled end, so as to control the corresponding controlled end to obtain the target item from the target server through the control instruction and feedback the acquisition result of the target item to the control end. The ability of the target server to prevent network attacks can be known based on the acquisition result of the target item obtained by the control end; that is, in an embodiment of the present invention, the ability of the target server to prevent network attacks can be detected by simulating network attacks. If the prevention ability does not meet the standard, the corresponding risk control strategy can be upgraded, thereby effectively preventing network attacks and improving the ability of the target server to prevent network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 The present invention is a flowchart of a method for preventing network attacks provided by an embodiment of the present invention.

[0026] Figure 2 It is another flowchart of the method for preventing network attacks provided by an embodiment of the present invention.

[0027] Figure 3 This is another flowchart of the method for preventing network attacks provided by an embodiment of the present invention.

[0028] Figure 4 The present invention is a schematic diagram of a system for preventing network attacks provided by an embodiment of the present invention.

[0029] Figure 5 The present invention is a schematic diagram of a device for preventing network attacks provided by an embodiment of the present invention.

[0030] Figure 6 It is another structural schematic diagram of the device for preventing network attacks provided by an embodiment of the present invention.

[0031] Figure 7 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0033] Figure 1 1 is a flow chart of a method for preventing network attacks provided by an embodiment of the present invention. The method can be executed by a device for preventing network attacks provided by an embodiment of the present invention. The device can be implemented in software and / or hardware. In a specific embodiment, the device can be integrated in a server. The following embodiments will be described by taking the device integrated in a server as an example.

[0034] In order to distinguish it from the target server mentioned later, the server integrated with the control device of the embodiment of the present invention can be understood as a group control server used to control multiple controlled terminals. The Appium framework can be built in the server. The Appium framework is an open source, cross-platform testing framework that can be used to test native and hybrid mobile applications. Appium supports IOS (mobile operating system developed by Apple) and Android (mobile operating system developed by Google) and other systems. Appium uses the Json Wire protocol of WebDriver to drive the UIAutomation framework of the IOS system and the UIAutomator framework of the Android system.

[0035] Please refer to Figure 1 The method for preventing network attacks provided by the embodiment of the present invention may specifically include the following steps:

[0036] Step 101, obtaining a service script from a control terminal.

[0037] For example, the control end can be a personal computer (PC), tablet computer, laptop computer, desktop computer and other terminals. When the ability of the target server to prevent network attacks needs to be tested, a general business script can be written on the control end to control the controlled end to obtain the target item from the target server, or a pre-written business script can be loaded on the control end, and the server obtains the business script from the control end. Among them, the target item can be, for example, coupons, red envelopes and other items, the controlled end can be a terminal such as a mobile phone or tablet computer, and the target server can be a backend server of a merchant or enterprise.

[0038] For example, an e-commerce platform plans to carry out a promotion and issue a batch of coupons to attract consumers. In order to prevent cybercriminals from illegally attacking the target server to claim these coupons, before issuing the coupons, the operation of the cybercriminals can be simulated to detect the target server's ability to prevent network attacks. Then, the business script used to control the controlled end to claim the coupons from the target server can be obtained from the control end.

[0039] Step 102: Generate control instructions for each controlled terminal according to the business script.

[0040] In the specific implementation, since the cyber black industry usually controls a batch of devices when making network attacks, there can be multiple controlled terminals in the embodiment of the present invention. Specifically, a communication connection can be established with each controlled terminal through the debugging bridge ADB tool, such as establishing a communication connection with each controlled terminal through the ADB tool in a wired (such as universal serial bus USB) or wireless (such as Wifi) manner, and then obtaining the identification information of each controlled terminal, and generating control instructions for each controlled terminal according to the business script and the identification information of each controlled terminal. Among them, the identification information of the controlled terminal is used to uniquely identify the controlled terminal, and the identification information of the controlled terminal may include the factory serial number (Serial Number, SN) of the controlled terminal, the system identification of the controlled terminal (such as system name: Android, IOS, etc.), the system version number and other information.

[0041] The specific method of generating control instructions for each controlled terminal can be as follows:

[0042] (1) Generate and store a dedicated script for each controlled terminal based on the business script and the identification information of each controlled terminal.

[0043] For example, the business script and the identification information of each controlled terminal can be passed into the Appium framework, and the corresponding driver can be encapsulated for each controlled terminal in the Appium framework. The Appium framework can generate a dedicated script for each controlled terminal based on the business script passed in, the identification information of each controlled terminal, and the corresponding driver encapsulated for each controlled terminal. For example, if there are N controlled terminals, the identification information of the N controlled terminals can be passed into the Appium framework, and the general business script can be passed into the Appium framework. The Appium framework can generate a dedicated script for each of the N controlled terminals based on this business script, the identification information of the N controlled terminals, and the N drivers encapsulated for the N controlled terminals, that is, N dedicated scripts are generated, and N is a positive integer.

[0044] After generating a dedicated script for each controlled terminal, the generated dedicated script can be stored. In a specific embodiment, the dedicated script generated for each controlled terminal and the identification information of each controlled terminal can be written into a YAML file for storage. The YAML file is a configuration file. Compared with configuration files such as ini and conf, the YAML file is more concise and easy to operate, and can also store different types of data. The dedicated script generated for each controlled terminal and the identification information of each controlled terminal can be written into the YAML file for storage, which facilitates subsequent operations.

[0045] (2) Execute the dedicated script to generate control instructions for each controlled terminal.

[0046] Specifically, the dedicated script can be executed by the server process to generate control instructions for each controlled terminal.

[0047] For example, an Appium server process may be started, and the Appium server process may be used to obtain the dedicated scripts generated for each controlled terminal from the YAML file and execute them in sequence, thereby generating control instructions for each controlled terminal.

[0048] Alternatively, in order to improve data processing efficiency, multiple Appium server processes can be started at the same time. For example, an Appium server process can be started for each controlled end. The Appium server process started for each controlled end can be used to obtain the corresponding exclusive script from the YAML file and execute it, thereby generating control instructions for each controlled end.

[0049] It can be seen that in the embodiment of the present invention, the Appium framework can be used to generate control instructions for multiple controlled terminals according to a common business script, thereby realizing one script controlling multiple controlled terminals. Therefore, when group control of multiple controlled terminals is required, only a common business script needs to be written on the control terminal, thereby reducing development costs.

[0050] Step 103 , sending a control instruction to the corresponding controlled terminal, so as to control the corresponding controlled terminal to obtain the target item from the target server through the control instruction and feed back the acquisition result of the target item to the control terminal.

[0051] In the specific implementation, in order to facilitate the control of each controlled terminal, an application installation package of a remote management smart device (Smartphone Test Farm, STF) tool can be implanted in each controlled terminal. This application installation package consists of an open source high-speed screenshot tool minicap and a simulation operation tool minitouch. After sending the corresponding control command to each controlled terminal, the control command can be used to control the corresponding controlled terminal's system UIAutomation framework to start the corresponding application to obtain the target object from the target server; at the same time, the minicap that triggers the STF captures the image of the controlled terminal in real time by calling the ndk screenshot interface of the underlying Android of the controlled terminal, and transmits the captured image to the control terminal browser in real time through the websocket interface, so that the control terminal can obtain a sequence of image streams, which are synthesized into a video, which shows the process of the controlled terminal obtaining the target object from the target server; on the other hand, the minitouch that triggers the STF simulates the interface operations such as clicking and sliding on the controlled terminal, so that the control terminal can monitor the operations of each controlled terminal and control each controlled terminal.

[0052] Each controlled end can feed back the acquisition result of the target item to the control end in real time through the websocket interface. The acquisition result is used to determine the target server's ability to prevent network attacks. If the target item is successfully acquired, it means that the network attack is successful. If the acquisition of the target item fails, it means that the network attack fails. After the control end obtains the acquisition results of the target item acquired by each controlled end, a detection report can be generated. According to the detection report generated by the control end, the ability of the target server to prevent network attacks can be known. For example, the success rate of network attacks can be obtained according to the detection report generated by the control end. When the success rate of network attacks reaches a certain preset value (such as 70%, 80%), it can be considered that the target server's ability to prevent network attacks is not up to standard, and the corresponding risk control strategy can be upgraded.

[0053] According to the method provided in the embodiment of the present invention, different business scripts can be written to simulate network attacks in different business scenarios, so that the risk control system can identify more risk tags, comprehensively improve the target server's ability to prevent network attacks, and prevent criminals from making illegal profits.

[0054] In an embodiment of the present invention, a business script can be obtained from the control end, and a control instruction can be generated for each controlled end according to the business script, and the control instruction can be sent to the corresponding controlled end, so as to control the corresponding controlled end to obtain the target item from the target server through the control instruction and feedback the acquisition result of the target item to the control end. The ability of the target server to prevent network attacks can be known based on the acquisition result of the target item obtained by the control end; that is, in an embodiment of the present invention, the ability of the target server to prevent network attacks can be detected by simulating network attacks. If the prevention ability does not meet the standard, the corresponding risk control strategy can be upgraded, thereby effectively preventing network attacks and improving the ability of the target server to prevent network attacks.

[0055] The following examples further illustrate the method for preventing network attacks provided by the embodiment of the present invention. Figure 2 The method of the embodiment of the present invention comprises the following steps:

[0056] Step 201: Establish communication connection with each controlled terminal through the debug bridge ADB tool.

[0057] For example, the ADB tool can be used to establish a communication connection with each controlled terminal in a wired (such as Universal Serial Bus USB) or wireless (such as Wifi) manner. The controlled terminal can be, for example, a mobile phone, a tablet computer or other terminal, and there can be multiple controlled terminals.

[0058] Step 202, obtaining a service script from the control end.

[0059] For example, the control terminal may be a terminal such as a personal computer, a tablet computer, a laptop computer, a desktop computer, etc., the business script may be a general script for controlling the controlled terminal to obtain the target item from the target server, and the target server may be a backend server of a merchant or enterprise. Taking the target item as a red envelope as an example, the business script may be a script for controlling the controlled terminal to receive the red envelope from the target server.

[0060] Step 203: Obtain identification information of each controlled terminal.

[0061] For example, the identification information of the controlled terminal may include the factory serial number of the controlled terminal, the system identification of the controlled terminal (such as system name: Android, IOS, etc.), the system version number and other information.

[0062] Step 204, the business script and the identification information of each controlled terminal are passed to the Appium framework, and a corresponding driver is encapsulated for each controlled terminal in the Appium framework, and a dedicated script is generated for each controlled terminal using the Appium framework.

[0063] Specifically, the Appium framework can generate a dedicated script for each controlled terminal based on the business script passed in, the identification information of each controlled terminal, and the corresponding driver encapsulated for each controlled terminal. For example, if there are N controlled terminals, the identification information of the N controlled terminals can be passed into the Appium framework, and the common business script can be passed into the Appium framework. The Appium framework generates a dedicated script for each of the N controlled terminals based on this business script, the identification information of the N controlled terminals, and the N drivers encapsulated for the N controlled terminals, that is, generates N dedicated scripts, where N is a positive integer.

[0064] Step 205, write the dedicated script generated for each controlled terminal and the identification information of each controlled terminal into a YAML file for storage.

[0065] YAML file is a configuration file. Compared with ini, conf and other configuration files, YAML file is more concise and simple to operate. It can also store different types of data. The exclusive scripts generated for each controlled terminal and the identification information of each controlled terminal are written into the YAML file for storage, which facilitates subsequent operations.

[0066] Step 206, start the Appium server process to obtain the dedicated script from the YAML file and execute it, so as to generate control instructions for each controlled terminal.

[0067] For example, an Appium server process may be started, and the Appium server process may be used to obtain the dedicated scripts generated for each controlled terminal from the YAML file and execute them in sequence, thereby generating control instructions for each controlled terminal.

[0068] Alternatively, in order to improve data processing efficiency, multiple Appium server processes can be started at the same time. For example, an Appium server process can be started for each controlled end. The Appium server process started for each controlled end can be used to obtain the corresponding exclusive script from the YAML file and execute it, thereby generating control instructions for each controlled end.

[0069] Step 207 , sending a control instruction to the corresponding controlled terminal, so as to control the corresponding controlled terminal to obtain the target item from the target server through the control instruction and feed back the acquisition result of the target item to the control terminal.

[0070] Specifically, an application installation package of the STF tool can be implanted in each controlled terminal, and this application installation package consists of an open source high-speed screenshot tool minicap and a simulation operation tool minitouch. After sending the corresponding control instructions to each controlled terminal, the control instructions can be used to control the corresponding controlled terminal's system UIAutomation framework to start the corresponding application to obtain the target object from the target server; at the same time, minicap is triggered to capture the image of the controlled terminal in real time by calling the ndk screenshot interface of the controlled terminal's Android bottom layer, and the captured image is transmitted to the control terminal browser in real time through the websocket interface, so that the control terminal can obtain a sequence of image streams, which are synthesized into a video, and the video shows the process of the controlled terminal obtaining the target object from the target server; on the other hand, minitouch is triggered to simulate the interface operations such as clicking and sliding on the controlled terminal, so that the control terminal can monitor the operations of each controlled terminal and control each controlled terminal.

[0071] In addition, dual-opening software, proxy software, etc. can be installed on the controlled end, so that multiple identical applications can be run on a controlled end at the same time, and control instructions can be used to control multiple identical applications to obtain target items from the target server. For example, dual-opening software for running two "JD.com" applications at the same time can be installed on the controlled end, and two JD.com applications can be run on the controlled end at the same time. Control instructions can be used to control the two JD.com applications to receive red envelopes from the JD.com server at the same time, thereby more comprehensively testing the target server's ability to prevent network attacks.

[0072] Each controlled end can feed back the acquisition result of the target item to the control end in real time through the websocket interface. If the target item is successfully acquired, it means that the network attack is successful. If the target item fails to be acquired, it means that the network attack fails. After the control end obtains the acquisition result of each controlled end acquiring the target item, a detection report can be generated. According to the detection report generated by the control end, the ability of the target server to prevent network attacks can be known. For example, the success rate of network attacks can be obtained according to the detection report generated by the control end. When the success rate of network attacks reaches a certain preset value (such as 80%, 90%), it can be considered that the ability of the target server to prevent network attacks is not up to standard, and the corresponding risk control strategy can be upgraded, so as to effectively prevent network attacks and enhance the ability of the target server to prevent network attacks.

[0073] Figure 3It is another flow chart of the method for preventing network attacks provided by an embodiment of the present invention. The method can be executed by the device for preventing network attacks provided by an embodiment of the present invention, and the device can be implemented in software and / or hardware. In a specific embodiment, the device can be integrated in a control terminal, and the control terminal can be a terminal such as a personal computer, a tablet computer, a laptop computer, a desktop computer, etc. The following embodiments will be described by taking the device integrated in the control terminal as an example.

[0074] like Figure 3 As shown, the method of this embodiment includes the following steps:

[0075] Step 301: Send a service script to a group control server, so that the group control server generates a control instruction for each controlled terminal according to the service script and sends the control instruction to the corresponding controlled terminal.

[0076] For example, when it is necessary to test the target server's ability to prevent network attacks, a general business script can be written on the control end to control the controlled end to obtain the target item from the target server, or a pre-written business script can be loaded on the control end and then sent to the group control server.

[0077] The target items may be, for example, coupons, red envelopes and other items, the controlled terminals may be terminals such as mobile phones and tablet computers, and the target server may be a backend server of a merchant or enterprise.

[0078] Step 302, receiving the control result fed back by each controlled terminal, where the control result is the result of each controlled terminal obtaining the target object from the target server according to the corresponding control instruction.

[0079] For example, after receiving the business script, the group control server can obtain the identification information of each controlled terminal, generate a control instruction for each controlled terminal according to the business script and the identification information of each controlled terminal, and then send the control instruction to the corresponding controlled terminal, so as to control the corresponding controlled terminal to obtain the target item from the target server through the control instruction and feedback the acquisition result of the target item to the control terminal, and the control terminal receives the acquisition result fed back by each controlled terminal. For the specific method of generating the control instruction for each controlled terminal, please refer to the description of the previous embodiment, which will not be repeated here.

[0080] Step 303: display the control result so that the administrator can determine the target server's ability to prevent network attacks based on the control result.

[0081] In the specific implementation, in order to facilitate the control of each controlled terminal, an application installation package of a remote management smart device (Smartphone Test Farm, STF) tool can be implanted in each controlled terminal. This application installation package consists of an open source high-speed screenshot tool minicap and a simulation operation tool minitouch. After the group control server sends the corresponding control command to each controlled terminal, the control command can be used to control the corresponding controlled terminal's system UIAutomation framework to start the corresponding application to obtain the target object from the target server; at the same time, the minicap that triggers the STF captures the image of the controlled terminal in real time by calling the ndk screenshot interface of the underlying Android of the controlled terminal, and transmits the captured image to the control terminal browser in real time through the websocket interface, so that the control terminal can obtain a sequence of image streams, which are synthesized into a video, which shows the process of the controlled terminal obtaining the target object from the target server; on the other hand, the minitouch that triggers the STF simulates the interface operations such as clicking and sliding on the controlled terminal, so that the control terminal can monitor the operations of each controlled terminal and control each controlled terminal.

[0082] Each controlled end can feed back the acquisition result of the target item to the control end in real time through the websocket interface. The acquisition result is used to determine the target server's ability to prevent network attacks. If the target item is successfully acquired, it means that the network attack is successful. If the acquisition of the target item fails, it means that the network attack fails. After the control end obtains the acquisition results of the target items acquired by each controlled end, the acquisition results can be displayed, and a test report can be generated based on the acquisition results. The ability of the target server to prevent network attacks can be known based on the test report generated by the control end. For example, the success rate of network attacks can be obtained based on the test report generated by the control end. When the success rate of network attacks reaches a certain preset value (such as 70%, 80%), it can be considered that the target server's ability to prevent network attacks is not up to standard, and the corresponding risk control strategy can be upgraded.

[0083] In the embodiment of the present invention, the target server's ability to prevent network attacks can be detected by simulating network attacks. If the prevention capability does not meet the standard, the corresponding risk control strategy can be upgraded to effectively prevent network attacks and enhance the target server's ability to prevent network attacks.

[0084] For example, let's simulate the cybercrime group control of a group of mobile phones to receive JD.com red envelopes to test the JD.com server's ability to prevent network attacks. For example, JD.com wants to carry out a promotion and plans to distribute a batch of red envelopes to attract consumers. In order to prevent the cybercrime from illegally attacking the target server to collect these red envelopes, before distributing the red envelopes, the operation of the cybercrime can be simulated to test the target server's ability to prevent network attacks. Specifically, Figure 4 As shown, the control end can be a PC, the controlled end can be a mobile phone, there can be multiple controlled ends, and the target server can be the backend server of JD.com. Then, the STF application installation package can be implanted in each of these mobile phones, and then a communication connection can be established with these mobile phones through the ADB tool to obtain the business script used to control the mobile phones to receive red envelopes from the JD.com server from the PC; after obtaining the business script, the business script and the identification information of this batch of mobile phones can be passed to the Appium framework in the group control server, and the corresponding driver can be encapsulated for each mobile phone in the Appium framework, and a dedicated script can be generated for each mobile phone using the Appium framework; then an Appium server can be started for each mobile phone to perform The Appium server process started for each mobile phone executes the exclusive script generated for each mobile phone, thereby generating a control instruction for each mobile phone and sending the control instruction to the corresponding mobile phone; after receiving the control instruction, the corresponding mobile phone can, under the control of the control instruction, open the JD application and send a red envelope collection request to the JD server. The red envelope collection process can be transmitted to the PC in the form of a screenshot through the STF tool to form a picture stream, and the PC can display the red envelope collection status of each mobile phone in real time. Finally, the PC can generate a detection report based on the results of each mobile phone receiving the red envelope. According to the detection report, it can be known whether the JD server's ability to prevent network attacks meets the standards.

[0085] In an embodiment of the present invention, a business script can be obtained from the control end, and a control instruction can be generated for each controlled end according to the business script, and the control instruction can be sent to the corresponding controlled end, so as to control the corresponding controlled end to obtain the target item from the target server through the control instruction and feedback the acquisition result of the target item to the control end. The ability of the target server to prevent network attacks can be known based on the acquisition result of the target item obtained by the control end; that is, in an embodiment of the present invention, the ability of the target server to prevent network attacks can be detected by simulating network attacks. If the prevention ability does not meet the standard, the corresponding risk control strategy can be upgraded, thereby effectively preventing network attacks and improving the ability of the target server to prevent network attacks.

[0086] Figure 5 1 is a structural diagram of a device for preventing network attacks provided by an embodiment of the present invention. The device is suitable for executing a method for preventing network attacks provided by an embodiment of the present invention. The device may be a group control server. Figure 5 As shown, the device may specifically include:

[0087] The acquisition module 501 is used to acquire the service script from the control terminal;

[0088] A generating module 502, configured to generate a control instruction for each controlled terminal according to the service script;

[0089] The control module 503 is used to send the control instruction to the corresponding controlled end, so as to control the corresponding controlled end to obtain the target item from the target server through the control instruction and feedback the acquisition result of the target item to the control end, and the acquisition result is used to determine the ability of the target server to prevent network attacks.

[0090] In one embodiment, the generating module 502 generates control instructions for each controlled terminal according to the service script, including:

[0091] Obtaining identification information of each controlled terminal;

[0092] The control instruction is generated for each controlled terminal according to the business script and the identification information of each controlled terminal.

[0093] In one embodiment, the generating module 502 generates the control instruction for each controlled terminal according to the service script and the identification information of each controlled terminal, including:

[0094] Generating and storing a dedicated script for each controlled terminal according to the business script and the identification information of each controlled terminal;

[0095] The dedicated script is executed to generate the control instructions for each controlled terminal.

[0096] In one embodiment, the generating module 502 generates a dedicated script for each controlled terminal according to the service script and the identification information of each controlled terminal, including:

[0097] The business script and the identification information of each controlled terminal are passed into the Appium framework, and a corresponding driver is encapsulated for each controlled terminal in the Appium framework. The Appium framework is used to generate a dedicated script for each controlled terminal according to the business script passed into the Appium framework, the identification information of each controlled terminal, and the corresponding driver encapsulated for each controlled terminal.

[0098] In one embodiment, the generating module 502 stores the dedicated script, including:

[0099] The dedicated scripts generated for the respective controlled terminals and the identification information of the respective controlled terminals are correspondingly written into a YAML file for storage.

[0100] In one embodiment, the generation module 502 executes the dedicated script to generate the control instruction for each controlled terminal, including:

[0101] An Appium server process is started for each controlled terminal, and the corresponding dedicated script is obtained from the YAML file and executed by using the Appium server process started for each controlled terminal, so as to generate the control instruction for each controlled terminal.

[0102] In one embodiment, the generation module 502 executes the dedicated script to generate the control instruction for each controlled terminal, including:

[0103] The Appium server process is started, and the dedicated scripts generated for each controlled terminal are obtained from the YAML file using the Appium server process and executed in sequence, thereby generating the control instructions for each controlled terminal.

[0104] In one embodiment, the device further comprises:

[0105] The connection module is used to establish a communication connection with each controlled terminal through a debug bridge ADB tool.

[0106] In one embodiment, each controlled terminal is implanted with a remote management intelligent device STF tool, and the control module 503 controls the corresponding controlled terminal to feed back the acquisition result of the target item to the control terminal through the control instruction, including:

[0107] The control instruction controls the corresponding controlled end to use the STF tool to feed back the acquisition result of the target object to the control end.

[0108] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the functional modules described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0109] The device of the embodiment of the present invention can obtain a business script from the control end, generate a control instruction for each controlled end according to the business script, and send the control instruction to the corresponding controlled end, so as to control the corresponding controlled end to obtain the target item from the target server through the control instruction and feedback the acquisition result of the target item to the control end. The ability of the target server to prevent network attacks can be known according to the acquisition result of the target item obtained by the control end; that is, in the embodiment of the present invention, the ability of the target server to prevent network attacks can be detected by simulating network attacks. If the prevention ability does not meet the standard, the corresponding risk control strategy can be upgraded, thereby effectively preventing network attacks and improving the ability of the target server to prevent network attacks.

[0110] Figure 6 It is another structural diagram of the device for preventing network attacks provided by an embodiment of the present invention. The device is suitable for executing the method for preventing network attacks provided by an embodiment of the present invention. The device can be a control end.

[0111] like Figure 6 As shown, the device may specifically include:

[0112] The sending module 601 is used to send a service script to the group control server, so that the group control server generates a control instruction for each controlled terminal according to the service script and sends the control instruction to the corresponding controlled terminal;

[0113] A receiving module 602 is used to receive control results fed back by each controlled terminal, where each controlled terminal obtains a target object from a target server according to a corresponding control instruction;

[0114] The display module 603 is used to display the control result so that the administrator can determine the ability of the target server to prevent network attacks according to the control result.

[0115] The device of the embodiment of the present invention can detect the target server's ability to prevent network attacks by simulating network attacks. If the prevention capability does not meet the standard, the corresponding risk control strategy can be upgraded to effectively prevent network attacks and enhance the target server's ability to prevent network attacks.

[0116] An embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for preventing network attacks provided in any of the above embodiments is implemented.

[0117] An embodiment of the present invention further provides a computer-readable medium having a computer program stored thereon, and when the program is executed by a processor, the method for preventing network attacks provided by any of the above embodiments is implemented.

[0118] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 of an electronic device suitable for implementing an embodiment of the present invention. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0119] like Figure 7As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0120] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0121] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0122] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0123] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0124] The modules and / or units involved in the embodiments of the present invention may be implemented in software or hardware. The modules and / or units described may also be set in a processor, for example, it may be described as: a processor includes an acquisition module, a generation module and a control module; or it may be described as: a processor includes a sending module, a receiving module and a display module. The names of these modules do not, in some cases, constitute limitations on the modules themselves.

[0125] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes: obtaining a business script from a control terminal; generating a control instruction for each controlled terminal according to the business script; sending the control instruction to the corresponding controlled terminal, so as to control the corresponding controlled terminal to obtain the target item from the target server through the control instruction and feedback the acquisition result of the target item to the control terminal, and the acquisition result is used to determine the ability of the target server to prevent network attacks.

[0126] Alternatively, when the above one or more programs are executed by a device, the device includes: sending a business script to a group control server, so that the group control server generates control instructions for each controlled terminal according to the business script and sends the control instructions to the corresponding controlled terminal; receiving control results fed back by each controlled terminal, wherein the control results are the results of each controlled terminal obtaining the target item from the target server according to the corresponding control instructions; and displaying the control results so that the management personnel can determine the ability of the target server to prevent network attacks based on the control results.

[0127] According to the technical solution of the embodiment of the present invention, the ability of the target server to prevent network attacks can be detected by simulating network attacks. If the prevention ability does not meet the standard, the corresponding risk control strategy can be upgraded to effectively prevent network attacks and enhance the ability of the target server to prevent network attacks.

[0128] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for preventing network attacks, characterized in that: Applied to group control servers, including: Get the business script from the control end; Generating a control instruction for each controlled terminal according to the business script, comprising: acquiring identification information of each controlled terminal, generating and storing a dedicated script for each controlled terminal according to the business script and the identification information of each controlled terminal, and executing the dedicated script to generate the control instruction for each controlled terminal, wherein there are multiple controlled terminals; Sending the control instruction to the corresponding controlled end, so as to control the corresponding controlled end to obtain the target item from the target server through the control instruction and feed back the acquisition result of the target item to the control end, generating a detection report based on the acquisition result of the target item, and determining the network attack success rate based on the detection report, wherein the acquisition result includes success and failure, and the network attack success rate is used to determine whether the target server's ability to prevent network attacks meets the standard, and feeding back the picture stream to the control end, so that the control end synthesizes a video according to the picture stream, wherein the video shows the process of the controlled end obtaining the target item from the target server; Among them, each controlled end is implanted with an application installation package of the STF tool for remote management of smart devices, and the application installation package consists of a high-speed screenshot tool and a simulation operation tool. The simulation operation tool is used to simulate the interface operation on the controlled end according to the control instruction, and the high-speed screenshot tool is used to call the system bottom-level screenshot interface of the controlled end according to the control instruction, capture the image of the controlled end in real time, and transmit the captured image to the control end in real time through the web socket interface to perform image synthesis to obtain the video.

2. The method for preventing network attacks according to claim 1, characterized in that: Generating a dedicated script for each controlled terminal according to the business script and the identification information of each controlled terminal includes: The business script and the identification information of each controlled terminal are passed into the Appium framework, and a corresponding driver is encapsulated for each controlled terminal in the Appium framework. The Appium framework is used to generate a dedicated script for each controlled terminal according to the business script passed into the Appium framework, the identification information of each controlled terminal, and the corresponding driver encapsulated for each controlled terminal.

3. The method for preventing network attacks according to claim 1, characterized in that: The storing of the exclusive script comprises: The dedicated scripts generated for the respective controlled terminals and the identification information of the respective controlled terminals are correspondingly written into a YAML file for storage.

4. The method for preventing network attacks according to claim 3, characterized in that: The executing the dedicated script to generate the control instruction for each controlled terminal includes: An Appium server process is started for each controlled terminal, and the corresponding dedicated script is obtained from the YAML file and executed by using the Appium server process started for each controlled terminal, so as to generate the control instruction for each controlled terminal.

5. The method for preventing network attacks according to claim 3, characterized in that: The executing the dedicated script to generate the control instruction for each controlled terminal includes: The Appium server process is started, and the dedicated scripts generated for each controlled terminal are obtained from the YAML file using the Appium server process and executed in sequence, thereby generating the control instructions for each controlled terminal.

6. The method for preventing network attacks according to claim 1, characterized in that: Before obtaining the business script from the control end, it also includes: A communication connection is established with each controlled terminal through a debug bridge ADB tool.

7. A method for preventing network attacks, characterized in that: include: Sending a service script to a group control server so that the group control server obtains identification information of each controlled terminal, generates and stores a dedicated script for each controlled terminal according to the service script and the identification information of each controlled terminal, and executes the dedicated script to generate a control instruction for each controlled terminal, wherein there are multiple controlled terminals; receiving control results fed back by each controlled terminal, wherein each controlled terminal obtains a target object from a target server according to a corresponding control instruction; Generate a detection report according to the acquisition result, and determine the network attack success rate based on the detection report, wherein the network attack success rate is used to determine whether the target server's ability to prevent network attacks meets the standard; receiving the image streams fed back by the controlled terminals, and synthesizing the image streams into a video, wherein the video shows a process in which the controlled terminal obtains the target item from the target server; Displaying the control result and the video so that the administrator can determine whether the network attack is successful according to the control result, and displaying the detection report so that the administrator can determine whether the target server's ability to prevent network attacks meets the standards according to the detection report; Among them, each controlled end is implanted with an application installation package of the STF tool for remote management of smart devices, and the application installation package consists of a high-speed screenshot tool and a simulation operation tool. The simulation operation tool is used to simulate the interface operation on the controlled end according to the control instruction, and the high-speed screenshot tool is used to call the system bottom-level screenshot interface of the controlled end according to the control instruction, capture the image of the controlled end in real time, and transmit the captured image to the control end in real time through the web socket interface to perform image synthesis to obtain the video.

8. A device for preventing network attacks, characterized in that: Applied to group control servers, including: The acquisition module is used to obtain the business script from the control end; A generating module, used to generate a control instruction for each controlled terminal according to the business script, including: obtaining identification information of each controlled terminal, generating and storing a dedicated script for each controlled terminal according to the business script and the identification information of each controlled terminal, and executing the dedicated script to generate the control instruction for each controlled terminal, where there are multiple controlled terminals; A control module, used to send the control instruction to the corresponding controlled terminal, so as to control the corresponding controlled terminal to obtain the target item from the target server through the control instruction and feed back the acquisition result of the target item to the control terminal, generate a detection report based on the acquisition result of the target item, and determine the network attack success rate based on the detection report, the acquisition result includes success and failure, and the network attack success rate is used to determine whether the target server's ability to prevent network attacks meets the standard, and feed back a picture stream to the control terminal so that the control terminal synthesizes a video based on the picture stream, and the video shows the process of the controlled terminal obtaining the target item from the target server; Among them, each controlled end is implanted with an application installation package of the STF tool for remote management of smart devices, and the application installation package consists of a high-speed screenshot tool and a simulation operation tool. The simulation operation tool is used to simulate the interface operation on the controlled end according to the control instruction, and the high-speed screenshot tool is used to call the system bottom-level screenshot interface of the controlled end according to the control instruction, capture the image of the controlled end in real time, and transmit the captured image to the control end in real time through the web socket interface to perform image synthesis to obtain the video.

9. A device for preventing network attacks, characterized in that: include: A sending module, configured to send a service script to a group control server, so that the group control server obtains identification information of each controlled terminal, generates and stores a dedicated script for each controlled terminal according to the service script and the identification information of each controlled terminal, and executes the dedicated script to generate a control instruction for each controlled terminal, wherein there are multiple controlled terminals; A receiving module, used to receive control results fed back by each controlled terminal, wherein the control results are acquisition results of the target object obtained by each controlled terminal from the target server according to the corresponding control instruction, and to generate a detection report according to the acquisition results, and to determine a network attack success rate based on the detection report, wherein the network attack success rate is used to determine whether the target server's ability to prevent network attacks meets the standards, and to receive image streams fed back by each controlled terminal, and to synthesize the image streams into a video, wherein the video shows the process of the controlled terminal obtaining the target object from the target server; A display module, used to display the control result and the video, so that the administrator can determine whether the network attack is successful according to the control result, and to display the detection report, so that the administrator can determine whether the target server's ability to prevent network attacks meets the standards according to the detection report; Among them, each controlled end is implanted with an application installation package of the STF tool for remote management of smart devices, and the application installation package consists of a high-speed screenshot tool and a simulation operation tool. The simulation operation tool is used to simulate the interface operation on the controlled end according to the control instruction, and the high-speed screenshot tool is used to call the system bottom-level screenshot interface of the controlled end according to the control instruction, capture the image of the controlled end in real time, and transmit the captured image to the control end in real time through the web socket interface to perform image synthesis to obtain the video.

10. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the method for preventing network attacks as claimed in any one of claims 1 to 6 is implemented when the processor executes the program, or the method for preventing network attacks as claimed in claim 7 is implemented when the processor executes the program.

11. A system for preventing network attacks, characterized in that: It comprises a controlled end, a target server, a group control server for executing the method for preventing network attacks as described in any one of claims 1 to 6, and a control end for executing the method for preventing network attacks as described in claim 7.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for preventing network attacks as described in any one of claims 1 to 6 is implemented, or when the program is executed by a processor, the method for preventing network attacks as described in claim 7 is implemented.

Images