Network security countermeasure method, device and electronic device

Abstract

The present application proposes a network security confrontation method, device and electronic device, which relate to the field of network security technology. Among them, the above-mentioned network security confrontation method includes: first, using each preset risk item of the defense side host to launch an attack operation to the defense side host. Then, the emergency response score of the defense side host is determined according to the emergency response operation of the defense side host; the reinforcement score of the defense side host is determined according to the attack cost and the repair result of the defense side host to the preset risk item; the counterattack score of the defense side host is determined according to the counterattack operation initiated by the defense side host to the network security counterattack attack platform. Finally, the defense score of the defense side host is determined based on the emergency response score, the reinforcement score and the counterattack score. In order to provide defense personnel with network security training that is closer to actual network attack scenarios, the defense personnel's defense capabilities against network attacks are improved.

Description

[Technical field]

[0001] The present application relates to the field of network security technology, and in particular to a network security confrontation method, device and electronic device. [Background technology]

[0002] With the widespread application and rapid development of Internet technology, various network attacks emerge in an endless stream, and network information security incidents occur from time to time. In this case, it is particularly important to use the network security confrontation platform to conduct relevant network security training for defense personnel.

[0003] At present, the network security training modes of network security confrontation platforms mainly include: Capture The Flag (CTF) mode, war sharing mode, Attack With Defense (AWD) mode, high ground mode, etc. However, these platforms all have the following defects: first, the training mode of the platform does not match the actual network attack scenario and is less practical; second, the training mode of the platform pays more attention to the training of attack skills, and the training content does not match the actual needs of defense personnel. [Summary of the invention]

[0004] The embodiments of the present application provide a network security countermeasure method, device and electronic device to achieve network security training that is closer to actual network attack scenarios and improve the defense capabilities of defense personnel against network attacks.

[0005] In a first aspect, an embodiment of the present application provides a network security confrontation method, comprising: utilizing various preset risk items of a defense side host to initiate an attack operation to the defense side host; determining the emergency response score of the defense side host according to the emergency response operation of the defense side host to the attack operation; determining the reinforcement score of the defense side host according to the attack cost and the repair result of the defense side host to the preset risk items; determining the counterattack score of the defense side host according to the counterattack operation initiated by the defense side host to the network security counterattack platform; determining the defense score of the defense side host according to the emergency response score, the reinforcement score and the counterattack score.

[0006] In one possible implementation, before launching an attack operation on the defense side host using various preset risk items of the defense side host, the method also includes: implanting a first risk item into the defense side host; and implanting a second risk item into the network security anti-attack platform; wherein the first risk item or the second risk item may include any one or more of the following risk items: preset vulnerabilities; preset backdoors; preset virus programs.

[0007] In one possible implementation, the emergency response score of the defense side host is determined according to the emergency response operation of the defense side host to the attack operation, including: launching a vulnerability attack on the defense side host by utilizing a preset vulnerability of the defense side host, and determining the vulnerability repair score of the defense side host according to the defense result of the defense side host to the vulnerability attack; launching a backdoor attack on the defense side host by utilizing a preset backdoor of the defense side host, and determining the backdoor clearing score of the defense side host according to the defense result of the defense side host to the backdoor attack; launching a data theft attack on the defense side host by utilizing a preset virus program of the defense side host, and determining the data protection score of the defense side host according to the defense result of the defense side host to the data theft attack.

[0008] In one possible implementation, the reinforcement score of the defense side host is determined according to the attack cost and the repair result of the defense side host to the preset risk item, including: determining the repaired preset risk item from the preset risk items of the defense side host; determining the reinforcement score of the defense side host according to the attack cost of the attack operation corresponding to the repaired preset risk item; wherein the attack cost may include: attack time limit; attack tool.

[0009] In one possible implementation, the counterattack score of the defense side host is determined according to the counterattack operation initiated by the defense side host to the network security anti-attack platform, including: determining the tracing score of the defense side host according to the time it takes for the defense side host to search for attack information of the network security anti-attack platform; determining the file acquisition score of the defense side host according to the time it takes for the defense side host to obtain the target file from the network security anti-attack platform; and determining the counterattack score of the defense side host according to the tracing score and the file acquisition score.

[0010] In one possible implementation, the defense score of the host on the defense side is determined according to the emergency response score, the reinforcement score and the counterattack score, including: according to preset weights, respectively determining the weighted values ​​of the emergency response score, the reinforcement score and the counterattack score; adding the weighted values ​​of the emergency response score, the reinforcement score and the counterattack score to determine the defense score of the host on the defense side.

[0011] In a second aspect, an embodiment of the present application provides a network security countermeasure device, comprising: an attack module, used to initiate an attack operation on the defense side host by utilizing various preset risk items of the defense side host; a determination module, used to determine the emergency response score of the defense side host according to the emergency response operation of the defense side host to the attack operation; the determination module is also used to determine the reinforcement score of the defense side host according to the attack cost and the repair result of the defense side host to the preset risk items; the determination module is also used to determine the counterattack score of the defense side host according to the counterattack operation initiated by the defense side host to the network security countermeasure attack platform; a scoring module is used to determine the defense score of the defense side host according to the emergency response score, the reinforcement score and the counterattack score.

[0012] In one possible implementation, the device also includes: a risk implantation module, used to implant a first risk item into a defense-side host; and implant a second risk item into the network security anti-attack platform; wherein the first risk item or the second risk item may include any one or more of the following risk items: preset vulnerabilities; preset backdoors; preset virus programs.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor; and at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the method described above.

[0014] In a fourth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions enable the computer to execute the method as described above.

[0015] In the above technical scheme, first, the various preset risk items of the defense side host are used to initiate an attack operation to the defense side host. Then, the emergency response score of the defense side host is determined according to the emergency response operation of the defense side host to the attack operation; the reinforcement score of the defense side host is determined according to the attack cost and the repair result of the preset risk items by the defense side host; the counterattack score of the defense side host is determined according to the counterattack operation initiated by the defense side host to the network security anti-attack platform. Finally, the defense score of the defense side host is determined based on the emergency response score, the reinforcement score and the counterattack score. This achieves network security training that is closer to actual network attack scenarios and improves the defense capabilities of defense personnel against network attacks.

Brief Description of the Drawings

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A flowchart of an embodiment of the network security countermeasure method of the present application;

[0018] Figure 2 This is a schematic diagram of the structure of an embodiment of the network security countermeasure device of the present application;

[0019] Figure 3 This is a schematic diagram of the structure of another embodiment of the network security countermeasure device of the present application;

[0020] Figure 4 This is a schematic diagram of the structure of an embodiment of the electronic device of the present application. [Specific implementation method]

[0021] In order to better understand the technical solution of the present application, the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0022] It should be clear that the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0023] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0024] In the embodiment of the present application, a network security counter-attack platform may be provided. The network security counter-attack platform may be used to execute the network security counter-attack method provided in the embodiment of the present application, so as to provide network security training for defense personnel that is closer to the actual network attack scenario, and improve the defense personnel's defense capability against network attacks.

[0025] Figure 1 This is a flow chart of an embodiment of the network security countermeasure method of the present application. Figure 1 As shown, the above network security confrontation method may include:

[0026] Step 101, using various preset risk items of the defending side host, an attack operation is initiated to the defending side host.

[0027] In the embodiment of the present application, the network security anti-attack platform can simulate the network attacker in the actual scenario and launch an attack operation on the defending host. By simulating the real network attack scenario, the defender is trained to improve the defense capability of the defender.

[0028] Before launching an attack operation on the host on the defense side, the network security counter-attack platform can implant the first risk item into the host on the defense side according to the design of the topic. In order to use the first risk item to launch an attack operation on the host on the defense side. In addition, a jump server and a botnet are prepared for the network security counter-attack platform so that the network security counter-attack platform can simulate network attackers in actual scenarios. The second risk item is implanted into the network security counter-attack platform so that the host on the defense side can launch a counterattack operation against the network security counter-attack platform. Among them, the first risk item or the second risk item may include: preset vulnerabilities, preset backdoors, and preset virus programs.

[0029] Among them, the attack operations launched to the defense-side host may include: security scanning attack, system vulnerability attack, brute force attack, denial of service attack, website content tampering and remote control Trojan horse, etc.

[0030] Step 102: Determine the emergency response score of the defending side host according to the emergency response operation of the defending side host to the attack operation.

[0031] In the embodiment of the present application, the defending side host may experience a server interruption due to the attack operation on the defending side host in step 101. At this time, the defending side host can judge the current service status of multiple servers and restore the normal service functions of the servers.

[0032] On this basis, the host on the defense side can initiate emergency response operations for the attack operations of the network security counter-attack platform. Emergency response operations may include: finding and clearing backdoor files, obfuscating backdoor files, deleting newly created malicious users, killing Trojan horse processes, and patching vulnerabilities.

[0033] In the embodiment of the present application, in addition to simulating the attack operation of the attacker, the network security anti-attack platform can also detect the defense operation of the defense side and score the defense operation of the host on the defense side.

[0034] Specifically, the network security anti-attack platform can determine the emergency response score of the host on the defense side according to the emergency response operation of the host on the defense side.

[0035] In some embodiments, the network security anti-attack platform can perform multiple interception attack detections, backdoor cleaning detections, and data protection detections on the defense side host at preset time intervals. This determines the vulnerability repair capability, backdoor cleaning capability, and data protection capability of the defense side host at each time node. Based on the above emergency response operations of the defense side host at each time node, the emergency response score of the defense side host is determined.

[0036] For any one of the operations of determining the emergency response score of the host on the defense side, the specific implementation method is as follows.

[0037] In some embodiments, interception attack detection can be performed to determine the vulnerability repair score of the defense side host. The network security anti-attack platform can use the preset vulnerability of the defense side host to launch a vulnerability attack on the defense side host and detect the ability of the defense side host to intercept the attack. If the defense side host successfully defends, it can be proved that the preset vulnerability has been repaired. Otherwise, it is considered that the preset vulnerability has not been repaired. According to the defense result of the defense side host against the vulnerability attack, the vulnerability repair score of the defense side host can be determined.

[0038] In some other embodiments, a backdoor cleaning detection may be performed to determine the backdoor cleaning score of the defense side host. The network security anti-attack platform may verify the existence of the preset backdoor in the defense side host. Specifically, it may be determined whether the preset backdoor still exists by executing the detection script preset by the defense side host. Thus, the backdoor cleaning score of the defense side host is determined. Alternatively, the preset backdoor of the defense side host may be used to launch a backdoor attack on the defense side host. The backdoor cleaning score of the defense side host is determined based on the defense result of the defense side host against the backdoor attack.

[0039] In some other embodiments, data protection detection can be performed to determine the data protection score of the host on the defense side. The network security anti-attack platform can use the preset virus program of the host on the defense side to steal the target data in the host on the defense side. If the target data is successfully stolen, it can be considered that the host on the defense side has not killed the preset virus program and the data protection has failed; otherwise, it is considered that the host on the defense side has good data protection capabilities. According to the data protection result of the host on the defense side, the data protection score of the host on the defense side is determined.

[0040] Step 103: Determine the reinforcement score of the host on the defense side according to the attack cost and the repair result of the host on the defense side for the preset risk item.

[0041] In the embodiment of the present application, the network security anti-attack platform can determine the reinforcement score of the defense side host after the attack operation is completed.

[0042] Specifically, the restored preset risk items can be determined from the preset risk items of the defense-side host, wherein the restored preset risk items can be completely restored preset risk items or partially restored preset risk items.

[0043] Determine the attack operation corresponding to the above-mentioned fixed preset risk item. According to the increase in the attack cost of the fixed preset risk item to the attack operation, determine the limiting ability of the fixed preset risk item to the attack operation. Thus, determine the reinforcement score of the host on the defense side.

[0044] The above attack costs may include: attack time and attack tools. If the repaired preset risk items prolong the time it takes to break into the system; or reduce the expected attack effect; or add additional attack tools and increase the traffic consumption used for the attack, it can be considered that the attack cost has increased, thus limiting the attack operation.

[0045] For example, by using the target vulnerability in the host on the defense side, the network security anti-attack platform could have broken through the defense measures and achieved arbitrary code execution with system-level administrator privileges. However, due to the repair of the above target vulnerability by the host on the defense side, the network security anti-attack platform was restricted to arbitrary code execution with ordinary user privileges, and could not write important system files through code execution, but could only achieve file reading. At this point, it can be considered that the reinforcement operation of the host on the defense side reduced the expected attack effect and achieved the restriction of attack operations.

[0046] Step 104: Determine a counterattack score of the defending side host according to the counterattack operation initiated by the defending side host to the network security anti-attack platform.

[0047] In the embodiment of the present application, in the counterattack phase, first, the host on the defense side can search for attack information of the network security anti-attack platform based on information such as login logs, middleware logs, and data traffic. The attack information may include, for example, the attacker's IP, the attacker's host information, and the jump server used by the attacker.

[0048] After determining the attack information of the network security anti-attack platform, the host on the defense side can initiate a counterattack operation against the network security anti-attack platform. The host on the defense side can use the preset risk items in the network security anti-attack platform to obtain the target file in the network security anti-attack platform. And submit the obtained target file to the target address in the network security anti-attack platform. When the network security anti-attack platform receives the target file submitted by the host on the defense side, it can be considered that the host on the defense side has successfully counterattacked.

[0049] During the above counterattack process of the host on the defense side, the network security anti-attack platform can determine the counterattack score of the host on the defense side. Specifically, first, the tracing score of the host on the defense side can be determined according to the time it takes for the host on the defense side to search for attack information on the network security anti-attack platform. Then, the file acquisition score of the host on the defense side can be determined according to the time it takes for the host on the defense side to obtain the target file from the network security anti-attack platform. Finally, the tracing score and the file acquisition score can be added to determine the counterattack score of the host on the defense side.

[0050] Step 105: Determine the defense score of the host on the defense side according to the emergency response score, the reinforcement score, and the counterattack score.

[0051] In some embodiments, the emergency response score, reinforcement score, and counterattack score obtained in the aforementioned steps may be added together, and the obtained sum may be determined as the defense score of the defense-side host.

[0052] In other embodiments, the weighted values ​​of the emergency response score, the reinforcement score, and the counterattack score may be determined according to the preset weights. The preset weights may be set according to the actual situation. Then, the weighted values ​​of the emergency response score, the reinforcement score, and the counterattack score may be added together to determine the defense score of the defense side host.

[0053] In the embodiment of the present application, the network security confrontation method of the present application is divided into three stages: the emergency response stage, the reinforcement stage, and the counterattack stage. First, the various preset risk items of the defense side host are used to initiate an attack operation on the defense side host. Then, the emergency response score, reinforcement score, and counterattack score of the defense side host are determined respectively. Finally, the defense score of the defense side host is determined based on the emergency response score, reinforcement score, and counterattack score. Thereby achieving network security training that is closer to actual network attack scenarios and improving the defense personnel's defense capabilities against network attacks.

[0054] In another embodiment of the present application, different from the above embodiment, the network security confrontation method of the present application can be divided into four stages: emergency response stage, reinforcement stage, tracing stage and counterattack stage. Determine the emergency response score, reinforcement score, tracing score and counterattack score of the host on the defense side respectively. Determine the defense score of the host on the defense side according to the emergency response score, reinforcement score, tracing score and counterattack score of the host on the defense side.

[0055] First, the emergency response score of the host on the defense side can be determined according to the emergency response operation of the host on the defense side to the attack operation. The specific implementation method can refer to step 102 of the above embodiment, which will not be repeated here.

[0056] Then, the reinforcement score of the host on the defense side can be determined according to the attack cost and the repair result of the host on the defense side for the preset risk item. The specific execution method can refer to step 103 of the above embodiment, which will not be repeated here.

[0057] Secondly, the tracing score of the host on the defense side can be determined based on the time it takes for the host on the defense side to search for attack information on the network security anti-attack platform.

[0058] Finally, the file acquisition score of the defense-side host can be determined based on the time it takes for the defense-side host to obtain the target file from the network security anti-attack platform.

[0059] In some embodiments, the emergency response score, reinforcement score, tracing score, and counterattack score obtained in the aforementioned steps may be added together, and the obtained sum may be determined as the defense score of the defense-side host.

[0060] In other embodiments, the weighted values ​​of the emergency response score, reinforcement score, tracing score, and counterattack score can be determined according to the preset weights. The size of the preset weights can be set according to the actual needs. Then, the weighted values ​​of the emergency response score, reinforcement score, tracing score, and counterattack score can be added together to determine the defense score of the defense side host.

[0061] In the embodiment of the present application, the network security confrontation method of the present application is divided into four stages: emergency response stage, reinforcement stage, tracing stage and counterattack stage. First, use the various preset risk items of the defense side host to launch an attack operation on the defense side host. Then, determine the emergency response score, reinforcement score, tracing score and counterattack score of the defense side host respectively. Finally, determine the defense score of the defense side host based on the emergency response score, reinforcement score, tracing score and counterattack score. Thereby achieving network security training that is closer to actual network attack scenarios and improving the defense personnel's ability to defend against network attacks.

[0062] Figure 2 This is a schematic diagram of the structure of an embodiment of the network security confrontation device of the present application. The network security confrontation device in this embodiment can be used as a network security confrontation device to implement the network security confrontation method provided in the embodiment of the present application. Figure 2 As shown, the network security confrontation device may include: an attack module 21 , a determination module 22 and a scoring module 23 .

[0063] The attack module 21 is used to initiate an attack operation on the defending side host by using various preset risk items of the defending side host.

[0064] The determination module 22 is used to determine the emergency response score of the defense side host according to the emergency response operation of the defense side host to the attack operation. And it is used to determine the reinforcement score of the defense side host according to the attack cost and the repair result of the defense side host to the preset risk item. It is also used to determine the counterattack score of the defense side host according to the counterattack operation initiated by the defense side host to the network security anti-attack platform.

[0065] The scoring module 23 is used to determine the defense score of the defense-side host according to the emergency response score, the reinforcement score and the counterattack score.

[0066] In the specific implementation process, when the determination module 22 is used to determine the emergency response score of the defense side host, it is specifically used to use the preset vulnerability of the defense side host to launch a vulnerability attack on the defense side host, and determine the vulnerability repair score of the defense side host according to the defense result of the defense side host against the vulnerability attack. Use the preset backdoor of the defense side host to launch a backdoor attack on the defense side host, and determine the backdoor clearing score of the defense side host according to the defense result of the defense side host against the backdoor attack. Use the preset virus program of the defense side host to launch a data theft attack on the defense side host, and determine the data protection score of the defense side host according to the defense result of the defense side host against the data theft attack.

[0067] When determining the reinforcement score of the defense side host, the determination module 22 is specifically used to determine the repaired preset risk items from the preset risk items of the defense side host. The reinforcement score of the defense side host is determined according to the attack cost of the attack operation corresponding to the repaired preset risk item. The attack cost may include: attack time and attack tool.

[0068] When determining the counterattack score of the defense side host, the determination module 22 is specifically used to determine the source tracing score of the defense side host according to the time it takes for the defense side host to search for attack information of the network security anti-attack platform. The file acquisition score of the defense side host is determined according to the time it takes for the defense side host to obtain the target file from the network security anti-attack platform. The counterattack score of the defense side host is determined according to the source tracing score and the file acquisition score.

[0069] Furthermore, when the scoring module 23 is used to determine the defense score of the defense side host, it is specifically used to determine the weighted values ​​of the emergency response score, the reinforcement score, and the counterattack score according to the preset weights. The weighted values ​​of the emergency response score, the reinforcement score, and the counterattack score are added together to determine the defense score of the defense side host.

[0070] In the above network security confrontation device, first, the attack module 21 uses each preset risk item of the defense side host to initiate an attack operation to the defense side host. Then, the determination module 22 determines the emergency response score of the defense side host according to the emergency response operation of the defense side host to the attack operation; determines the reinforcement score of the defense side host according to the attack cost and the repair result of the defense side host to the preset risk item; and determines the counterattack score of the defense side host according to the counterattack operation initiated by the defense side host to the network security confrontation attack platform. Finally, the scoring module 23 determines the defense score of the defense side host according to the emergency response score, the reinforcement score and the counterattack score. Thereby achieving network security training that is closer to the actual network attack scenario and improving the defense personnel's defense capabilities against network attacks.

[0071] Figure 3 This is a schematic diagram of the structure of another embodiment of the network security confrontation device of the present application. Figure 2 Compared with the network security countermeasure device shown in the figure, the difference is that Figure 3 The network security countermeasure device shown may also include: a risk implantation module 31.

[0072] The risk implantation module 31 is used to implant the first risk item into the defense-side host; and implant the second risk item into the network security anti-attack platform.

[0073] The first risk item or the second risk item may include any one or more of the following risk items: a preset vulnerability, a preset backdoor, and a preset virus program.

[0074] Figure 4 This is a schematic diagram of the structure of an embodiment of the electronic device of the present application. Figure 4 As shown, the electronic device may include at least one processor; and at least one memory communicatively connected to the processor, wherein the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the network security countermeasure method provided in the embodiment of the present application.

[0075] The electronic device may be a network security countermeasure device, and this embodiment does not limit the specific form of the electronic device.

[0076] Figure 4 A block diagram of an exemplary electronic device suitable for implementing the embodiments of the present application is shown. Figure 4 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0077] like Figure 4As shown, the electronic device is in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: one or more processors 410, a memory 430, and a communication bus 440 connecting different system components (including the memory 430 and the processor 410).

[0078] The communication bus 440 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnection (PCI) bus.

[0079] Electronic devices typically include a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device, including volatile and non-volatile media, removable and non-removable media.

[0080] The memory 430 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory. The electronic device may further include other removable / non-removable, volatile / non-volatile computer system storage media. Figure 4 Not shown, a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a compact disc read only memory (CD-ROM), a digital versatile disc read only memory (DVD-ROM), or other optical media) may be provided. In these cases, each drive may be connected to the communication bus 440 via one or more data medium interfaces. The memory 430 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present application.

[0081] A program / utility having a set (at least one) of program modules may be stored in memory 430, such program modules including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules typically perform the functions and / or methods of the embodiments described herein.

[0082] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, displays, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via the communication interface 420. Furthermore, the electronic device may also communicate with the network adapter ( Figure 4 The network adapter may communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via the communication bus 440. It should be understood that although Figure 4 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, disk arrays (Redundant Arrays of Independent Drives; hereinafter referred to as: RAID) systems, tape drives, and data backup storage systems.

[0083] The processor 410 executes various functional applications and data processing by running the programs stored in the memory 430, such as implementing the network security countermeasure method provided in the embodiment of the present application.

[0084] An embodiment of the present application also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions enable the computer to execute the network security countermeasure method provided by the embodiment of the present application.

[0085] The above-mentioned non-temporary computer-readable storage medium can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (Read Only Memory; hereinafter referred to as: ROM), an erasable programmable read-only memory (ErasableProgrammable Read Only Memory; hereinafter referred to as: EPROM) or flash memory, optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0086] Computer-readable signal media may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0087] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0088] The computer program code for performing the operation of the present application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (Local Area Network; hereinafter referred to as: LAN) or a wide area network (Wide Area Network; hereinafter referred to as: WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0089] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0090] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0091] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0092] It should be noted that the terminals involved in the embodiments of the present application may include but are not limited to personal computers (Personal Computer; hereinafter referred to as: PC), personal digital assistants (Personal Digital Assistant; hereinafter referred to as: PDA), wireless handheld devices, tablet computers (Tablet Computer), mobile phones, MP3 players, MP4 players, etc.

[0093] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0094] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0095] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A network security countermeasure method, characterized in that: The method is applied to a network security anti-attack platform; the method comprises: Initiate an attack operation on the defending side host by using various preset risk items of the defending side host; Determining an emergency response score of the defending side host according to an emergency response operation of the defending side host to the attack operation; Determine the reinforcement score of the defense-side host according to the attack cost and the repair result of the defense-side host on the preset risk item; Determining a counterattack score of the defending side host according to a counterattack operation initiated by the defending side host to the network security anti-attack platform; Determining a defense score of the defense-side host according to the emergency response score, the reinforcement score, and the counterattack score; Before launching an attack operation on the defense-side host using each preset risk item of the defense-side host, the method further includes: implanting the first risk item into the defense-side host; and implanting the second risk item into the network security anti-attack platform; The first risk item or the second risk item may include any one or more of the following risk items: pre-set vulnerability; pre-set backdoor; pre-set virus program; The step of determining the emergency response score of the defense-side host according to the emergency response operation of the defense-side host to the attack operation includes: Initiate a vulnerability attack on the defending side host by using a preset vulnerability of the defending side host, and determine a vulnerability repair score of the defending side host according to the defense result of the defending side host against the vulnerability attack; Using the preset backdoor of the defending side host to launch a backdoor attack on the defending side host, and determining the backdoor clearing score of the defending side host according to the defense result of the defending side host against the backdoor attack; Using a preset virus program of a defense side host to launch a data stealing attack on the defense side host, and determining a data protection score of the defense side host according to a defense result of the defense side host against the data stealing attack; The emergency response score includes a vulnerability repair score, a backdoor removal score, and a data protection score; The step of determining the reinforcement score of the defense-side host according to the attack cost and the repair result of the defense-side host on the preset risk item includes: Determining a restored preset risk item from the preset risk items of the defense-side host; Determining a reinforcement score of the host on the defense side according to an attack cost of an attack operation corresponding to the repaired preset risk item; The attack cost includes: attack time; attack tool; The step of determining the counterattack score of the defense-side host according to the counterattack operation initiated by the defense-side host to the network security anti-attack platform includes: Determine the tracing score of the defense-side host according to the time length for the defense-side host to search for attack information of the network security anti-attack platform; Determining a file acquisition score of the defense-side host according to the time it takes for the defense-side host to acquire the target file from the network security anti-attack platform; Determining a counterattack score of the defense-side host according to the tracing score and the file acquisition score; The determining the defense score of the defense-side host according to the emergency response score, the reinforcement score, and the counterattack score includes: According to preset weights, respectively determine weighted values ​​of the emergency response score, the reinforcement score, and the counterattack score; The weighted values ​​of the emergency response score, the reinforcement score, and the counterattack score are added together to determine the defense score of the defense-side host.

2. A network security countermeasure device, characterized in that: include: An attack module, used to initiate an attack operation on the defending side host by using various preset risk items of the defending side host; A determination module, configured to determine an emergency response score of the defense-side host according to an emergency response operation of the defense-side host to the attack operation; The determination module is further used to determine the reinforcement score of the defense side host according to the attack cost and the repair result of the defense side host for the preset risk item; The determination module is further configured to determine a counterattack score of the defense-side host according to a counterattack operation initiated by the defense-side host to the network security anti-attack platform; A scoring module, used to determine the defense score of the defense-side host according to the emergency response score, the reinforcement score and the counterattack score; Before launching an attack operation on the defending side host using each preset risk item of the defending side host, the device further includes: A risk implantation module, used to implant the first risk item into the defense-side host; and implant the second risk item into the network security anti-attack platform; The first risk item or the second risk item may include any one or more of the following risk items: pre-set vulnerability; pre-set backdoor; pre-set virus program; The step of determining the emergency response score of the defense-side host according to the emergency response operation of the defense-side host to the attack operation includes: Initiate a vulnerability attack on the defending side host by using a preset vulnerability of the defending side host, and determine a vulnerability repair score of the defending side host according to the defense result of the defending side host against the vulnerability attack; Using the preset backdoor of the defending side host to launch a backdoor attack on the defending side host, and determining the backdoor clearing score of the defending side host according to the defense result of the defending side host against the backdoor attack; Using a preset virus program of a defense side host to launch a data stealing attack on the defense side host, and determining a data protection score of the defense side host according to a defense result of the defense side host against the data stealing attack; The emergency response score includes a vulnerability repair score, a backdoor removal score, and a data protection score; The step of determining the reinforcement score of the defense-side host according to the attack cost and the repair result of the defense-side host on the preset risk item includes: Determining a restored preset risk item from the preset risk items of the defense-side host; Determining a reinforcement score of the host on the defense side according to an attack cost of an attack operation corresponding to the repaired preset risk item; The attack cost includes: attack time; attack tool; The step of determining the counterattack score of the defense-side host according to the counterattack operation initiated by the defense-side host to the network security anti-attack platform includes: Determine the tracing score of the defense-side host according to the time length for the defense-side host to search for attack information of the network security anti-attack platform; Determining a file acquisition score of the defense-side host according to the time it takes for the defense-side host to acquire the target file from the network security anti-attack platform; Determining a counterattack score of the defense-side host according to the tracing score and the file acquisition score; The determining the defense score of the defense-side host according to the emergency response score, the reinforcement score, and the counterattack score includes: According to preset weights, respectively determine weighted values ​​of the emergency response score, the reinforcement score, and the counterattack score; The weighted values ​​of the emergency response score, the reinforcement score, and the counterattack score are added together to determine the defense score of the defense-side host.

3. An electronic device, characterized in that: include: at least one processor; as well as at least one memory in communication with the processor, wherein: The memory stores program instructions executable by the processor, and the processor can execute any method according to claim 1 by calling the program instructions.

4. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions enable the computer to execute any one of the methods of claim 1.

Images