An openstack-based target automatic deployment method
By adopting an automated target deployment method based on OpenStack, and utilizing the target machine classification model and OpenStack API, the automated deployment of targets was achieved, solving the problems of complex target scenario design and repeated use, and improving deployment efficiency and training effect.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SICHUAN UNIV
- Filing Date
- 2022-07-18
- Publication Date
- 2026-05-08
AI Technical Summary
The deployment of virtual environments and design of target scenarios in existing network ranges are complex and consume a lot of human and material resources, and the reuse of targets leads to low training efficiency.
An automated target deployment method based on OpenStack is adopted. By constructing a target classification model, using a decision tree model to predict target machines, generating target configuration files, and calling the OpenStack API to complete target deployment, the automated deployment of targets is achieved.
It improves the efficiency of target deployment, reduces manual interaction, and allows users to complete target deployment by providing only a small amount of key information, thus reducing human and material costs.
Smart Images
Figure CN115220736B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and more specifically to an automated target deployment method based on OpenStack. Background Technology
[0002] The complexity of cybersecurity threats is constantly increasing, and they are becoming more large-scale and organized. Generally, attackers possess powerful weapons and ample resources. To quickly detect signs of cyberattacks and respond appropriately, security personnel need to conduct training and attack / defense drills in virtual environments that provide a high degree of real-world simulation. This has led to the development of cyber ranges. Cyber ranges, which rely on virtualization technology to highly replicate real-world network environments, are a key research area in cybersecurity and a crucial infrastructure for cyberspace security that many countries are exploring and developing. Well-known examples include NCR, MCR, EDURANge, and KYPO. Typically, a cyber range is built upon many critical infrastructure elements, such as a robust network environment, ample storage resources, and excellent computing power. Currently, cyber ranges have become an important support tool for cybersecurity tasks such as technology verification, cyber weapon testing, cyber attack / defense drills, cyber risk assessment, and cybersecurity skills training. In practical applications, the targets used in attack / defense drills operate in a virtual environment.
[0003] Currently, virtual environments in cyber ranges are primarily supported by three methods: 1. Virtual environment management programs running at the operating system level. This method relies on virtual machine creation and management programs running on existing operating systems, such as VirtualBox and VMware. 2. Virtual environment management programs running at the hardware level. This method uses virtual environment management programs that can directly control physical hardware, such as VMware ESXi, Citrix XenServer, and Microsoft Hyper-V. 3. Cloud computing technology. Cloud computing is one of the most powerful technologies currently available for providing and managing virtualized resources. Popular cloud platforms include OpenStack and Alibaba Cloud.
[0004] Establishing network computing resources is only the first step in building a training range. The design, deployment, and verification of virtual targets are often costly and error-prone stages. In principle, a network target should allow for the definition of a single scenario for continuous use over a period of time. Ideally, these scenarios should not be reused, as this can discourage learners and significantly reduce the effectiveness of training activities. For example, the annual NATO Lockdown Shield program relies on only one virtual scenario, which is updated annually but used for only two days. Beyond scenario design, security personnel also need to plan and implement network and routing deployments. Literature indicates that by 2022, 15% of large enterprises will rely on network ranges to improve the capabilities of their internal security teams, compared to less than 1% currently. This is primarily because designing and deploying a suitable training target requires significant human, material, and material resources, and it's crucial to avoid highly repetitive target usage. Summary of the Invention
[0005] This invention addresses the problems existing in the prior art by providing an automated target deployment method based on OpenStack.
[0006] The technical solution adopted in this invention is: an automated target deployment method based on OpenStack, comprising the following steps:
[0007] Step 1: Build a target machine classification model and train the model;
[0008] Step 2: Input the required target machine feature values into the classification model trained in Step 1 to obtain the target target machine, and obtain the required target machine based on the target target machine;
[0009] Step 3: Create a target configuration file based on the target machine key files obtained in Step 2;
[0010] Step 4: Parse the target configuration file and call the OPENSTACK API to complete the target deployment.
[0011] Furthermore, the target machine classification model in step 1 adopts a decision tree model; the process of constructing the dataset required for training the model is as follows:
[0012] Obtain the target machine dataset and reduce its dimensionality to 2D.
[0013] Perform clustering on the dataset to obtain N subclasses;
[0014] Balancing the dataset yields the dataset needed to train the decision tree model.
[0015] Furthermore, the target configuration file in step 3 includes a network module, a routing module, and a target machine module;
[0016] The network module generates network configuration information based on key information;
[0017] The routing module generates routing information based on key information;
[0018] The target module obtains the specified information from the target based on key information.
[0019] Furthermore, the network configuration information includes network name, subnet, IP start field, and gateway; the routing information includes route name, network sequence number, including name and subnet of the network to be connected; the target machine specification information includes target machine name, network, IP address, template, and image.
[0020] A deployment system based on an automated target deployment method using OPENSTACK includes a resource module, an automated deployment module, and a target dataset preprocessing module.
[0021] The resource module is used to acquire the required target machine based on the target target machine;
[0022] The target machine dataset preprocessing module is used to obtain the dataset required for training the target machine classification model;
[0023] The automated deployment module is used to parse the network and target machine feature value fields in the target key information file, obtain the target target machine through the target machine classification model, create the target configuration file, and call the OPENSTACK API to complete the target deployment based on the target configuration file.
[0024] The beneficial effects of this invention are:
[0025] (1) This invention introduces machine learning to predict target machines, and proposes and implements an automated deployment scheme for targets based on OpenStack, eliminating the need for interaction with OpenStack through the WEB interface and improving the efficiency of deploying target machines.
[0026] (2) The present invention is based on key information for automated deployment of targets. Users only need to provide a small amount of key target information to obtain the required target machine. Attached Figure Description
[0027] Figure 1 This is a schematic diagram of the process of the present invention. Detailed Implementation
[0028] like Figure 1 As shown, an automated target deployment method based on OpenStack includes the following steps:
[0029] Step 1: Build a target machine classification model and train the model;
[0030] This project utilizes the large number of pre-designed target machines on Vulnhub to replace the manual design process. Vulnhub contains 764 pre-designed target machines, most of which provide information such as operating system, exploit method, exploit difficulty, machine size, and file format. Some target machines also provide detailed exploitation tutorials. A web crawler was designed to specifically scrape Vulnhub target machine information. After scraping all the target machine information, based on the target machine descriptions and exploitation tutorials, custom keywords were used to categorize the target machines into nine types: WEB, extraction, CTF, code execution, brute force, exploitation, database, other, and unknown.
[0031] After abstracting the above features, the original dataset also includes 14 features such as the difficulty of exploiting the target machine vulnerability, whether the target machine has DHCP enabled, the target machine's operating system, the target machine's size, and the target machine's storage type. Data preprocessing operations such as numerical transformation and null removal are then performed on the dataset.
[0032] After converting the collected target machine dataset into a dataset containing only specific numerical values, the TSNE dimensionality reduction method was used to reduce the dimensionality of the target machine dataset to 2D space. The dimensionality-reduced dataset exhibits obvious clusters, and clustering operations can be performed using general clustering methods. After clustering, the dataset is divided into N subclasses. The sample size of each subclass indicates that the dataset is imbalanced, with a significant difference in sample size. Existing algorithms such as SMOTE are then used to balance the dataset.
[0033] A decision tree model was chosen as the classification model for the target machine, and then the classification model was trained using a preprocessed dataset.
[0034] Step 2: Input the required target machine feature values into the classification model trained in Step 1 to obtain the target target machine, and obtain the required target machine based on the target target machine;
[0035] The target machine's key information is defined using YAML. The target machine description file describes the number of networks and the characteristics of the target machine. Table 1 shows an example target machine description file, which describes the number of networks and the characteristics of the target machine. Specifically, this file tells the script that three networks are needed, where the `link` field `[external,0,1]` indicates that networks `external`, `0`, and `1` are connected using routing. The `feature` field contains information about the target machine, such as `[web,linux,0.8,easy]` indicating that the target machine needs to be a web server, the operating system is Linux, the target size is 0.8GB, and the attack difficulty is easy. `network` indicates that the target machine belongs to the first network segment in the created network, and the `floatingIP` field being True indicates that a floating IP is bound to the target machine, which can be understood as the attack entry point. After specifying the key information, executing the `python vmchoose.py` script will automatically create the specific target configuration file.
[0036] Table 1. Key Information Documents for Target Drills
[0037]
[0038] After editing the target's key information description file, run the target prediction script. The script reads the `feature` field to obtain the target's features, then uses a pre-trained target classification model to predict the target's category. After predicting the target's category, the script searches for its 10 nearest neighbors (10 virtual machines most similar to the target) from among those of the same category, randomly selects one, downloads it, and performs decompression. Before downloading the target, the script checks if the download link is active; it only starts downloading if the link is active. Furthermore, target files on Vulnhub are mostly compressed files or other file formats like OVA, while OpenStack best supports image files in qcow2 / vmdk format. Therefore, decompression is necessary to obtain an image file compatible with the OpenStack platform. After the virtual machine download is complete, the script automatically generates a usable target configuration file.
[0039] Step 3: Create a target configuration file based on the target machine key files obtained in Step 2;
[0040] The script will create the corresponding number of networks based on the `networks:number` field; create corresponding routes based on `networks:link`; deploy the target machines in the corresponding network segments based on `vms:network`; and automatically bind floating IPs to the target machines based on `vms:floatingIP`. All other necessary information is automatically generated. To avoid conflicts with existing OpenStack information, the script will automatically query existing OpenStack information before automatically creating the data and then avoid those conflicts.
[0041] The target configuration file includes a network module, a routing module, and a target machine module. For the network module, only the required number of networks is specified in the key information. The script automatically queries existing networks on the OpenStack platform and then randomly generates usable network configuration information from unused network segments, including network name, subnet, and IP address range. The routing module is created based on the `link` field under the `networks` module in the key information. The `link` field already specifies the network numbers to be connected to. Only the `subnet` field of the automatically created network needs to be obtained to create the routing information. The generated routing information includes the name and the subnet of the network to be connected; these should be filled in sequentially. For the target machine module, the image files of these target machines need to be uploaded to the OpenStack platform. After downloading the image files locally, simply fill in the fields of this module according to the image file name, such as the target machine name and image file path. The network where the target machine resides is completed according to the information specified in the key information. The IP addresses of the target machines are generated using a randomized strategy.
[0042] Step 4: Parse the target configuration file and call the OPENSTACK API to complete the target deployment.
[0043] To complete a function call, you simply need to pass the corresponding parameters to the specific API function. Users can customize target configuration files according to their own needs. In many use cases, users need to customize target configuration files, such as customizing network topology, customizing target machines, specifying network segments, and specifying target machine IP addresses. Custom-defined target configuration files allow for the execution of highly user-defined target scenarios.
[0044] A deployment system based on an automated target deployment method using OPENSTACK includes a resource module, an automated deployment module, and a target dataset preprocessing module.
[0045] The resource module is used to obtain the required target machines based on the target machine. This module provides a large number of available target machines, along with information such as the size, file type, attack difficulty, exploit route, and download link of the target machine. Once the target machine is predicted, its file can be downloaded from Vulnhub and decompressed to obtain an OpenStack-compatible image file format.
[0046] The target machine dataset preprocessing module is used to obtain the dataset needed to train the target machine classification model; it provides an important data source for training the target machine classification model. First, web crawling technology is used to obtain information on all target machines on Vulnhub. Then, custom keywords are used for feature extraction, and operations such as removing null values and numerical transformations are performed to obtain the original target machine dataset. Finally, the target machine dataset is automatically classified and balanced.
[0047] The automated deployment module is used to parse the network and target machine feature value fields in the target key information file, obtain the target target machine through the target machine classification model, create the target configuration file, and call the OPENSTACK API to complete the target deployment based on the target configuration file.
[0048] This invention implements an automated target deployment method based on key information. This method uses the aforementioned target machine dataset to train a target machine classification model. Users only need to provide some key information about the target to complete the automated deployment. Specifically, the key information mainly consists of the target machine's feature values. After obtaining these feature values, the classifier predicts the target machine's category, then selects the 10 closest target machines from that category, and randomly selects one as a candidate target machine for deployment to the OpenStack platform. After finding all candidate target machines, the script automatically generates a target configuration file, then runs the automated deployment script to parse the configuration file, and finally calls the OpenStack API to complete the automated target deployment.
Claims
1. A target automation deployment method based on OpenStack, characterized in that, Includes the following steps: Step 1: Construct a target machine classification model and train it. Define target machines using custom keywords, categorizing them into nine features: WEB, extraction, CTF, code execution, brute-force attack, vulnerability exploitation, database, other, and unknown. After abstracting these features, the original dataset still contains 14 features: target machine vulnerability exploitation difficulty, whether DHCP is enabled, target machine operating system, target machine size, and target machine storage type. Convert the collected target machine dataset into a dataset containing only specific numerical values, then use the TSNE dimensionality reduction method to reduce the dimensionality of the target machine dataset to within 2D. Perform clustering on the dataset to obtain N subclasses. Balancing the dataset yields the dataset needed to train the decision tree model. Step 2: Input the required target machine feature values into the classification model trained in Step 1 to obtain the target target machine, and obtain the required target machine based on the target target machine; use YAML language to define the key information of the target machine. The key information of the target machine describes the number of networks and the features of the target machine. Step 3: Create a target configuration file based on the target machine key files obtained in Step 2. The target configuration file includes a network module, a routing module, and a target machine module. The script will create the corresponding number of networks according to the networks: number field; create the corresponding routes according to networks: link; deploy the target machine in the corresponding network segment according to vms: networks; and automatically bind a floating IP to the target machine according to vms: floatingIP. Step 4: Parse the target configuration file and call the OPENSTACK API to complete the target deployment.
2. The target automated deployment method based on OpenStack according to claim 1, characterized in that, The target configuration file in step 3 includes a network module, a routing module, and a target machine module; The network module generates network configuration information based on key information; The routing module generates routing information based on key information; The target module obtains the specified information from the target based on key information.
3. The target automated deployment method based on OpenStack according to claim 2, characterized in that, The network configuration information includes network name, subnet, IP start field, and gateway; the routing information includes route name, network sequence number, including name and subnet of the network to be connected; the target machine specification information includes target machine name, network, IP address, template, and image.
4. The deployment system of the target automated deployment method based on OPENSTACK as described in any one of claims 1 to 3, characterized in that, It includes a resource module, an automated deployment module, and a target machine dataset preprocessing module; The resource module is used to acquire the required target machine based on the target target machine; The target machine dataset preprocessing module is used to obtain the dataset required for training the target machine classification model; The automated deployment module is used to parse the network and target feature value fields in the target machine key files, obtain the target target through the target machine classification model, create the target configuration file, and call the OPENSTACK API to complete the target deployment based on the target configuration file.