A network security training method based on simulated network

Abstract

The present invention belongs to the field of network information security technology, specifically a network security training method based on a simulated network. The present invention specifically includes: constructing a simulated network topology environment, including: original service network topology, simulated network topology, network isolation module; constructing a network security training system for information security attack and defense training and security data collection; including attack tool library module, defense tool library module, attack strategy library module, defense strategy library module, log library module, data collection module: finally, network security training based on a simulated network is performed. The present invention simulates and reproduces the real network topology through a simulated network training environment, uses various attack methods to perform network attack tests, and discovers security vulnerabilities in the target service network structure through interactive feedback between various security resource modules, thereby providing and implementing corresponding defense plans, and obtaining corresponding network security data for storage and export analysis.

Description

Technical Field

[0001] The present invention belongs to the technical field of network information security, and in particular relates to a network security training method based on a simulated network. Background Art

[0002] Network security has always been a concern of the computer industry. In recent years, with the innovation and progress of technology, a new generation of network architectures such as digital twins have been proposed. Various service structures are more complex and data demand is greater. Traditional passive security defense systems are difficult to ensure the safe and reliable operation of new intelligent system services. An active and effective security training program is needed to establish protection measures corresponding to the actual environment.

[0003] In security training, it is necessary to conduct information security attack and defense training on the target computer (referred to as the target machine). The traditional way is to record the various hardware and software configurations of the target machine, and build a target machine with the same configuration on a new computer for attack and defense training. However, this method requires additional equipment overhead, and the training environment is not in the actual service environment. To truly and synchronously restore the same network service topology structure quickly and synchronously, and to conduct attack tests on the target machine in the service and obtain security data without affecting normal service, a new simulated network architecture is needed to achieve this. Summary of the invention

[0004] The purpose of the present invention is to provide a network security training method based on a simulated network, which can effectively discover security vulnerabilities in network services, collect and provide security data records.

[0005] The network security training method based on simulated network provided by the present invention simulates and reproduces the real network topology through a simulated network training environment, uses various attack methods to perform network attack tests, and discovers security vulnerabilities in the target service network structure through interactive feedback between various security resource modules, provides and implements corresponding defense plans, and obtains corresponding network security data for storage and export analysis.

[0006] Here, the simulated network training environment refers to a network structure in which the network service has the same network topology and the same service application as the real service network, and can simultaneously and synchronously provide the same feedback to the external service and generate the same data, but the network and data access are isolated from each other and do not interfere with each other. In a simulated network training environment, attacks and interference on services can be equivalent to the same attacks and interference on network services in a real network environment, but will not affect the normal operation of network services in a real network environment. A system that deploys information attack and defense and security data collection based on this can perform security testing on the service network and obtain security data in a real working environment without interfering with the provision of normal services, while achieving the effect of comparison with normal services.

[0007] The network security training method based on simulated network provided by the present invention comprises the following specific steps:

[0008] 1. Constructing a simulated network topology environment;

[0009] The simulated network topology environment includes: original service network topology, simulated network topology, and network isolation module; among which:

[0010] The original service network topology is the original network part that provides normal services;

[0011] The simulated network topology is a simulation of the original service network, which has the same network topology structure and service applications as the original service network module, and can simultaneously and synchronously provide the same feedback to external services and generate the same data;

[0012] The network isolation module is deployed on the host of the service network topology structure, and is used to isolate the original service network topology and the simulated network topology, ensure the isolation of the two in network and data access, and synchronously transmit external data access to the two network topologies.

[0013] (II) Constructing a network security training system for information security attack and defense training and security data collection; specifically, conducting network security training on target network services through simulated network topology and collecting corresponding security data; specifically including the following modules: attack tool library module, defense tool library module, attack strategy library module, defense strategy library module, log library module, data collection module: Among them:

[0014] The attack tool library module provides attack means for the network attack end, and is mainly composed of preset network penetration tools, network attack tools, program execution scripts, etc. After the above tools are integrated to form a unified interface, they can be directly provided to the attack strategy library for modular call.

[0015] It should be noted that modular calls refer to a certain degree of detailed classification of the functions of the attack tool library, which can be called individually or in free combination. Among them, network penetration tools include active scanning tools, passive scanning tools, and vulnerability scanning tools; network attack tools include denial of service attack tools, Trojan horse production tools, malicious code injection tools, service authentication attack tools, and network deception tools. Various tools are composed of third-party software or execution scripts, providing interfaces for direct calls by programs. If necessary, interface writing methods are also provided, and new third-party tool software can be imported as needed.

[0016] The defense tool library module provides defense and information detection means for the target machine, and is mainly composed of firewalls, pre-set network threat detection tools, system monitoring tools, patch tools, program execution scripts, etc. The above tools are integrated to form a unified interface, which can be directly used by the defense strategy library for modular calls.

[0017] It should be noted that the real-time collection and feedback of security data on the target machine is mainly carried out by network threat detection tools and system monitoring tools; while specific defense measures are mainly implemented through firewalls, patch tools, and program scripted configuration modification operations.

[0018] The attack strategy library module provides decision-making and adjustment of attack methods, and can interface call and customize the combination of attack methods in the attack tool library to attack the target machine; it can also generate and store customized attack strategies and import existing common attack strategies.

[0019] The defense strategy library module provides decision-making and adjustment of defense methods. It can interface call and customize the combination of defense methods in the defense tool library to defend against attacks from the attacking end; by obtaining real-time security data, the defense measures of the target machine are adjusted according to the strategy.

[0020] It should be noted that there is a data path between the attack strategy library module and the defense strategy library module. Specifically, the security data generated by the defense strategy library module can be fed back to the attack strategy module through the data path. The security data includes data before and after the implementation of the defense countermeasures. The attack strategy library module can analyze the feedback data and change the attack method in combination with the attack strategy.

[0021] The log library module is used to store the behavior records of network attacks and defenses and result feedback.

[0022] The data collection module provides the storage and export of data records during the attack and defense process. The data here includes attack methods, defense methods, target machine security data and defense results. After collection and integration, they are stored in a one-to-one corresponding data vector, and an interface is provided for batch export for data analysis and training.

[0023] (III) Conduct cybersecurity training based on simulated networks. The specific process is as follows (see Figure 2 ):

[0024] (1) The attack strategy library module calls the attack tool library module to attack the target network service. The defense strategy library module obtains data reflecting network and system characteristics, such as port traffic and process status, through the network threat detection tools and system monitoring tools of the defense tool library, and passes it to the data collection module;

[0025] (2) The data collection module feeds back the attack results to the defense strategy library module. The defense strategy library module adjusts the defense strategy based on the result data and calls the defense tool library module to defend against the attack on the target network service.

[0026] (3) After defending against the attack, new feature data is generated and passed to the data collection module;

[0027] (4) The data collection module then feeds back the data results after defense to the attack strategy library module. The attack strategy library module adjusts the attack strategy based on the result data and prepares to call the attack tool library to carry out the next network attack;

[0028] (5) The cycle continues in this way. During this process, the data generated by the attack strategy library module, the defense strategy library module, and the data collection module are all recorded in the log library module. The data collection module will record and save the generated data for export for analysis or further data training.

[0029] The network security training program method based on simulated network provided by the present invention can construct a simulated network environment with the same topology structure and the same service content without affecting normal network services, and conduct targeted network security training. In the proposed information attack and defense and security data collection system, the strategy adjustment of the attack and defense strategy module can effectively and comprehensively provide training programs, which is helpful to actively and effectively discover security vulnerabilities in network services and collect and provide security data records. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a framework diagram of the network security training method based on simulated network of the present invention.

[0031] Figure 2 It is a specific flowchart of the network security training method based on the simulated network of the present invention. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the purpose, structure and operation mode of the present invention, the present invention is further described below in conjunction with examples and drawings.

[0033] like Figure 1 As shown in the figure, a method for implementing a simulated network training environment is mainly composed of several modules, including the original service network topology, the simulated network topology, the network isolation module, and the security training module. The solid arrows represent the actual network data access, and the dotted arrows represent the logical network data access. The security training module is composed of the constructed network security training system, combined with Figure 2As shown in the figure, with the simulated network topology as the target network service, the attack strategy library module uses the attack tool library to launch an attack via the gateway, and the attack is diverted through the network isolation layer so that the attack can only reach the simulated network topology; after the external request passes through the gateway, it can still be delivered to the original service network topology and the simulated network topology at the same time through the network isolation layer.

[0034] The following is an example of the specific process of network security training. Figure 2 As shown, the attack strategy library module first executes the penetration scanning strategy according to the attack strategy, calls the scanning tools in the attack tool library, such as Nmap, etc., scans the target network service, obtains its service information, and finds out that the ssh service is open on port 22 and the http service is open on port 80. The scanning information is then recorded in the log and stored in the log library module.

[0035] Subsequently, according to the scanning results and the attack strategy, the attack strategy library module calls the attack tool library module to attack the target network service, such as hping3, etc., and selects to perform an authentication attack on the ssh service to try to crack the ssh password; selects to perform a denial of service attack on the http service, and sends a large number of tcp SYN packets to consume its network resources and interfere with normal services. After the attack method is selected, the target network service is attacked in sequence. At the same time, the network threat detection tools and system monitoring tools preset in the defense tool library module monitor the attacked target network service and obtain the characteristic data after the attack. For example, a large number of login requests are detected after ssh is attacked by service authentication, and a large number of tcp non-homologous data packets are detected after http is attacked by denial of service. The monitoring data is stored in the data collection module, and the data collection module feeds this back to the attack strategy library module as the attack result, and stores it in the log library module; the attack strategy library module receives the data feedback, can understand whether the attack has achieved the effect, and logs the selected attack method and stores it in the log library module.

[0036] Subsequently, the data collection module also feeds back the characteristic data to the defense strategy library module. After receiving the data feedback, the defense strategy library module can understand the attack situation of the target network service and select the defense means of the defense tool library module for network defense according to the defense strategy. For example, after ssh receives a large number of homologous requests, the source IP is blacklisted to block the network requests in the blacklist; after receiving a TCP SYN attack, the semi-connected queue is expanded or the SYN cookie function is enabled to prevent a large number of semi-connected TCP requests from consuming resources. After the defense is carried out, the defense method is recorded in the log and stored in the log library module.

[0037] Subsequently, the attack strategy library module calls the attack tool library module again, uses the same means to attack the target network service after defense, and obtains the characteristic data after defense through monitoring again and stores it in the data collection module. For example, after the attack source IP is blacklisted, a large number of blacklist IP alarms and data packet drops are detected; after the SYN cookie function is turned on, a large number of TCP SYN packets are detected, and the TCP service can establish a connection normally. The data collection module then stores the characteristic data after defense as the result in the log library module, and also feeds back to the attack strategy library module and the defense strategy library module. The attack strategy library module receives data feedback and can understand whether the attack is completely defended, and selects a new attack method according to the attack strategy, and calls the attack tool library for the next network attack. The defense strategy library module receives data feedback and can understand whether the defense is effective. Combined with the characteristic data after the next attack, the new defense method is adjusted again according to the defense strategy. In this way, a round of network security training is completed.

[0038] It should be noted that the strategies used in the attack strategy library and the defense strategy library can be written based on expert experience or generated through model training using data.

[0039] To summarize, in this example, through the diversion of the network isolation layer, the simulated network topology network security training can be carried out without affecting the original service. At the same time, the normal maintenance of external requests also ensures that during network security training, the simulated network topology and the original service network topology are in the same service provision environment; and through the above security training, the target network service can be actively and automatically trained for security, network attacks can be carried out and corresponding defenses can be built, and the defense effect can be tested, and real-time data can be obtained and saved.

[0040] Obviously, the present invention is described through some examples. Those skilled in the art know that various replacements, adjustments and improvements can be made to these features and examples according to principles without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited to the specific examples disclosed herein, and all these replacements, adjustments and improvements should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A network security training method based on a simulated network, characterized in that: Through the simulated network training environment, the real network topology is simulated and reproduced, and various attack methods are used to test network attacks. Through the interactive feedback between various security resource modules, security vulnerabilities in the target service network structure are discovered, corresponding defense solutions are provided and implemented, and corresponding network security data is obtained for storage and export analysis; The specific steps include:

1. Constructing a simulated network topology environment; The simulated network topology environment includes: original service network topology, simulated network topology, and network isolation module; among which: The original service network topology is the original network part that provides normal services; The simulated network topology is a simulation of the original service network, which has the same network topology structure and service applications as the original service network module, and can simultaneously and synchronously provide the same feedback to external services and generate the same data; The network isolation module is deployed on the host of the service network topology structure, and is used to isolate the original service network topology and the simulated network topology, ensure the isolation of the two in terms of network and data access, and synchronously transmit external data access to the two network topologies; (II) Constructing a network security training system for information security attack and defense training and security data collection; specifically, conducting network security training on target network services through simulated network topology and collecting corresponding security data; specifically including the following modules: attack tool library module, defense tool library module, attack strategy library module, defense strategy library module, log library module, data collection module: Among them: The attack tool library module provides attack means for the network attack end, and is mainly composed of preset network penetration tools, network attack tools, and program execution scripts; the above tools are directly provided to the attack strategy library for modular call after being integrated to form a unified interface; The defense tool library module provides defense and information detection means for the target machine, and is composed of a firewall, a preset network threat detection tool, a system monitoring tool, a patch tool, and a program execution script; the above tools are integrated to form a unified interface, which is directly used by the defense strategy library for modular calls; The attack strategy library module provides decision-making and adjustment of attack methods, and attacks the target machine by selecting attack methods in the attack tool library through interface calls and custom combinations; and generates and stores custom attack strategies and imports existing common attack strategies; The defense strategy library module provides decision-making and adjustment of defense methods, and defends against attacks from the attacking end by selecting defense methods from the defense tool library through interface calls and custom combinations; by obtaining real-time security data, the defense measures of the target machine are adjusted according to the strategy; The log library module is used to store network attack and defense behavior records and result feedback; The data collection module provides storage and export of data records during the attack and defense process; the data here includes attack methods, defense methods, target machine security data and defense results, which are collected and integrated to form a one-to-one corresponding data vector for storage, and provide an interface for batch export for data analysis and training; (III) Conduct cybersecurity training based on a simulated network. The specific process is as follows: (1) The attack strategy library module calls the attack tool library module to attack the target network service. The defense strategy library module obtains data reflecting network and system characteristics, including port traffic and process status, through the network threat detection tools and system monitoring tools of the defense tool library, and passes it to the data collection module; (2) The data collection module feeds back the attack results to the defense strategy library module. The defense strategy library module adjusts the defense strategy based on the result data and calls the defense tool library module to defend against the attack on the target network service. (3) After defending against the attack, new feature data is generated and passed to the data collection module; (4) The data collection module then feeds back the data results after defense to the attack strategy library module. The attack strategy library module adjusts the attack strategy based on the result data and prepares to call the attack tool library to carry out the next network attack; (5) The cycle continues in this way. During this process, the data generated by the attack strategy library module, the defense strategy library module, and the data collection module are all recorded in the log library module. The data collection module will record and save the generated data for export for analysis or further data training.

2. The network security training method based on simulated network according to claim 1 is characterized in that: The modular call described in the attack tool library module refers to the detailed classification of the functions of the attack tool library, which are called individually or in free combination; among them, network penetration tools include active scanning tools, passive scanning tools, and vulnerability scanning tools; network attack tools include denial of service attack tools, Trojan horse making tools, malicious code injection tools, service authentication attack tools, and network deception tools.

3. The network security training method based on simulated network according to claim 1, characterized in that: In the defense tool library module, the real-time collection and feedback of the target machine's security data is mainly carried out by network threat detection tools and system monitoring tools; and specific defense measures are implemented through firewalls, patch tools, and program scripted configuration modification operations.

4. The network security training method based on simulated network according to claim 1 is characterized in that: There is a data path between the attack strategy library module and the defense strategy library module; the security data generated by the defense strategy library module can be fed back to the attack strategy module through the data path. The security data includes data before and after the implementation of the defense countermeasures. The attack strategy library module analyzes the feedback data and changes the attack method in combination with the attack strategy.

Images