An attack testing method and device, electronic equipment and storage medium

Abstract

The application provides an attack test method and device, electronic equipment and a storage medium. The method comprises: obtaining device information of each electronic device in a system to be tested; generating a system structure diagram according to the device information of each electronic device; determining a node with device information meeting a preset condition as a candidate node; determining a plurality of candidate attack paths according to the position of each candidate node in the system structure diagram; each candidate attack path comprises at least two candidate nodes; determining a target attack path from the plurality of candidate attack paths according to a preset rule; and using the target attack path to perform attack test on the test system. The attack test method provided by the application can automatically determine the target attack path according to the communication connection relationship of the electronic devices in the test system and the device information of each electronic device, so as to avoid the problems of low efficiency and large difference in test results caused by manual selection of attack paths and different selection of attack paths.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to an attack testing method and device, an electronic device, and a storage medium. BACKGROUND

[0002] Penetration attack testing is a network security analysis technique, which specifically attacks a network system under test by means of a hacker's attack method, so as to evaluate the network system security from the perspective of an attacker. It can be used to find system vulnerabilities, assist in vulnerability repair, and perform security reinforcement. Traditional penetration attack testing is usually implemented by a security service engineer. Penetration attack testing mainly relies on the personal experience of a security service engineer, and different security service engineers have different experiences, resulting in different project implementation results for different people. SUMMARY

[0003] Therefore, the present application provides an attack testing method and device, an electronic device, and a storage medium, which at least partially solve the problems in the prior art.

[0004] In one aspect of the present application, an attack testing method is provided, comprising:

[0005] Obtaining device information of each electronic device in a system to be tested.

[0006] Generating a system structure diagram according to the device information of each electronic device; each node in the system structure diagram corresponds to an electronic device, the device information of the corresponding electronic device is contained in the node, and the connection between any two nodes indicates that the two nodes have a communication connection.

[0007] Determining nodes with device information meeting a preset condition as candidate nodes to obtain a plurality of candidate nodes.

[0008] Determining a plurality of candidate attack paths according to the positions of each candidate node in the system structure diagram; each candidate attack path includes at least two candidate nodes.

[0009] Determining a target attack path from the plurality of candidate attack paths according to a preset rule.

[0010] Using the target attack path to perform attack testing on the test system.

[0011] In an exemplary embodiment of the present application, the device information includes device type and device configuration information.

[0012] The nodes with device information meeting the preset condition are determined as candidate nodes to obtain a plurality of candidate nodes, comprising:

[0013] According to the device type corresponding to each node, a detection rule set corresponding to each node is determined; the detection rule set includes at least one detection rule.

[0014] Each detection rule set is used to detect the device configuration information of the corresponding node.

[0015] If the current node meets any detection rule in the detection rule set corresponding to the current node, the current node is determined as a candidate node.

[0016] In an exemplary embodiment of the present application, the determining of the target attack path from the candidate attack paths according to the preset rule includes:

[0017] A priority score corresponding to each candidate attack path is determined; the priority score is determined according to the candidate nodes in the corresponding candidate attack path.

[0018] The target attack path is determined from the candidate attack paths according to the priority score.

[0019] In an exemplary embodiment of the present application, the determining of the target attack path from the candidate attack paths according to the priority score includes:

[0020] The candidate attack path in which the number of corresponding candidate nodes meets the preset number condition is determined as an intermediate attack path.

[0021] The intermediate attack path in which the corresponding priority score is the highest is determined as the target attack path.

[0022] In an exemplary embodiment of the present application, each device type has a corresponding device score; the device score is used to represent the importance of the corresponding electronic device.

[0023] The determining of the priority score corresponding to each candidate attack path includes:

[0024] The priority score corresponding to each candidate attack path is determined according to the device scores corresponding to all candidate nodes in each candidate attack path.

[0025] In an exemplary embodiment of the present application, after the obtaining of the candidate nodes, the method further includes:

[0026] A vulnerability score corresponding to each candidate node is determined according to the detection rule met by each candidate node.

[0027] The determining of the priority score corresponding to each candidate attack path according to the device scores corresponding to all candidate nodes in each candidate attack path includes:

[0028] The priority score of each candidate attack path is determined according to the device score and the vulnerability score corresponding to all candidate nodes in each candidate attack path.

[0029] In an example embodiment of the present application, each detection rule comprises a corresponding basic vulnerability score; each device type has a corresponding device weight.

[0030] The vulnerability score of each candidate node is determined according to the detection rule met by each candidate node, and the vulnerability score of each candidate node is determined according to the device weight of each candidate node and the basic vulnerability score corresponding to the detection rule met by each candidate node.

[0031] The vulnerability score of each candidate node is determined according to the device weight of each candidate node and the basic vulnerability score corresponding to the detection rule met by each candidate node.

[0032] In another aspect of the present application, an attack testing device is provided, comprising:

[0033] An acquisition module is configured to acquire device information of each electronic device in a system to be tested.

[0034] A generation module is configured to generate a system structure diagram according to the device information of each electronic device; each node in the system structure diagram corresponds to one electronic device, the device information of the corresponding electronic device is contained in the node, and a connection line between any two nodes indicates that the two nodes have a communication connection.

[0035] A node determination module is configured to determine a node whose device information meets a preset condition as a candidate node, so as to obtain a plurality of candidate nodes.

[0036] A first path determination module is configured to determine a plurality of candidate attack paths according to the positions of the candidate nodes in the system structure diagram; each candidate attack path comprises at least two candidate nodes.

[0037] A second path determination module is configured to determine a target attack path from the plurality of candidate attack paths according to a preset rule.

[0038] A testing module is configured to perform attack testing on the testing system using the target attack path.

[0039] In another aspect of the present application, an electronic device is provided, comprising a processor and a memory.

[0040] The processor is configured to execute the steps of any of the above methods by calling programs or instructions stored in the memory.

[0041] In another aspect of the present application, a non-transitory computer readable storage medium is provided, which stores programs or instructions, and the programs or instructions make a computer execute the steps of any of the above methods.

[0042] The attack test method provided in the application can generate a system structure diagram corresponding to the to-be-tested system according to the communication connection relationship of the electronic devices in the to-be-tested system and the device information of each electronic device. Then, the nodes in the system structure diagram that meet preset conditions are determined as candidate nodes. The candidate nodes are nodes that can be attacked devices, that is, they have certain security vulnerabilities. After the candidate nodes are determined, the candidate attack paths can be determined according to the positions of each candidate node in the system structure diagram and the communication connection relationship therebetween. The candidate attack paths are attack paths that can be used for penetration attack test. Then, the target attack path is determined from the candidate attack paths according to preset rules, so as to realize attack test through an optimal attack path. The attack test method provided in the application can automatically determine the target attack path according to the communication connection relationship of the electronic devices in the to-be-tested system and the device information of each electronic device, so as to avoid the problems of low efficiency and large difference in test results caused by different attack paths selected by different people when the attack path is selected by people. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the application, and for those skilled in the art, other drawings can be obtained from these drawings without creative labor.

[0044] Figure 1 The flowchart of an attack test method provided in an embodiment of the application.

[0045] Figure 2 The structural block diagram of an attack test device provided in an embodiment of the application. DETAILED DESCRIPTION

[0046] The embodiments of the application will be described in detail below with reference to the drawings.

[0047] It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict; and based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present disclosure.

[0048] It is important to note that the various aspects described throughout this disclosure can be implemented in any of numerous ways, as the described aspects specify a generic set of options. Other aspects described herein can include one or more of the following aspects and / or yet other aspects. It should be apparent that the aspects described herein can be implemented in a wide variety of forms and that any specific structure and / or function described herein is merely illustrative. An aspect or any specified feature or combination of features need not be implemented to receive benefit of any claim or aspect.

[0049] Reference is made to Figure 1 In one aspect of the present disclosure, a method for attack testing is provided, comprising the steps of:

[0050] S100, obtaining device information of each electronic device in a system to be tested. The device information can include device type and device configuration information. The device type can be office equipment, client equipment, router, switch, database, mail server, printing equipment, firewall, domain controller, and administrator server, etc. The device configuration information can include host system version information, port opening information, service version information, service opening information, and hardware version information, etc.

[0051] S200, generating a system structure diagram according to the device information of each electronic device. Each node in the system structure diagram corresponds to an electronic device, and the device information of the corresponding electronic device is contained in the node. The connection between any two nodes indicates that the two nodes have communication connection.

[0052] S300, determining nodes with device information meeting a preset condition as candidate nodes to obtain a plurality of candidate nodes. Specifically, the preset condition can be used to determine nodes that are easy to be attacked successfully by attack means or attack techniques (i.e., nodes with security vulnerabilities), and the corresponding device information can be used to determine whether the nodes can be attacked successfully.

[0053] S400, determining a plurality of candidate attack paths according to the positions of each candidate node in the system structure diagram. Each candidate attack path includes at least two candidate nodes. The position of a candidate node in the system structure diagram can indicate its importance and whether it can be directly connected to the external network. An electronic device in the system structure diagram that has only one node in communication connection relationship or a node directly connected to the external network can be used as an entry node (i.e., the first node to be attacked).

[0054] It is known that when a domain controller or an administrator server of a network system is successfully penetrated, the network system is considered to be compromised. Therefore, the successful penetration of the domain controller or the administrator server is the final goal of the penetration attack test. Therefore, in the embodiment, the device type corresponding to the node corresponding to the focus of each candidate attack path should be a domain controller or an administrator server.

[0055] S500, determining a target attack path from the plurality of candidate attack paths according to a preset rule. The target attack path determined by the preset rule can be a candidate attack path with the least electronic devices on the attack path, or a candidate attack path with the lowest overall attack difficulty. The specific preset rule can be designed according to actual needs.

[0056] S600, using the target attack path to perform attack testing on the test system. The attack testing can be a penetration attack test, and the specific testing method can be set according to actual needs. The attack means used in the attack testing can be selected according to the device type and the security vulnerabilities of the nodes on the target attack path.

[0057] The attack testing method provided in the embodiment can generate a system structure diagram corresponding to the test system according to the communication connection relationship of the electronic devices in the test system and the device information of each electronic device. Then, the nodes in the system structure diagram that meet the preset conditions are determined as candidate nodes. The candidate nodes are nodes that can be attacked, i.e., they have certain security vulnerabilities. After determining the candidate nodes, the candidate attack paths can be determined according to the positions of each candidate node in the system structure diagram and the communication connection relationship between them. The candidate attack paths are attack paths that can be used for penetration attack testing. Then, a target attack path is determined from the plurality of candidate attack paths according to a preset rule, so as to perform attack testing through an optimal or most optimal attack path. The attack testing method provided in the embodiment can automatically determine a target attack path according to the communication connection relationship of the electronic devices in the test system and the device information of each electronic device, so as to avoid the problems of low efficiency and large difference in test results caused by manual selection of attack paths.

[0058] In an example embodiment of the present application, the step S300 includes the following steps:

[0059] S310, determine a detection rule set corresponding to each node according to a device type corresponding to each node. The detection rule set contains at least one detection rule. Wherein, the detection rule can be set according to the attack method or attack means in the preset attack mode knowledge graph. For example, if a certain attack means can attack the client device using A version windows system, the corresponding detection rule can be set for the client device, which can determine whether the corresponding device uses A version windows system.

[0060] S320, use each detection rule set to detect the device configuration information of the node corresponding thereto.

[0061] S330, if the current node meets any detection rule in the detection rule set corresponding thereto, the current node is determined as a candidate node.

[0062] Specifically, the detection rule can include but is not limited to the following provided detection rules:

[0063] Whether the system of the domain control server is a lower version of win server 2008r2;

[0064] Whether the domain control server has high permission;

[0065] Whether the domain control server is two or more;

[0066] Whether the PC system in the office network is a low version of XP and win7;

[0067] Whether there is an unauthorized access database in the Redis database cluster;

[0068] Whether the administrator server is a lower version of win7 system.

[0069] In the embodiment, the detection rule set capable of directly detecting whether each node has a security vulnerability is determined according to the device type corresponding to each node. And the detection rule set is used for detection. To realize the all-round vulnerability detection of each node, more accurately determine the candidate node, and avoid the problem of invalid detection.

[0070] In an exemplary embodiment of the present application, the step S500 comprises:

[0071] S510, determine a priority score corresponding to each candidate attack path. The priority score is determined according to the candidate node in the corresponding candidate attack path.

[0072] S520, determine a target attack path from several candidate attack paths according to the priority score.

[0073] In this embodiment, the priority score of each candidate attack path is determined according to the candidate nodes in each candidate attack path. The priority score can be determined according to at least one of the number of candidate nodes in the candidate path, the importance of the candidate nodes, and the number of vulnerabilities of the candidate nodes. The fewer the number of candidate nodes, the fewer the devices that need to be attacked, and the efficiency of the attack can be improved. The higher the importance of the candidate nodes, the greater the help to subsequent attacks after the candidate nodes are compromised. The more the number of vulnerabilities of the candidate nodes, the lower the difficulty of compromising the candidate nodes or the more attack methods that can be selected.

[0074] Therefore, in this application, the priority score corresponding to each candidate attack path is determined by the above method, and the optimal candidate attack path can be selected as the target attack path, thereby improving the efficiency of penetration attack testing.

[0075] In an exemplary embodiment of the present application, the target attack path is determined from the plurality of candidate attack paths according to the priority score, comprising:

[0076] The candidate attack path corresponding to the number of candidate nodes meeting the preset number condition is determined as an intermediate attack path.

[0077] The intermediate attack path corresponding to the highest priority score in the intermediate attack path is determined as the target attack path.

[0078] In actual implementation, when determining the priority score of each candidate attack path, there may be a situation where the number of candidate nodes on the path is particularly large, but the corresponding priority score is also high. However, as known, the more devices attacked, the greater the probability of being discovered during malicious attacks. Therefore, the above candidate attack path is obviously not suitable as a target attack path. Therefore, in this embodiment, such candidate attack paths are first deleted by the preset number condition to avoid determining them as target attack paths, thereby improving the accuracy of the determined target attack path.

[0079] In an exemplary embodiment of the present application, each device type has a corresponding device score. The device score is used to represent the importance of the corresponding electronic device. For example, the device score of the domain controller is the highest, and the device score of the client device is the lowest.

[0080] The priority score corresponding to each candidate attack path is determined, comprising:

[0081] The priority score corresponding to each candidate attack path is determined according to the device score corresponding to all candidate nodes in each candidate attack path.

[0082] Specifically, the device scores corresponding to all candidate nodes in each candidate attack path can be added to obtain a priority score of the candidate attack path. At this time, the higher the priority score is, the higher the attack value of the corresponding candidate attack path is, so that the accuracy of the determined target attack path is higher.

[0083] In an exemplary embodiment of the present application, after the candidate nodes are obtained, the method further comprises:

[0084] According to the detection rule met by each candidate node, a vulnerability score corresponding to each candidate node is determined.

[0085] The priority score corresponding to each candidate attack path is determined according to the device scores corresponding to all candidate nodes in each candidate attack path.

[0086] The priority score corresponding to each candidate attack path is determined according to the device scores and vulnerability scores corresponding to all candidate nodes in each candidate attack path.

[0087] Specifically, each detection rule includes a corresponding basic vulnerability score; each device type has a corresponding device weight.

[0088] The vulnerability score corresponding to each candidate node is determined according to the detection rule met by each candidate node, comprising:

[0089] The vulnerability score of each candidate node is determined according to the device weight of each candidate node and the basic vulnerability score corresponding to the detection rule met by each candidate node. The vulnerability score can be obtained by weighting and summing the basic vulnerability score with the device weight.

[0090] The basic vulnerability score can be determined according to the number of attack means or the difficulty of attack corresponding to the detection rule corresponding to the basic vulnerability score. The higher the attack means or the lower the difficulty of attack, the higher the corresponding basic vulnerability score. Moreover, the same vulnerability has different values on different types of electronic devices for an attacker. For example, if the value of vulnerability A on a domain controller is much higher than the value of vulnerability A on a client device. Therefore, in this embodiment, the determined priority score can reflect the value of the vulnerabilities existing in the candidate attack path and the distinction of the attack value of the same vulnerability on different types of devices, so that the determined priority is more accurate, thereby improving the accuracy of the subsequently determined target attack path.

[0091] Please refer to Figure 2 In another aspect of the present application, an attack testing device is provided, comprising:

[0092] An acquisition module is configured to acquire device information of each electronic device in a system to be tested.

[0093] The generating module is configured to generate a system structure diagram according to the device information of each electronic device; each node in the system structure diagram corresponds to one electronic device, the device information of the corresponding electronic device is contained in the node, and a connection line between any two nodes indicates that the two nodes have a communication connection.

[0094] The node determining module is configured to determine a node whose device information meets a preset condition as a candidate node, so as to obtain a plurality of candidate nodes.

[0095] The first path determining module is configured to determine a plurality of candidate attack paths according to the positions of the candidate nodes in the system structure diagram; each candidate attack path includes at least two candidate nodes.

[0096] The second path determining module is configured to determine a target attack path from the plurality of candidate attack paths according to a preset rule.

[0097] The testing module is configured to perform attack testing on the test system by using the target attack path.

[0098] In addition, although the various steps of the method in the present disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in this specific order, or that all of the steps shown must be performed to achieve the desired result. Additionally or alternatively, some steps can be omitted, a plurality of steps can be combined into one step, and / or one step can be divided into a plurality of steps, etc.

[0099] From the above description of the embodiments, those skilled in the art can easily understand that the example embodiments described herein can be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.) or a network, and includes a plurality of instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to perform the method according to the embodiments of the present disclosure.

[0100] In the exemplary embodiments of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0101] Those skilled in the art can understand that various aspects of the present application can be implemented as a system, a method or a program product. Therefore, various aspects of the present application can be embodied in a form of a complete hardware embodiment, a complete software embodiment (including firmware, microcode, etc.), or an embodiment combining software and hardware aspects, which can be collectively referred to as "circuitry", "module" or "system" herein.

[0102] The electronic device according to this embodiment of the present application. The electronic device is merely an example and should not bring any limitation to the function and use range of the embodiments of the present application.

[0103] The electronic device is in the form of a general computing device. The components of the electronic device can include, but are not limited to, the at least one processor described above, the at least one storage described above, and a bus connecting different system components, including the storage and the processor.

[0104] The storage stores program codes which can be executed by the processor, so that the processor executes the steps according to various exemplary embodiments of the present application described in the "Exemplary Method" part of the present specification.

[0105] The storage can include a readable medium in the form of a volatile storage, such as a random access memory (RAM) and / or a cache memory, and can further include a read-only memory (ROM).

[0106] The storage can further include programs / utilities with a set of (at least one) program modules, such as an operating system, one or more application programs, other program modules, and program data, each of which or some combination of which can include the implementation of a network environment.

[0107] The bus can be one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures.

[0108] The electronic device can also communicate with one or more external devices such as a keyboard or a pointing device, through an I / O interface. The electronic device can also communicate to one or more devices that enable a user to interact with it, and / or to one or more devices (e.g., a router, a modem, a server, etc.) that enable the electronic device to communicate with one or more other computing devices. Such communication can occur via an I / O interface. Also, the electronic device can communicate to one or more networks such as a local area network (LAN), a wide area network (WAN), and / or the Internet through a network adapter. It should be appreciated that the network adapter can be collectively part of the electronic device, part of another device, or a stand-alone device. In addition, while the network adapter is illustrated as a single device, the network adapter can include any number of devices that are adapted to enable the electronic device to communicate with one or more networks.

[0109] Those skilled in the art will readily understand that the example embodiments described herein can be implemented by software and / or by hardware coupled with software, as described above. Thus, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, or the like) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to perform the methods according to the embodiments of the present disclosure.

[0110] In the example embodiments of the present disclosure, a computer readable storage medium is also provided, which stores a program product capable of implementing the above-mentioned method of the present disclosure. In some possible embodiments, various aspects of the present disclosure can also be implemented in the form of a program product, which includes program codes for causing a terminal device to perform the steps described in the above-mentioned "example method" section according to various example embodiments of the present disclosure when the program product is run on the terminal device.

[0111] The program product can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any combination of the above. More specific examples (non-exhaustive list) of the readable storage medium include an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0112] Computer readable signal media can include a propagated data signal with instructions embodied in data signals. Such propagated signal can take a wide variety of forms, including but not limited to electro-magnetic signals, optical signals, and so forth. A computer readable medium of the present application can also be any medium that can be read by a computer. Such mediums can include, but are not limited to optical storage devices (e.g., CD-ROMs, optical disks, etc.), semi-conductor memory devices (e.g., RAM, ROM, etc.), and further can include any medium that can be used to store the desired information dynamically accessible by a computer.

[0113] The code can be transmitted in any form including radio frequency, optical, electrical, or the like, or any suitable combination thereof. A code can be implemented in any of a variety of programming languages including, for example, C++.

[0114] The program code may

[0115] Further, the above-described diagrams merely illustrate a sequence of the processes included in the method according to the exemplary embodiments of the present application, and are not intended to limit the present application. It is readily understood that the processes illustrated in the above-described diagrams do not indicate or limit the time sequence of the processes. In addition, it is readily understood that the processes can be executed in synchronization or asynchronously, for example, in a plurality of modules.

[0116] It should be noted that although several modules or units of the apparatus for action execution are mentioned in the above detailed description, such division is not mandatory. Indeed, according to an embodiment of the present disclosure, the features and functionalities of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functionalities of one module or unit described above can be further divided into embodied by a plurality of modules or units.

[0117] The above merely provides the specific implementation of the present application, but the protection scope of the present application is not limited to this. Any changes or replacements within the technical scope disclosed by the present application can be easily conceived by the person skilled in the art, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An attack testing method, characterized in that, include: Obtain device information for each electronic device in the system under test; Generate a system structure diagram based on the device information of each electronic device; Each node in the system structure diagram corresponds to an electronic device. The node contains the device information of the corresponding electronic device. A line between any two nodes indicates that there is a communication connection between the two nodes. Nodes whose device information meets preset conditions are identified as candidate nodes to obtain a number of candidate nodes; Based on the position of each candidate node in the system structure diagram, several candidate attack paths are determined; Each candidate attack path includes at least two candidate nodes; Based on preset rules, the target attack path is determined from several candidate attack paths; The test system was attacked using the target attack path; The device information includes device type and device configuration information; The step of determining nodes whose device information meets preset conditions as candidate nodes, to obtain a number of candidate nodes, includes: Based on the device type corresponding to each node, a detection rule set corresponding to each node is determined; the detection rule set contains at least one detection rule. Each set of detection rules is used to detect the device configuration information of its corresponding node. If the current node meets any detection rule in its corresponding detection rule set, then the current node is determined as a candidate node; The step of determining the target attack path from several candidate attack paths according to preset rules includes: Determine the priority score for each candidate attack path; the priority score is determined based on at least one of the following: the number of candidate nodes in the corresponding candidate attack path, the importance of the candidate nodes, and the number of vulnerabilities in the candidate nodes. Based on priority scores, the target attack path is determined from several candidate attack paths.

2. The attack testing method according to claim 1, characterized in that, The step of determining the target attack path from several candidate attack paths based on priority scores includes: The candidate attack path whose number of corresponding candidate nodes meets the preset number condition is determined as the intermediate attack path. The intermediate attack path with the highest priority score is identified as the target attack path.

3. The attack testing method according to any one of claims 2, characterized in that, Each device type has a corresponding device score; the device score is used to indicate the importance of the corresponding electronic device. Determining the priority score for each candidate attack path includes: The priority score for each candidate attack path is determined based on the device scores of all candidate nodes within each candidate attack path.

4. The attack testing method according to claim 3, characterized in that, After obtaining several candidate nodes, the method further includes: Based on the detection rules that each candidate node conforms to, determine the vulnerability score corresponding to each candidate node; The step of determining the priority score for each candidate attack path based on the device scores corresponding to all candidate nodes within each candidate attack path includes: The priority score for each candidate attack path is determined based on the device score and vulnerability score of all candidate nodes within each candidate attack path.

5. The attack testing method according to claim 4, characterized in that, Each of the aforementioned detection rules includes a corresponding basic vulnerability score; each device type has a corresponding device weight; The step of determining the vulnerability score corresponding to each candidate node based on the detection rules that each candidate node conforms to includes: The vulnerability score for each candidate node is determined based on its device weight and the basic vulnerability score corresponding to the detection rules it conforms to.

6. An attack testing device, characterized in that, include: The acquisition module is used to acquire device information for each electronic device in the system under test. The generation module is used to generate a system structure diagram based on the device information of each electronic device; Each node in the system structure diagram corresponds to an electronic device. The node contains the device information of the corresponding electronic device. A line between any two nodes indicates that there is a communication connection between the two nodes. The node determination module is used to determine the nodes whose device information meets the preset conditions as candidate nodes, so as to obtain a number of candidate nodes; The first path determination module is used to determine several candidate attack paths based on the position of each candidate node in the system structure diagram; each candidate attack path includes at least two candidate nodes. The second path determination module is used to determine the target attack path from several candidate attack paths according to preset rules. The testing module is used to perform attack tests on the test system using the target attack path; The device information includes device type and device configuration information; The step of determining nodes whose device information meets preset conditions as candidate nodes, to obtain a number of candidate nodes, includes: Based on the device type corresponding to each node, a detection rule set corresponding to each node is determined; the detection rule set contains at least one detection rule. Each set of detection rules is used to detect the device configuration information of its corresponding node. If the current node meets any detection rule in its corresponding detection rule set, then the current node is determined as a candidate node; The step of determining the target attack path from several candidate attack paths according to preset rules includes: Determine the priority score for each candidate attack path; the priority score is determined based on at least one of the following: the number of candidate nodes in the corresponding candidate attack path, the importance of the candidate nodes, and the number of vulnerabilities in the candidate nodes. Based on priority scores, the target attack path is determined from several candidate attack paths.

7. An electronic device, characterized in that, Including processor and memory; The processor executes the steps of the method as described in any one of claims 1 to 5 by invoking programs or instructions stored in the memory.

8. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores a program or instructions that cause a computer to perform the steps of the method as described in any one of claims 1 to 5.

Images