A traffic detection test method and device, electronic equipment and storage medium

Abstract

The application provides a traffic detection test method and device, electronic equipment and storage medium, and relates to the technical field of computers. The traffic detection test method is applied to an attack traffic simulation platform, includes: analyzing a preset intrusion detection rule, obtaining attack parameters, the attack parameters including: network quintuple information, flow information, load and keyword information; generating an attack simulation instruction according to the attack parameters; sending the attack simulation instruction to a client and a server respectively to listen to and obtain interactive traffic; and analyzing and obtaining a test result of the intrusion rule according to the interactive traffic. The application generates simulated traffic by analyzing a preset intrusion detection rule, realizes traffic detection through an attack simulation instruction, and makes up for the problem that information is missing and the actual environment cannot be simulated or the time cost of simulation is too high under the condition of known rules.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a test method, apparatus, electronic device, and storage medium for flow detection. Background Technology

[0002] In recent years, with the widespread adoption of network applications, network security has become particularly important. As a crucial component of network security, intrusion detection systems have attracted significant attention from the industry. Currently, Snort and Snort-like (Suricata) rules dominate the intrusion detection system landscape. These rules are simple and easy to understand, facilitating security expert teams in developing rules based on specific types of attack events.

[0003] In existing technologies, security expert teams extract feature rules by analyzing attack events, reproduce vulnerabilities using simulation testing platforms, and import the traffic from the vulnerability simulation platform into the intrusion detection system for processing along with normal traffic. Then, the normal data traffic and the collected vulnerability simulation platform data sample traffic can be used to test the stored intrusion detection rules.

[0004] Existing technologies mainly focus on batch testing of rules to filter out false positives and missed positives, but they cannot test the quality of rules and the robustness of the engine. In addition, when the rules are known, there are still problems such as missing information that cannot simulate the actual environment or the time cost required for simulation is too high. Summary of the Invention

[0005] The purpose of this application is to provide a testing method, apparatus, electronic device, and storage medium for traffic detection, so as to quickly verify the matching function and log reporting function of the intrusion detection testing engine in batches.

[0006] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows:

[0007] In a first aspect, embodiments of this application provide a method for traffic detection, comprising:

[0008] Parse the preset intrusion detection rules to obtain attack parameters, which include one or more of the following: network 5-tuple information, flow information, load and keyword information;

[0009] Based on the attack parameters, generate attack simulation instructions;

[0010] The attack simulation commands are sent to the client and server respectively to monitor and obtain the interaction traffic;

[0011] Based on the interaction traffic, analyze and obtain the test results of the intrusion detection rules.

[0012] In one optional implementation, generating attack simulation instructions based on the attack parameters includes:

[0013] The network quintuple information is converted into preset protocol and port information;

[0014] Convert the stream information into request or response information;

[0015] Convert the payload and keyword information into data packets;

[0016] Attack simulation instructions are generated by combining the preset protocol and port information, the request or response information, and the data packets.

[0017] In one optional implementation, converting the payload and keyword information into a data packet includes:

[0018] If there is a connection statement and a corresponding offset between any two contents of the load, then fill the two loads with random characters of the length corresponding to the offset, and obtain the filled load content;

[0019] Based on the filled payload content, the data packet is converted and obtained.

[0020] In one optional implementation, the attack parameters further include: regular expressions;

[0021] The step of converting the payload and keyword information into a data packet includes:

[0022] The payload and keyword information, along with the regular expression, are converted into a data packet.

[0023] In one optional implementation, sending the attack simulation instructions to the client and server respectively includes:

[0024] Based on the flow direction in the flow information, the attack simulation command is assigned to the path where the client or the server is located.

[0025] In one optional implementation, the step of analyzing and obtaining the test results of the intrusion detection rules based on the interaction traffic includes:

[0026] The address information of data packets in the interactive traffic is modified using a preset tool to obtain simulated traffic;

[0027] The simulated traffic is monitored using the preset intrusion detection rules, and alarm information is generated.

[0028] Based on the alarm information and the simulated traffic, analyze and obtain the test results of the intrusion detection rules.

[0029] In one optional implementation, the step of analyzing and obtaining the test results of the intrusion detection rules based on the alarm information and the simulated traffic includes:

[0030] Compare the alarm information with the rule information used by the simulated traffic;

[0031] If the alarm information and the rule information used by the simulated traffic are consistent, then the test result shows that the preset intrusion detection rule can be hit.

[0032] Secondly, embodiments of this application provide a testing apparatus for flow detection, comprising:

[0033] The parsing module is used to parse preset intrusion detection rules and obtain attack parameters, which include one or more of the following: network quintuple information, flow information, load and keyword information;

[0034] The generation module is used to generate attack simulation instructions based on the attack parameters;

[0035] The sending module is used to send the attack simulation commands to the client and the server respectively, in order to listen for and obtain the interaction traffic;

[0036] The analysis module is used to analyze and obtain the test results of the intrusion detection rules based on the interaction traffic.

[0037] In one optional implementation, the generation module is specifically used to convert the network quintuple information into preset protocol and port information; convert the flow information into request or response information; convert the load and keyword information into data packets; and generate attack simulation instructions by combining the preset protocol and port information, the request or response information, and the data packets.

[0038] 5. In an optional implementation, the generation module is specifically used to fill the two payloads with random characters of the length corresponding to the offset if there is a connection statement and a corresponding offset between the contents of any two payloads, and obtain the filled payload content; and to convert and obtain the data packet according to the filled payload content.

[0039] In one optional implementation, the attack parameters further include: a regular expression; the 0 generation module is specifically used to convert the payload and keyword information and the regular expression into data packets.

[0040] In one optional implementation, the sending module is specifically used to distribute the attack simulation command to the path where the client or the server is located, based on the flow direction in the flow information.

[0041] 5. In an optional implementation, the analysis module is specifically used to repair using preset tools.

[0042] Modify the address information of the interactive traffic to obtain simulated traffic; monitor the simulated traffic according to the preset intrusion detection rules and generate alarm information; analyze and obtain the test results of the intrusion detection rules based on the alarm information and the simulated traffic.

[0043] In one optional implementation, the analysis module is specifically used to compare the alarm information with the rule information used by the simulated traffic; if the alarm information and the rule information used by the simulated traffic are consistent, the test result indicates that the preset intrusion detection rule can be hit.

[0044] Thirdly, embodiments of this application provide an electronic device, including: a processor, a storage medium, and a bus. The storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the method provided in the first aspect.

[0045] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method provided in the first aspect.

[0046] The traffic detection testing method, apparatus, electronic device, and storage medium provided in this application embodiment generate attack simulation instructions by parsing preset intrusion detection rules. After receiving the instructions, the client and server interact, and the final test results can be obtained by analyzing the interaction traffic. This realizes traffic detection through attack simulation instructions, making up for the problems of missing information and inability to simulate the actual environment or excessive time cost required for simulation when the rules are known. Attached Figure Description

[0047] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 A schematic diagram of a system framework for intrusion detection rule testing provided in an embodiment of this application;

[0049] Figure 2 A flowchart illustrating a traffic detection test method provided in an embodiment of this application;

[0050] Figure 3 A flowchart illustrating a traffic detection test method provided in an embodiment of this application;

[0051] Figure 4 A flowchart illustrating a traffic detection test method provided in an embodiment of this application;

[0052] Figure 5 A schematic diagram of the structure of a flow detection test device provided in an embodiment of this application;

[0053] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0055] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0056] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0057] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0058] This application proposes a traffic detection testing method for intrusion detection rules, which can be implemented through an attack traffic simulation platform in the intrusion detection rule testing system.

[0059] Figure 1 A schematic diagram of a system framework for intrusion detection rule testing provided in an embodiment of this application is shown below. Figure 1 As shown, it includes:

[0060] The memory is used to store the intrusion detection rules to be tested, data samples collected by the packet collector, and simulated traffic.

[0061] A packet capture tool is used to sample and store attack behaviors suffered by a vulnerability simulation platform. It also collects replay traffic from the attack traffic simulation platform. For example, a packet capture tool could be a pcap capture tool that samples each attack behavior suffered by the vulnerability simulation platform and stores it in memory or a file system. This memory also stores intrusion detection rules to be tested.

[0062] The intrusion detection rule testing engine receives normal data traffic (data flows based on business and applications can be received via a normal network) and performs a first test on the stored intrusion detection rules based on this normal data traffic. It also performs a second test on the stored intrusion detection rules using data samples collected by a packet collector. Furthermore, the intrusion detection system uses the intrusion detection rule testing engine to monitor attack traffic and simulate the platform's network interface card to perform a third test on the stored intrusion detection rules.

[0063] The test involves several steps. Normal data traffic can be obtained from the office network. The intrusion detection rule testing engine includes multiple network interface cards (NICs). The first test monitors the resident status of each NIC within the engine to determine if the stored intrusion detection rules generate false alarms indicating malicious behavior in the normal data traffic. For example, if an intrusion detection rule triggers an alarm, it indicates a false alarm, and the engine records the rule that triggered the alarm. The second test iterates through the collected data samples based on the stored intrusion detection rules and analyzes them one by one to determine if there are any missed attacks. If so, these attacks that did not trigger alarms are recorded. The third test simulates the platform's NICs by monitoring attack traffic. The intrusion detection system is pre-set to generate alarm information. The alarm information is compared with the rule information used in the simulated traffic. If they match, the generated simulated traffic matches the characteristics of the pre-set intrusion detection rules. The intrusion detection rule testing engine generates test results for the first, second, and third tests, respectively, which include the information recorded above.

[0064] The network management page is used to respond to input commands, present the intrusion detection rules to be tested, and output the first test result, the second test result, and the third test result.

[0065] A vulnerability simulation platform consists of multiple virtual machines used to receive attack attempts. Attack tests can be conducted on the platform using software containing vulnerabilities. Furthermore, the platform can be exposed to the internet to receive a wider variety of attacks, including unknown attack behaviors.

[0066] The attack traffic simulation platform consists of multiple virtual machines and is used to reverse generate simulated traffic based on preset intrusion detection rules. By comparing the alarm information generated by the preset intrusion detection system with the rule information used by the generated simulated traffic, it tests and verifies whether the characteristics of the preset intrusion detection rules are hit.

[0067] The system consists of a client and a server. The server can be developed based on network frameworks such as Tokio and Twisted. Both the client and server are used to execute interactive tasks after receiving instructions from the attack traffic simulation platform.

[0068] Figure 2 A flowchart illustrating a traffic detection test method provided in this application embodiment is shown below. Figure 2 As shown, this method, applied to an attack traffic simulation platform, includes:

[0069] S201. Parse the preset intrusion detection rules and obtain attack parameters. The attack parameters include one or more of the following: network 5-tuple information, flow information, load and keyword information.

[0070] It should be noted that the preset intrusion detection rules can be Snort rules or Snort-like rules (Suricata). The attack traffic simulation platform reads and parses Snort rules or Snort-like rules, that is, it performs statement parsing and decomposition on Snort rules or Snort-like rules. For example, a regular expression parser or syntax parser can be used for parsing to obtain attack parameters, which include one or more of the following: network 5-tuple information, flow information, load, and keyword information. In addition to network 5-tuple information, other non-essential attack parameters may also be included, which are not limited here. Furthermore, the obtained attack parameters can be saved to the corresponding data structure.

[0071] S202. Generate attack simulation instructions based on attack parameters.

[0072] The information obtained after converting the above attack parameters can be combined to form attack simulation instructions for subsequent attack simulations.

[0073] S203. Send the attack simulation commands to the client and server respectively to listen for and obtain the interaction traffic.

[0074] The attack traffic simulation platform sends attack simulation commands to both the client and server. Upon receiving the commands, the client and server begin executing interactive tasks, monitoring and acquiring the interaction traffic between them. It's important to note that flow information includes flow state and flow direction. When the flow direction is client -> server, the client encapsulates a data packet and sends a request to the server. When the flow direction is server -> client, the client sends a request (the content of which is randomly generated), and the server responds with a data packet content concatenated according to preset intrusion detection rules.

[0075] S204. Based on the interaction traffic, analyze and obtain the test results of the intrusion detection rules.

[0076] By acquiring the interaction traffic, we can analyze some problems in the process of attack simulation command interaction, and thus obtain test results.

[0077] For example, an attack traffic simulation platform monitors the interaction traffic between the client and the server. It can modify the IP address of the data packets using a tool (specifically tcprewrite), export and store the final simulated traffic. The intrusion detection system generates alarm information by monitoring the network card of the attack traffic simulation platform or by receiving and replaying the traffic through the aforementioned packet collector. By comparing the alarm information with the rule information used in the generated simulated traffic, the test results of the intrusion detection rules can be analyzed and obtained.

[0078] In this embodiment, attack simulation instructions are generated by parsing preset intrusion detection rules. After receiving the instructions, the client and server interact. The final test results can be obtained by analyzing the interaction traffic. This realizes traffic detection through attack simulation instructions, which makes up for the problems of missing information and inability to simulate the actual environment or excessive time cost required for simulation when the rules are known.

[0079] In this embodiment of the application, attack simulation instructions are generated based on attack parameters, including:

[0080] The network 5-tuple information is converted into preset protocol and port information; the flow information is converted into request or response information; and the payload and keyword information are converted into data packets.

[0081] Furthermore, attack simulation instructions are generated by combining preset protocols and port information, request or response information, and data packets.

[0082] In other words, in this embodiment, attack parameters are obtained by parsing the preset intrusion detection rules, and then combined to generate attack simulation instructions to achieve attack simulation.

[0083] It should be noted that by converting the network five-tuple information to the protocol type and port information enabled according to the intrusion detection rules, the corresponding protocol sub-service can be started. The server can generate a fake protocol sub-service on the attack traffic simulation platform based on the received protocol type and data packets.

[0084] In addition, the actual data packets filled above are data packets concatenated based on the payload content and keyword information. When there are connection statements and corresponding offsets between the two payload contents, random characters of the corresponding length can be filled between the two payload contents.

[0085] Furthermore, the protocol type and port information enabled according to the preset intrusion detection rules, the converted request or response information, and the information of the actual filled data packet can be combined to form an attack simulation command. Generally, an attack simulation command can be generated if the above three conditions are met.

[0086] In another embodiment, converting the payload and keyword information into a data packet includes:

[0087] If any two payload contents contain a join statement and a corresponding offset, then a random string of the offset length is inserted between the two payloads to obtain the padded payload content. Further, based on the padded payload content, the data packet is converted and obtained.

[0088] It should be noted that the above connection statement can be a distance, within, or other connection statements.

[0089] Furthermore, based on the filled payload content, the actual filled data packet is obtained.

[0090] Optionally, the attack parameters mentioned above may also include: regular expressions.

[0091] Accordingly, the above-mentioned conversion of payload and keyword information into data packets may include: converting payload and keyword information and regular expressions into data packets.

[0092] The regular expression can be a PCRE expression. If a PCRE expression exists, the corresponding payload bytecode is generated using a password dictionary library. Then, the payload, keyword information, and regular expression are converted into the actual data packet to be filled.

[0093] In this embodiment of the application, the above-mentioned attack simulation instructions are sent to the client and the server respectively, including:

[0094] Based on the flow direction in the flow information, the attack simulation commands are assigned to the path where the client or server is located.

[0095] It should be noted that the attack traffic simulation platform can send attack simulation commands to the client or server according to the flow direction in the flow information. Specifically, the concatenated payload content can be distributed to the path where the client or server is located through the configuration file to realize subsequent interaction between the client and server.

[0096] Figure 3 A flowchart illustrating a traffic detection test method provided in an embodiment of this application is shown below. Figure 3 As shown, the test results for analyzing and obtaining intrusion detection rules based on the interaction traffic include:

[0097] S301. Modify the address information of data packets in the interactive traffic using a preset tool to obtain simulated traffic.

[0098] The attack traffic simulation platform uses a preset tool (such as tcprewrite) to modify the IP address of data packets in the interactive traffic, and then exports and stores the final simulated traffic.

[0099] S302. Monitor simulated traffic and generate alarm information by setting up intrusion detection rules.

[0100] Preset intrusion detection rules can be Snort rules or Snort-like rules (Suricata). The intrusion detection system monitors attack traffic through the preset intrusion detection rules, simulating the platform's network interface card or receiving replayed traffic through the aforementioned packet collector, and generates alarm information. It should be noted that since the interactive traffic is generated in real time, the intrusion detection system can directly monitor it, while replayed traffic records previous interactive traffic for reproduction.

[0101] S303. Based on alarm information and simulated traffic, analyze and obtain the test results of intrusion detection rules.

[0102] Based on the alarm information and simulated traffic mentioned above, the final test results of the preset intrusion detection rules can be obtained by comparing the alarm information and simulated traffic.

[0103] In this embodiment, the test results of the intrusion detection rules can be obtained by comparing the acquired simulated traffic with the alarm information generated by the intrusion detection system. This overcomes the problems of insufficient information to simulate the actual environment or excessive time cost required for simulation when the rules are known. It also allows for batch and rapid verification of the matching and log reporting functions of the intrusion detection engine.

[0104] Figure 4 A flowchart illustrating a traffic detection test method provided in an embodiment of this application is shown below. Figure 4 As shown, based on alarm information and simulated traffic, the test results for obtaining intrusion detection rules are analyzed, including:

[0105] S401. Compare alarm information with the rule information used by simulated traffic.

[0106] Compare the alarm information with the rule information used in the generated simulated traffic.

[0107] S402. If the rule information used is consistent with the preset intrusion detection rule, then the test result shows that the preset intrusion detection rule can be hit.

[0108] If the rule information used by the generated simulated traffic is consistent with the alarm information of the intrusion detection system, it means that the generated simulated traffic can hit the characteristics of the preset intrusion detection rules.

[0109] In this embodiment, by comparing alarm information and rule information used by simulated traffic, the test results of intrusion detection rules are obtained, which makes up for the shortcomings of known rules, such as the inability to simulate the actual environment due to missing information or the excessive time cost required for simulation.

[0110] Figure 5 This is a schematic diagram of the structure of a flow detection testing device provided in an embodiment of this application, as shown below. Figure 5 As shown, the device 500 includes: a parsing module 501, a generation module 502, a sending module 503, and an analysis module 504. Wherein:

[0111] Parsing module 501 is used to parse preset intrusion detection rules and obtain attack parameters. The attack parameters include one or more of the following: network 5-tuple information, flow information, load and keyword information.

[0112] The generation module 502 is used to generate attack simulation instructions based on the attack parameters;

[0113] The sending module 503 is used to send attack simulation commands to the client and the server respectively, in order to listen for and obtain interactive traffic;

[0114] Analysis module 504 is used to analyze and obtain the test results of the intrusion detection rules based on the interaction traffic.

[0115] In one optional implementation, the generation module 502 is specifically used to convert network 5-tuple information into preset protocol and port information; convert flow information into request or response information; convert load and keyword information into data packets; and combine the preset protocol and port information, request or response information, and the data packets to generate attack simulation instructions.

[0116] In one optional implementation, the generation module 502 is specifically used to fill the two payloads with random characters of the length corresponding to the offset if there is a connection statement and a corresponding offset between the contents of any two payloads, and obtain the filled payload content; and convert and obtain a data packet based on the filled payload content.

[0117] In one optional implementation, the attack parameters further include: a regular expression; the generation module 502 is specifically used to convert the payload and keyword information and the regular expression into data packets.

[0118] In one alternative implementation, the sending module 503 is specifically used to distribute the attack simulation command to the path where the client or server is located based on the flow direction in the flow information.

[0119] In one optional implementation, the analysis module 504 is specifically used to modify the address information of the interactive traffic using a preset tool to obtain simulated traffic; to monitor the simulated traffic through preset intrusion detection rules and generate alarm information; and to analyze and obtain the test results of the intrusion detection rules based on the alarm information and the simulated traffic.

[0120] In one optional implementation, the analysis module 504 is specifically used to compare the alarm information with the rule information used by the simulated traffic; if the alarm information and the rule information used by the simulated traffic are consistent, the test result indicates that the preset intrusion detection rule can be hit.

[0121] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0122] Figure 6This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, such as... Figure 6 As shown, the electronic device 600 includes: a processor 601, a storage medium 602, and a bus 603.

[0123] Storage medium 602 stores machine-readable instructions executable by processor 601. When the electronic device is running, processor 601 communicates with storage medium 602 via bus 603, and processor 601 executes the machine-readable instructions to perform the steps of the above method embodiments. The specific implementation and technical effects are similar and will not be described again here.

[0124] The storage medium 602, processor 601, and bus 603 are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines. The mobile storage device includes at least one software function module that can be stored in the storage medium 602 in the form of software or firmware or embedded in the operating system (OS) of the electronic device. The processor 601 is used to execute executable modules stored in the storage medium 602, such as software function modules and computer programs included in the secure processing method of the mobile storage medium.

[0125] The storage medium 602 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), etc.

[0126] Optionally, this application also provides a storage medium storing a computer program, which, when run by a processor, executes the steps of the traffic detection test method in the above embodiments. The specific implementation and technical effects are similar and will not be repeated here.

[0127] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0128] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0129] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0130] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0131] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A test method for flow detection, characterized in that, The method, applied to an attack traffic simulation platform, includes: Parse the preset intrusion detection rules to obtain attack parameters, which include one or more of the following: network 5-tuple information, flow information, load and keyword information; Based on the attack parameters, generate attack simulation instructions; The attack simulation commands are sent to the client and server respectively to monitor and obtain the interaction traffic; Based on the interaction traffic, analyze and obtain the test results of the intrusion detection rules; Sending the attack simulation commands to the client and server respectively includes: Based on the flow direction in the flow information, the attack simulation command is assigned to the path where the client or the server is located; When the flow direction in the flow information is from the client to the server, the client encapsulates a data packet and sends a request to the server; when the flow direction in the flow information is from the server to the client, the client sends a request, and the server responds with a data packet content concatenated according to the preset intrusion detection rules. The content in the request sent by the client is randomly generated. The step of analyzing and obtaining the test results of the intrusion detection rules based on the interaction traffic includes: The address information of data packets in the interactive traffic is modified using a preset tool to obtain simulated traffic; The simulated traffic is monitored using the preset intrusion detection rules, and alarm information is generated. Based on the alarm information and the simulated traffic, analyze and obtain the test results of the intrusion detection rules; The step of analyzing and obtaining the test results of the intrusion detection rules based on the alarm information and the simulated traffic includes: Compare the alarm information with the rule information used by the simulated traffic; If the alarm information and the rule information used by the simulated traffic are consistent, then the test result shows that the preset intrusion detection rule can be hit.

2. The method according to claim 1, characterized in that, The step of generating attack simulation instructions based on the attack parameters includes: The network quintuple information is converted into preset protocol and port information; Convert the stream information into request or response information; Convert the payload and keyword information into data packets; Attack simulation instructions are generated by combining the preset protocol and port information, the request or response information, and the data packets.

3. The method according to claim 2, characterized in that, The step of converting the payload and keyword information into a data packet includes: If there is a connection statement and a corresponding offset between any two contents of the load, then fill the two loads with random characters of the length corresponding to the offset, and obtain the filled load content; Based on the filled payload content, the data packet is converted and obtained.

4. The method according to claim 2 or 3, characterized in that, The attack parameters also include: regular expressions; The step of converting the payload and keyword information into a data packet includes: The payload and keyword information, along with the regular expression, are converted into a data packet.

5. A flow rate detection testing device, characterized in that, include: The parsing module is used to parse preset intrusion detection rules and obtain attack parameters, which include one or more of the following: network 5-tuple information, flow information, load and keyword information; The generation module is used to generate attack simulation instructions based on the attack parameters; The sending module is used to send the attack simulation commands to the client and the server respectively, in order to listen for and obtain the interaction traffic; An analysis module is used to analyze and obtain the test results of the intrusion detection rules based on the interaction traffic; The sending module is specifically used to distribute the attack simulation command to the path where the client or server is located according to the flow direction in the flow information; When the flow direction in the flow information is from the client to the server, the client encapsulates a data packet and sends a request to the server; when the flow direction in the flow information is from the server to the client, the client sends a request, and the server responds with a data packet content concatenated according to the preset intrusion detection rules. The content in the request sent by the client is randomly generated. The analysis module is specifically used to modify the address information of data packets in the interactive traffic using a preset tool to obtain simulated traffic; The simulated traffic is monitored using the preset intrusion detection rules, and alarm information is generated. Based on the alarm information and the simulated traffic, analyze and obtain the test results of the intrusion detection rules; The analysis module is specifically used to compare the alarm information with the rule information used by the simulated traffic; if the alarm information and the rule information used by the simulated traffic are consistent, the test result indicates that the preset intrusion detection rule can be hit.

6. An electronic device, characterized in that, The electronic device includes a processor, a storage medium, and a bus. The storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of the flow detection test method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the test method for traffic detection as described in any one of claims 1-4.

Images