A method, device, equipment and medium for determining a network attack target

Abstract

The application provides a network attack target range determination method, device, equipment and medium, the method comprises the following steps: in response to the received attack deduction request, obtaining the attacker host information, the attacked host information and the attack tool input by the user; obtaining the attack rule corresponding to the attack tool from the database; the attacker host information corresponding to the attacker host carries out network attack on the attacked host information corresponding to the attacked host according to the attack rule, and obtains the attack determination result. The attack rule of the application is stored in the data or the corresponding rule file is generated, the attack rule and the attack business of the deduction target range engine are separated, the attack rule is added or modified, the determination logic code does not need to be recompiled, the storage burden of the deduction target range engine is reduced, when the attack deduction is carried out, the corresponding attack rule can be directly extracted from the database by the deduction target range engine, and the flexibility of data processing is improved.

Description

Technical Field

[0001] This invention relates to the field of network attack and defense security, and in particular to a method, apparatus, equipment and medium for determining network attack ranges. Background Technology

[0002] In a network attack simulation range, the simulation range engine is a tool for performing network attack simulations. Its function is to determine the input parameters to obtain the simulation results of the network attack. Currently, the input parameters of the simulation range engine include the attack rules of the attack tools. Since the attack tools are variables, their corresponding order of magnitude increases with changes in attack requirements. As the number of attack tools increases, the number of attack rules that need to be stored in the traditional simulation range engine also increases. Moreover, every time an attack tool is added, a corresponding attack rule needs to be added to the simulation range engine. When the attack rules are modified according to actual needs, the corresponding determination logic code in the simulation range engine also needs to be modified accordingly. Therefore, the determination method of the traditional simulation range engine has poor application flexibility, and with the increase in the number of simulations and the number of attack tools, the order of magnitude of storage in the simulation range engine will increase, leading to a decrease in its data processing performance. Summary of the Invention

[0003] In view of this, the present invention provides a method, apparatus, device, and medium for determining network attack ranges, which at least partially solves the technical problem of poor application flexibility in the determination methods of existing simulation range engines. The technical solution adopted by the present invention is as follows:

[0004] According to one aspect of this application, a method for determining a network attack range is provided, comprising:

[0005] In response to a received attack simulation request, obtain the attacker's host information, the victim's host information, and the attack tools input by the user;

[0006] Retrieve the attack rules corresponding to the attack tools from the preset database;

[0007] The attacker's host, corresponding to the attacker's host information, performs a network attack on the victim's host, corresponding to the victim's host information, according to the attack rules and using the attack tools, and obtains the attack determination result.

[0008] In one exemplary embodiment of this application, the attacker's host, corresponding to the attacker's host information, performs a network attack on the victim's host, corresponding to the victim's host information, according to attack rules and using an attack tool, to obtain an attack determination result, including:

[0009] Based on the attacker's host information and the victim's host information, access verification is performed on the victim's host corresponding to the victim's host information to obtain the access verification result;

[0010] Based on the access verification results and attack rules, the attacker's host, corresponding to the attacker's host information, launches a network attack on the victim's host, thus obtaining the attack determination result.

[0011] In one exemplary embodiment of this application, based on attacker host information and victim host information, access verification is performed on the victim host corresponding to the victim host information to obtain an access verification result, including:

[0012] Perform access verification on the attacked host corresponding to the attacked host information;

[0013] If the victim host address node corresponding to the victim host information is the same as the attacker host address node corresponding to the attacker host information, then the corresponding access verification result is successful access verification.

[0014] If the victim host address node corresponding to the victim host information is different from the attacker host address node corresponding to the attacker host information, then subnet verification is performed to obtain the corresponding access verification result.

[0015] In one exemplary embodiment of this application, if the victim host address node corresponding to the victim host information is different from the attacker host address node corresponding to the attacker host information, subnet verification is performed to obtain the corresponding access verification result, including:

[0016] If the victim's host address node is different from the attacker's host address node, then verify whether the victim's host address node and the attacker's host address node are in the same network subnet;

[0017] If the attacked host address node and the attacker host address node are in the same network subnet, the corresponding access verification result is successful; otherwise, the corresponding access verification result is unsuccessful.

[0018] In one exemplary embodiment of this application, based on the access verification result and attack rules, the attacker's host corresponding to the attacker's host information launches a network attack on the attacked host, and an attack determination result is obtained, including:

[0019] If the access verification result is successful, the attack rules are parsed to obtain the corresponding attack constraint policy.

[0020] Retrieve a list of all attributes of the attacked host address node from the database;

[0021] The attack determination result is obtained by comparing the list of all attributes of the host address node to the attack constraint policy.

[0022] In one exemplary embodiment of this application, a list of all attributes of the attacked host address node is compared with the attack constraint policy to obtain an attack determination result, including:

[0023] If all attributes in the attribute list of the attacked host address node satisfy the attack constraint policy, the attack is considered successful; otherwise, the attack is considered unsuccessful.

[0024] In one exemplary embodiment of this application, based on the access verification result and attack rules, the attacker's host corresponding to the attacker's host information is made to launch a network attack on the attacked host to obtain an attack determination result, which further includes:

[0025] If the access verification result is "access verification failed", then the attack failure will be determined as the attack judgment result.

[0026] According to one aspect of this application, a device for determining a network attack range is provided, comprising:

[0027] The request and response module is used to respond to received attack simulation requests and obtain attacker host information, victim host information and attack tools input by the user.

[0028] The rule acquisition module is used to retrieve the attack rules corresponding to the attack tools from a preset database;

[0029] The result determination module is used to determine the attack result by having the attacker host corresponding to the attacker host information launch a network attack on the victim host corresponding to the victim host information using attack tools according to the attack rules.

[0030] According to one aspect of this application, a non-transitory computer-readable storage medium is provided, wherein the storage medium stores at least one instruction or at least one program segment, the at least one instruction or the at least one program segment being loaded and executed by a processor to implement the method for determining the network attack range.

[0031] According to one aspect of this application, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0032] The present invention has at least the following beneficial effects:

[0033] This invention extracts attack rules from a database, enabling attackers to launch network attacks against victims based on these rules, thus obtaining attack judgment results. Attack rules are stored in the database or generated into corresponding rule files. By separating the attack rules from the attack operations of the simulation engine, it achieves immediate modification and use. When adding or modifying attack rules, only the corresponding judgment logic code in the database or the corresponding rule file needs to be modified, without recompiling the judgment logic code, reducing the storage burden on the simulation engine. When performing attack simulations, the simulation engine can directly extract the corresponding attack rules from the database, improving the flexibility of data processing. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 A flowchart illustrating the method for determining a network attack target range provided in an embodiment of the present invention;

[0036] Figure 2 A block diagram of a network attack range determination device provided in an embodiment of the present invention. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] The simulation range engine judges the input parameters to obtain the corresponding judgment results, which can be used as the attack result of the network attack or as the judgment result of the entry condition for the next step in the network attack. The parameters input to the simulation range engine include the attack rules of the attack tools. The attack tools are the equipment in the simulation range engine, and their corresponding attack rules are the equipment rules in the simulation range engine. To simulate network attack states, attack tools are used to carry out network attacks by attackers against the attacked network. The judgment logic code corresponding to the attack tools is the corresponding attack rule. As the number of attack simulations in the simulation range engine increases, the number of types of attack tools used will also increase, and the number of corresponding attack rules will also increase. In traditional network attack range judgment methods, the attack rules used are stored in the simulation range engine. As the number of attack rules stored in the simulation range engine increases, the simulation range engine will become bloated, leading to a decrease in its data processing performance. Moreover, when the attack rules in the simulation range engine are modified according to actual needs, the corresponding judgment logic code in the simulation range engine must also be modified. Traditional simulation range engines integrate attack business and attack rules into themselves, which is not very flexible. Therefore, it is necessary to propose a network attack range judgment method that can flexibly extract the corresponding attack rules according to different attack needs.

[0039] A method for determining a network attack range, such as Figure 1 As shown, it includes:

[0040] Step S100: In response to the received attack simulation request, obtain the attacker's host information, the victim's host information, and the attack tools input by the user.

[0041] The aforementioned method for determining the network attack range is applied in the simulation range engine. When the simulation range engine receives an attack simulation request, it obtains the attacker's host information, the victim's host information, and the attack tools corresponding to the user's input of the attack simulation request. The attacker's host information is the attacker's host information during the attack simulation process, including the corresponding IP address node, etc. The victim's host information is the victim's host information during the attack simulation process, that is, the target host information, including the target host's IP address node, etc. The attack tools are the tools used to carry out network attacks. They can be information gathering tools or network attack tools. The attack tools have corresponding service functions. The simulation range engine uses the attack tools to carry out network attacks targeting the victim's host.

[0042] Step S200: Obtain the attack rules corresponding to the attack tool from the preset database;

[0043] Different types of attack tools correspond to different attack rules. Attack rules are the decision-making logic code of an attack tool, used to specify the attack method, attack scope, attack medium, node conditions, etc., and can be divided into general rules, node rules, and node effects. Node rules can be further subdivided into starting node rules and target node rules. Attack rules are stored in the database or generated into corresponding rule files. By separating attack rules from the attack business of the simulation range engine, they can be modified and used immediately. When adding or modifying attack rules, only the decision-making logic code in the corresponding database or the corresponding rule file needs to be modified, without recompiling the decision-making logic code, reducing the storage burden on the simulation range engine. When performing attack simulations, the simulation range engine can directly retrieve the corresponding attack rules from the database, improving the flexibility of data processing.

[0044] Step S300: The attacker host corresponding to the attacker host information performs a network attack on the victim host corresponding to the victim host information according to the attack rules and through the attack tool, and obtains the attack judgment result.

[0045] Further, in step S300, the attacker host corresponding to the attacker host information performs a network attack on the victim host corresponding to the victim host information according to the attack rules and using an attack tool, thereby obtaining an attack determination result, including:

[0046] Step S310: Based on the attacker's host information and the victim's host information, perform access verification on the victim's host corresponding to the victim's host information to obtain the access verification result.

[0047] Step S320: Based on the access verification result and the attack rules, the attacker host corresponding to the attacker host information is made to launch a network attack on the attacked host, and the attack judgment result is obtained.

[0048] Access verification, or accessibility determination, is used to verify whether the attacked host can be accessed. If it can be accessed, the next attack step is performed; otherwise, the attack determination method is terminated.

[0049] Specifically, in step S310, based on the attacker's host information and the victim's host information, access verification is performed on the victim's host corresponding to the victim's host information to obtain the access verification result, including:

[0050] Step S311: Perform access verification on the host corresponding to the attacked host information;

[0051] Step S312: If the address node of the attacked host corresponding to the attacked host information is the same as the address node of the attacker corresponding to the attacker host information, then the corresponding access verification result is successful access verification.

[0052] If the address node of the attacked host is the same as that of the attacker host, it means that the attacked host and the attacker host are local hosts, and the attacker host can be accessed by the attacked host. The corresponding access verification result is successful access verification.

[0053] Step S313: If the victim host address node corresponding to the victim host information is different from the attacker host address node corresponding to the attacker host information, then perform subnet verification to obtain the corresponding access verification result.

[0054] If the victim's host address node is different from the attacker's host address node, subnet verification is required to determine whether the victim's host and the attacker's host are in the same subnet, domain table, or subtable.

[0055] Specifically, in step S313, if the victim host address node corresponding to the victim host information is different from the attacker host address node corresponding to the attacker host information, then subnet verification is performed to obtain the corresponding access verification result, including:

[0056] Step S3131: If the victim's host address node is different from the attacker's host address node, then verify whether the victim's host address node and the attacker's host address node are in the same network subnet.

[0057] Step S3132: If the attacked host address node and the attacker host address node are in the same network subnet, the corresponding access verification result is successful; otherwise, the corresponding access verification result is unsuccessful.

[0058] Subnet verification first determines the accessibility type of the attacked host, then matches whether the attacked host address node and the attacker host address node are in the same subnet or domain. The subnet matches all network configuration IDs and queries the subnet, domain table, and sub-table. If they exist in the same subnet or domain, the corresponding access verification result is successful; otherwise, the access verification fails.

[0059] Specifically, in step S320, based on the access verification result and the attack rules, the attacker's host corresponding to the attacker's host information is instructed to launch a network attack against the attacked host, resulting in an attack determination result, including:

[0060] Step S321: If the access verification result is successful, then the attack rules are parsed to obtain the corresponding attack constraint policy.

[0061] Step S322: Obtain a list of all attributes of the attacked host address node from the database;

[0062] Step S323: Compare the list of all attributes of the host address node to be attacked with the attack constraint policy to obtain the attack determination result;

[0063] Step S324: If the access verification result is access verification failure, then the attack failure is determined as the attack judgment result.

[0064] Specifically, in step S323, the list of all attributes of the attacked host address node is compared with the attack constraint policy to obtain the attack determination result, including:

[0065] Step S3231: If all attributes in the attribute list of the attacked host address node satisfy the attack constraint policy, then the attack is determined to be successful; otherwise, the attack is determined to be unsuccessful.

[0066] The attack determination result is the result of determining the applicability of the attack rules to the attacked host. Applicability determination refers to the method of determining whether the tool can be executed and achieve the corresponding effect based on the rules of the node and the tool. The rule parser is used to parse the attack rules of the attack tool on the attacked host address node into a single constraint. Based on the selected attacked host address node, the database is used to extract the list of all attributes of the attacked host address node. The series of attribute values ​​in the attack rules are compared with the attribute values ​​existing in the attacked host address node to obtain the corresponding attack determination result. The determination result and the corresponding log file are then output.

[0067] A network attack range determination device 100, such as Figure 2 As shown, it includes:

[0068] The request and response module 110 is used to respond to the received attack simulation request and obtain the attacker's host information, the attacked host information, and the attack tools input by the user.

[0069] The rule acquisition module 120 is used to acquire the attack rules corresponding to the attack tools from a preset database;

[0070] The result determination module 130 is used to determine the attack result by having the attacker host corresponding to the attacker host information launch a network attack on the victim host corresponding to the victim host information using attack tools according to the attack rules.

[0071] The result determination module 130 is also used for:

[0072] Perform access verification on the attacked host corresponding to the attacked host information;

[0073] If the victim host address node corresponding to the victim host information is the same as the attacker host address node corresponding to the attacker host information, then the corresponding access verification result is successful access verification.

[0074] If the victim's host address node is different from the attacker's host address node, then verify whether the victim's host address node and the attacker's host address node are in the same network subnet;

[0075] If the attacked host address node and the attacker host address node are in the same network subnet, the corresponding access verification result is successful; otherwise, the corresponding access verification result is unsuccessful.

[0076] If the access verification result is successful, the attack rules are parsed to obtain the corresponding attack constraint policy.

[0077] Retrieve a list of all attributes of the attacked host address node from the database;

[0078] If all attributes in the attribute list of the attacked host address node satisfy the attack constraint policy, the attack is considered successful; otherwise, the attack is considered unsuccessful.

[0079] If the access verification result is "access verification failed", then the attack failure will be determined as the attack judgment result.

[0080] Embodiments of the present invention also provide a computer program product including program code, which, when the program product is run on an electronic device, causes the electronic device to perform the steps of the methods described above in various exemplary embodiments of the present invention.

[0081] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0082] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0083] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0084] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely hardware implementations, entirely software implementations (including firmware, microcode, etc.), or implementations combining hardware and software aspects, collectively referred to herein as “circuits,” “modules,” or “systems.”

[0085] An electronic device according to this embodiment of the invention. The electronic device is merely an example and should not be construed as limiting the functionality or scope of the embodiments of the invention.

[0086] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).

[0087] The storage device stores program code that can be executed by the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of the present invention.

[0088] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0089] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0090] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.

[0091] The electronic device can also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). This communication can be achieved through input / output (I / O) interfaces. Furthermore, the electronic device can communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter. As shown in the figure, the network adapter communicates with other modules of the electronic device via a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0092] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0093] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.

[0094] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0095] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0096] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0097] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0098] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0099] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0100] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for determining a network attack range, characterized in that, include: In response to a received attack simulation request, obtain the attacker's host information, the victim's host information, and the attack tools input by the user; Retrieve the attack rules corresponding to the attack tool from a preset database; The attacker host corresponding to the attacker host information performs a network attack on the victim host corresponding to the victim host information according to the attack rules and the attack tool, and obtains the attack determination result. Specifically, the attacker host corresponding to the attacker host information performs a network attack on the victim host corresponding to the victim host information according to the attack rules and through the attack tool, and obtains an attack determination result, including: Based on the attacker's host information and the victim's host information, access verification is performed on the victim's host corresponding to the victim's host information to obtain the access verification result; Based on the access verification result and the attack rules, the attacker host corresponding to the attacker host information is made to launch a network attack on the attacked host, and an attack determination result is obtained. Specifically, based on the attacker's host information and the attacked host information, access verification is performed on the attacked host corresponding to the attacked host information to obtain the access verification result, including: Perform access verification on the attacked host corresponding to the attacked host information; If the victim host address node corresponding to the victim host information is the same as the attacker host address node corresponding to the attacker host information, then the corresponding access verification result is successful access verification. If the victim host address node corresponding to the victim host information is different from the attacker host address node corresponding to the attacker host information, then subnet verification is performed to obtain the corresponding access verification result.

2. The method according to claim 1, characterized in that, If the victim host address node corresponding to the victim host information is different from the attacker host address node corresponding to the attacker host information, then subnet verification is performed to obtain the corresponding access verification result, including: If the victim host address node is different from the attacker host address node, then verify whether the victim host address node and the attacker host address node are in the same network subnet; If the attacked host address node and the attacker host address node are in the same network subnet, the corresponding access verification result is successful; otherwise, the corresponding access verification result is unsuccessful.

3. The method according to claim 2, characterized in that, Based on the access verification result and the attack rules, the attacker host corresponding to the attacker host information is instructed to launch a network attack on the attacked host, resulting in an attack determination result, including: If the access verification result is successful, the attack rules are parsed to obtain the corresponding attack constraint strategy. Retrieve a list of all attributes of the attacked host address node from the database; The attack determination result is obtained by comparing the list of all attributes of the attacked host address node with the attack constraint policy.

4. The method according to claim 3, characterized in that, The attack determination result is obtained by comparing the list of all attributes of the attacked host address node with the attack constraint policy, including: If all attributes in the attribute list of the attacked host address node satisfy the attack constraint policy, the attack is determined to be successful; otherwise, the attack is determined to be unsuccessful.

5. The method according to claim 4, characterized in that, Based on the access verification result and the attack rules, the attacker host corresponding to the attacker host information is instructed to launch a network attack on the attacked host to obtain an attack determination result, which further includes: If the access verification result is access verification failure, then the attack failure is determined as the attack judgment result.

6. A device for determining a network attack range, characterized in that, include: The request and response module is used to respond to received attack simulation requests and obtain attacker host information, victim host information and attack tools input by the user. The rule acquisition module is used to retrieve the attack rules corresponding to the attack tools from a preset database; The result determination module is used to determine the attack result by having the attacker host corresponding to the attacker host information perform a network attack on the victim host corresponding to the victim host information according to the attack rules and the attack tools. Wherein, the attacker host corresponding to the attacker host information, according to the attack rules, uses the attack tool to launch a network attack on the victim host corresponding to the victim host information, and obtains an attack determination result, including: Based on the attacker's host information and the victim's host information, access verification is performed on the victim's host corresponding to the victim's host information to obtain the access verification result; Based on the access verification result and the attack rules, the attacker host corresponding to the attacker host information is made to launch a network attack on the attacked host, and an attack determination result is obtained. Specifically, based on the attacker's host information and the attacked host information, access verification is performed on the attacked host corresponding to the attacked host information to obtain the access verification result, including: Perform access verification on the attacked host corresponding to the attacked host information; If the victim host address node corresponding to the victim host information is the same as the attacker host address node corresponding to the attacker host information, then the corresponding access verification result is successful access verification. If the victim host address node corresponding to the victim host information is different from the attacker host address node corresponding to the attacker host information, then subnet verification is performed to obtain the corresponding access verification result.

7. A non-transitory computer-readable storage medium, wherein the storage medium stores at least one instruction or at least one program segment, characterized in that, The at least one instruction or the at least one program segment is loaded and executed by the processor to implement the method as described in any one of claims 1-5.

8. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 7.

Images