Network target range data management method, device and equipment and readable storage medium

Abstract

The application discloses a network target range data management method, device and equipment and a readable storage medium. The method comprises the following steps: obtaining attribute data of attack and defense tools used by both attack and defense sides in a network target range; performing classification processing on the attack and defense tools and the attribute data to obtain a classification result; inputting the classification result into a preset metadata model, so that the metadata model generates a metadata structure with a unified format according to the classification result, performs format unification processing on the attribute data, and fills the attribute data into the corresponding metadata structure; and the preset metadata model is a metadata model for analyzing and managing the attack and defense tools and the attribute data, which is constructed according to a preset mapping rule. The application realizes classification of the attack and defense tools used in the network target range and corresponding attribute data, and inputting the attack and defense tools and the attribute data into the metadata model for unified processing and management, thereby improving the efficiency of managing the network target range data.

Description

Technical Field

[0001] This application relates to the field of network range data management technology, and in particular to a network range data management method, apparatus, device and readable storage medium. Background Technology

[0002] Large-scale, realistic network environment simulations of federated ranges have become a major development trend in network range technology worldwide. In red-team / blue-team attack-defense competitions based on federated ranges, the red team attackers need to continuously collect target information, analyze assets and vulnerabilities using resources and tools, and penetrate defenses from both the front and the sides until they compromise the target. Conversely, the blue team defenders need to use tools in advance to assess, strengthen, and consolidate assets, and conduct threat prediction and blocking of source addresses and the discovery of compromised hosts throughout the process to achieve effective defense.

[0003] For a long time, due to the complex origins of various attack and defense tools and the chaotic and disorganized information such as operating platforms and operating environments, users of various attack and defense tools have had to spend a lot of time and energy to organize and classify various attack and defense tools.

[0004] However, due to the emergence of new system software platforms and attack methods, the chaotic and disorganized data information of various attack and defense tools, and the complexity of the data information of various tools, there is still a lot of complicated content after sorting out the data information of various attack and defense tools. As a result, when managing or calling attack and defense tools in a unified manner, it is necessary to screen and select the required content from the complicated content, which leads to low efficiency in managing various attack and defense tools. Summary of the Invention

[0005] In view of this, this application provides a network range data management method, apparatus, device and readable storage medium, aiming to improve the management efficiency of various attack and defense tools.

[0006] To achieve the above objectives, this application provides a network range data management method, which includes the following steps: Obtain the attribute data of the attack and defense tools used by both sides in the network test range and the attack and defense tools themselves; The offensive and defensive tools and the attribute data are classified to obtain classification results; Input the classification result into a preset metadata model so that the metadata model can generate a unified metadata structure based on the classification result, perform format unification processing on the attribute data, and populate it into the corresponding metadata structure; The preset metadata model is a metadata model constructed according to preset mapping rules to analyze and manage the attack and defense tools and the attribute data.

[0007] For example, the step of classifying the attack and defense tools and the attribute data to obtain classification results includes: Based on the type information of the attack and defense tools, determine the attack tools corresponding to the attacker in the network range, and determine the defense tools corresponding to the defender in the network range; Determine the attack function of the attack tool and the defense function of the defense tool; Based on the attack function and the defense function, the attack and defense tools and the attribute data are classified to obtain the classification result.

[0008] For example, the classification result includes a first classification result corresponding to the attack tool and a second classification result corresponding to the defense tool. The step of classifying the attack and defense tools and the attribute data according to the attack function and the defense function to obtain the classification result includes: Obtain the execution data of the attack tool when it performs the corresponding attack function; Based on the execution data, the attack intent, attack route, attack characteristics, and attack orientation of the attack function are determined; Based on the attack intent, attack route, attack characteristics, and attack orientation, the attack tools and corresponding attribute data are classified according to attack levels to obtain a first classification result; Determine the defensive location to which the defensive function is applied, and determine the corresponding defensive measures for the defensive function at different defensive locations; Based on the aforementioned defense methods, the defense tools and corresponding attribute data are classified according to their defense content to obtain a second classification result.

[0009] For example, the step of determining the attack functionality of the attack tool includes: If the attack tool is a basic attack tool, then the attack function of the basic attack tool is determined; If the attack tool is a complex attack tool composed of multiple basic attack tools, then each basic attack tool in the complex attack tool is identified, and the attack function of each basic attack tool is determined respectively.

[0010] For example, the step of inputting the classification result into a preset metadata model includes: The attribute data in the classification results are transformed to obtain a metadata object; Metadata governance is performed on the metadata object to remove abnormal content, and the governance result is obtained; Input the governance results into the preset metadata model.

[0011] For example, the step of transforming the attribute data in the classification result to obtain a metadata object includes: The attribute data in the classification results are transformed to obtain a metadata file describing the characteristics of the attack and defense tools; The metadata file is parsed to obtain a metadata object consisting of the metadata corresponding to the attribute data and the attribute information corresponding to the metadata.

[0012] For example, after the step of inputting the classification result into the preset metadata model, the following steps are included: Determine the data processing rules when the classification results are input into the metadata model; According to the data processing rules, the attack and defense tools and the attribute data are stored in a classified storage manner.

[0013] For example, to achieve the above objectives, this application also provides a network range data management device, the device comprising: The acquisition module is used to acquire the attack and defense tools used by both sides in the network test range and the attribute data of the attack and defense tools. The classification module is used to classify the attack and defense tools and the attribute data to obtain classification results; The input module is used to input the classification results into a preset metadata model, so that the metadata model can generate a unified metadata structure based on the classification results, perform format unification processing on the attribute data, and populate it into the corresponding metadata structure; wherein, the preset metadata model is a metadata model constructed according to preset mapping rules to analyze and manage the attack and defense tools and the attribute data.

[0014] For example, to achieve the above objectives, this application also provides a network range data management device, the device comprising: a memory, a processor, and a network range data management program stored in the memory and executable on the processor, the network range data management program being configured to implement the steps of the network range data management method as described above.

[0015] For example, to achieve the above objectives, this application also provides a computer-readable storage medium storing a network range data management program, which, when executed by a processor, implements the steps of the network range data management method described above.

[0016] Compared to related technologies where the data information of various attack and defense tools is messy and disordered, and the data information of various tools is complex, resulting in low efficiency in managing various attack and defense tools, this application obtains the attribute data of the attack and defense tools used by both sides in the network test range and the attack and defense tools; classifies the attack and defense tools and the attribute data to obtain classification results; inputs the classification results into a preset metadata model, so that the metadata model can generate a unified metadata structure based on the classification results, perform unified format processing on the attribute data, and fill it into the corresponding metadata structure; wherein, the preset metadata model is a metadata model for analyzing and managing the attack and defense tools and the attribute data constructed according to preset mapping rules. This involves acquiring attack and defense tools and their corresponding attribute data, classifying this data, and then organizing the attack and defense tools and their related attribute data. The organized classification results are then input into the metadata model, which generates a unified metadata structure based on the classification results and populates the attribute data into the corresponding metadata structure. This unifies and hierarchizes the data stored in the metadata model, avoiding the situation where the management efficiency of attack and defense tools and their related data is low due to too many types of attack and defense tools and messy data information. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the first embodiment of the network range data management method of this application; Figure 2 This is a schematic diagram illustrating the metadata attributes of the red-side attack resource in this application; Figure 3 This is a schematic diagram of the metadata attributes of the blue side's defense resources in this application; Figure 4 This is a schematic diagram of the network range data management architecture of this application; Figure 5 This is a flowchart illustrating the second embodiment of the network range data management method of this application; Figure 6 This is a flowchart illustrating the third embodiment of the network range data management method of this application; Figure 7 This is a schematic diagram of the hardware operating environment involved in the embodiments of this application.

[0018] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0020] This application provides a method for managing network range data, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the network range data management method of this application.

[0021] This application provides an embodiment of a network range data management method. It should be noted that although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order. For ease of description, the execution entities describing the various steps of the network range data management method are omitted below. The network range data management method includes: Step S110: Obtain the attribute data of the attack and defense tools used by both sides in the network target range and the attack and defense tools; Network ranges include online network attack and defense learning environments, network security competition platforms, network security technology testing and research platforms, and other technologies or products based on virtualization technology that simulate and reproduce the operational status and operating environment of network architecture, system equipment, and business processes in real cyberspace.

[0022] Based on the platform type, network ranges can be divided into ordinary ranges and federated ranges. A federated range is formed by multiple platforms belonging to different regions or locations, and a federated master controller manages the access and disconnection of each platform. Large-scale, realistic network environment simulations in federated ranges have become a major development trend in network range technology worldwide.

[0023] In particular, in the red-blue team offensive and defensive competition based on a federal target range, the red team attackers need to continuously collect target information, analyze assets and weaknesses using resource tools, and break through the defense from the front and sides until they capture the target. Conversely, the blue team defenders need to use tools in advance to sort out, reinforce, and consolidate assets, and conduct threat prediction and blocking of source IPs and the discovery of compromised hosts throughout the process to achieve a good defensive effect.

[0024] In this scenario, the red and blue teams represent the two sides conducting attack and defense drills within the network range, with the red team being the attackers and the blue team the defenders.

[0025] However, due to the continuous expansion of the federal test range and the complex origins of various offensive and defensive tools, as well as the chaotic and disordered information regarding their operating platforms and environments, the situation remains challenging.

[0026] In response to the above situation, this application proposes a network range data management method to organize and manage the messy and disordered red and blue team data, so as to facilitate the red and blue team players in selecting appropriate offensive and defensive tools.

[0027] Among them, attack and defense tools refer to the relevant network range tools used by the attacker and the defender, such as vulnerability exploitation, password cracking, attacking viruses or firewall defenses, endpoint antivirus and other attack and defense tools.

[0028] Among them, attack and defense tools generally have corresponding attributes or description files. For example, taking firewall defense tools as an example, firewall defense tools are usually used as perimeter defenses, serving as the first line of defense against external intrusions. They are mainly used to block untrusted external information from accessing the network and protect user information. The deployment location and deployment effect of the firewall defense tool are all attribute data of the tool.

[0029] In addition, attribute data also includes the recorded data of tools in various knowledge-based databases. For example, a knowledge-based database can be built, which stores attack and defense tool data and corresponding attribute data or descriptive files and data. This data can serve as the tag content for the attack and defense tool, allowing users to understand the attribute characteristics and uses of the corresponding tool through the tag content. In other words, the knowledge-based database provides relevant data content to facilitate the subsequent management of attack and defense tools. Simultaneously, it can be directly connected to existing databases to support the management of attack and defense tools.

[0030] Step S120: Classify the attack and defense tools and the attribute data to obtain classification results; The attack and defense tools and their corresponding attribute data constitute a large amount of data, which includes various aspects. For example, taking attack tools as an example, each attack tool can provide certain functional effects, such as data scanning, password cracking, and data tampering. However, there are also cases where multiple attack tools are combined and used together, that is, by combining multiple tools, a new, complex tool is formed that achieves multiple attack functions.

[0031] In addition, attack and defense tools also need to be classified according to their attribute type. For example, they can be divided into attack tools and defense tools, or they can be classified according to their content, such as attack tools that attack a specific vulnerability or defense tools that defend against a specific vulnerability. The specific classification needs to be based on the owner of the tool and the functions that the tool can perform.

[0032] The classification result is the result of dividing and classifying a large number of offensive and defensive tools and their corresponding attribute data. It can be divided into multiple levels. For example, the first level corresponds to offensive tools and defensive tools, the second level corresponds to the different functions of offensive or defensive tools, and the third level corresponds to the specific attribute data of offensive and defensive tools.

[0033] For example, the step of classifying the attack and defense tools and the attribute data to obtain classification results includes: Step a: Based on the type information of the attack and defense tools, determine the attack tools corresponding to the attacker in the network range, and determine the defense tools corresponding to the defender in the network range; The type information of attack and defense tools mainly includes the user of the attack and defense tools, namely the red attacker and the blue attacker.

[0034] Based on this type of information, the attack and defense tools that were originally piled up together are classified in a general sense. This is equivalent to creating two sub-databases in one database. These two sub-databases are an attack tool sub-database that stores attack tools and a defense tool sub-database that stores defense tools. This makes it easier for the red and blue teams to directly select the tool sub-database that they need to use, avoiding the process of constantly filtering and selecting from a large number of databases.

[0035] Step b: Determine the attack function of the attack tool and the defense function of the defense tool; After dividing the attack and defense tools into attack tools for the attackers within the network range and defense tools for the defenders within the network range, it is necessary to further sort out and manage the attack tools and defense tools separately.

[0036] Therefore, after categorizing attack and defense tools into attack tools and defense tools, it is necessary to classify them separately according to their functions. This is equivalent to creating many smaller databases within the attack tool sub-database and the defense tool sub-database.

[0037] When determining the attack function of an attack tool and the defense function of a defense tool, the data source of the attack and defense tools can be used as a reference. The description file of the corresponding attack and defense tool can be obtained from the source to determine the specific function of the tool. Alternatively, the purpose of the attack and defense tool can be determined based on relevant data such as its attributes, structural attributes, or text type attributes, thereby determining its function. Or, the function of the attack and defense tool can be directly determined from a knowledge database. If the function of an attack and defense tool cannot be determined, it can be determined by testing the tool.

[0038] For example, the step of determining the attack functionality of the attack tool includes: Step c: If the attack tool is a basic attack tool, then determine the attack function of the basic attack tool; Step d: If the attack tool is a complex attack tool composed of multiple basic attack tools, then determine each basic attack tool in the complex attack tool and determine the attack function of each basic attack tool.

[0039] When classifying attack and defense tools, it is also necessary to classify them according to their structural types. For example, commonly used attack tools can be combined with other attack tools in different ways to form complex attack tools. In general, defense tools only defend against a certain feature point. For example, firewall defense tools only block external connections, or antivirus defense tools only provide the function of removing software viruses.

[0040] Therefore, before classifying attack tools and determining their attack functions, complex attack tools need to be processed in a certain way to ensure that when determining the attack functions of attack tools, the statistical data are all based on the functions corresponding to the most basic attack tools. This avoids a complex attack tool from performing multiple functions at the same time, and thus avoids the complexity of sorting out attack tools.

[0041] In other words, attack tools are divided into two categories: basic attack tools and complex attack tools. Basic attack tools are the most basic tools that only implement one attack function, while complex attack tools are composed of multiple basic attack tools and can implement multiple attack functions at the same time.

[0042] When the attack tool is a basic attack tool, the attack function of the attack tool is directly determined. When the attack tool is a complex attack tool, the complex attack tool is first disassembled to determine the individual basic attack tools that make it up, and then the attack function of each basic attack tool is determined after disassembly.

[0043] Since defensive tools do not exist in combination for joint use, their defensive functions can be directly determined.

[0044] Step e: Based on the attack function and the defense function, classify the attack and defense tools and the attribute data to obtain the classification result.

[0045] Based on the different attack and defense functions, attack and defense tools and attribute data are classified. This is equivalent to storing tools with the same function together and listing multiple functional storage areas for subsequent data query and retrieval.

[0046] Step S130: Input the classification result into the preset metadata model so that the metadata model can generate a unified metadata structure based on the classification result, perform format unification processing on the attribute data, and fill it into the corresponding metadata structure; wherein, the preset metadata model is a metadata model constructed according to preset mapping rules to analyze and manage the attack and defense tools and the attribute data.

[0047] The classification results are input into the metadata model, which can then manage the classified attack and defense tools. The main management content is to manage the attack and defense tools that originally belonged to different platforms and systems in a unified format, including the data storage format, the data arrangement, and the composition of the data itself. For example, taking a relational database as an example, multiple corresponding data storage units can be generated. Based on the relationships between the data stored in them, the relationships between the storage units are established. This allows users to be prompted about the relationships between the data when they retrieve the corresponding data, thereby improving the efficiency of users in selecting attack and defense tools.

[0048] Therefore, the pre-defined metadata model needs to define corresponding data processing rules before use, such as mapping rules and data transformation rules, to transform the original data into corresponding metadata and generate a unified metadata structure. Attribute data should also be uniformly processed and populated into the corresponding metadata structure, thereby achieving the management effect of attack and defense tools and their corresponding attribute data. Among them, attribute data serves as supplementary data for attack and defense tools. Its main purpose is to add attributes and types for attack and defense tools to the metadata structure. Attribute data is like a tag attached to the attack and defense tool. Through the tag, the relevant attribute content of the attack and defense tool can be directly determined, such as the name, purpose, function, platform, interface, attack effect, and other related data of the attack and defense tool.

[0049] Reference Figure 2 and Figure 3 , Figure 2 This is a diagram illustrating the metadata attributes of the resources attacked by the Red Team. Figure 3 This is a diagram illustrating the metadata attributes of the blue team's defense resources.

[0050] Among them, attack resources are the sum of attack tools and their corresponding attribute data, while defense resources are the sum of defense tools and their corresponding attribute data.

[0051] in, Figure 2The attribute data of the attack resources includes: tool name, tool identifier, tool version number, tool description, function description, addition time, tool type, execution type, development language, tool form, access restrictions, tool running location, tool usage record, tool interface, total available quantity, currently available quantity, used quantity, ATT&CK (Adversarial Tactics Technology and Common Knowledge) matrix stage, dependent tools, running platform, tool triggering conditions, attack effect, tool usage instructions, system and performance requirements, output data type, information link address, attachment information, review status, target information, and corresponding vulnerability information. The target information includes target name, target description, target platform / verification environment, while the corresponding vulnerability information includes vulnerability name, CVE (Common Vulnerabilities & Exposures) number, other numbers, vulnerability description, vulnerability triggering conditions, vulnerability disclosure time, vulnerability patch time, and vulnerability status.

[0052] in, Figure 3 The attribute data corresponding to the defense resources include: tool name, tool identifier, tool version number, tool description, function description, tool category, execution type, tool form, development language, tool running location, tool usage record, addition time, running platform, tool interface, total available quantity, currently available quantity, used quantity, d3f tactical stage (D3FEND, a knowledge base for network security defense technology, specifically a directory mapping ATT&CK and defense technologies), dependent tools, target platform / verification environment, tool triggering conditions, defense effect, tool usage instructions, access restrictions, system and performance requirements, output data type, attachment information, and review status.

[0053] When the metadata model organizes the classification results, it establishes a metadata structure based on the specific attack and defense tools. After the metadata structure is established, it then proceeds according to… Figure 2 or Figure 3 The content is divided according to the attribute data, and the attribute data is filled into the corresponding attribute tags. The preset mapping rules of the metadata model are the rules for mapping attribute data to the corresponding locations and storing them. It is mainly used to organize the attribute data corresponding to different attack and defense tools.

[0054] When organizing data in the metadata model, the focus is on managing various attack and defense tools in a unified format and filling the corresponding positions with the attack and defense tools, thereby increasing the introduction and description of the functions or attributes of the attack and defense tools.

[0055] Furthermore, when adding corresponding attribute tags to the metadata structure, the settings and content of the attribute tags can be adaptively adjusted according to the user's or administrator's customization methods. For example, in Figure 2 or Figure 3 Based on the attribute tags, it allows for adding, deleting, modifying, and querying attributes, including adding new attribute tags, removing unnecessary attribute tags, modifying existing attribute tags, or updating existing attribute tags.

[0056] When deleting attribute tags, some fixed attribute tags must be retained. For example, essential tags that represent the most basic information about the attack and defense tool, such as the name and function of the attack and defense tool, must not be deleted. Furthermore, a minimum amount of content must be retained. This minimum amount of content describes the basic information of the attack and defense tool and will vary depending on the attack and defense tool.

[0057] For example, after the step of inputting the classification result into the preset metadata model, the following steps are included: Step f: Determine the data processing rules when the classification results are input into the metadata model; Step g: According to the data processing rules, store the attack and defense tools and the attribute data in a classified storage manner.

[0058] Before inputting the classification results into the metadata model, the data in the classification results will be transformed and processed to generate the metadata of the corresponding metadata model. The metadata includes ordinary data and file data. These two types of data need to be stored in a classified storage manner according to their data characteristics.

[0059] Ordinary data types can be directly stored in the database, while file-type data needs to be stored through the corresponding file system.

[0060] By pre-storing data processing rules in the database, when data is subsequently accessed from the database, the corresponding data, such as different transformation rules and mapping rules, can be extracted according to the data processing rules.

[0061] In summary, referring to Figure 4 , Figure 4 A schematic diagram of the architecture for network range data management.

[0062] according to Figure 4It is understood that managing network range data requires two steps. On the one hand, it involves classifying attack and defense tools and unifying the description of their characteristic attributes. This means establishing a metadata structure and attribute tags corresponding to attack and defense tools and attribute data through a metadata model. On the other hand, it involves storing the classified and unified data. Based on the classification results, different content is stored in different storage locations. For example, basic attacks (basic attack tools), complex attacks (complex attack tools), defense hardware, and defense software are stored separately.

[0063] Among them, defense hardware refers to the defense hardware required to defend against external attacks when building a network range. The construction of a network range includes at least software and hardware aspects.

[0064] Compared to related technologies where the data information of various attack and defense tools is messy and disordered, and the data information of various tools is complex, resulting in low efficiency in managing various attack and defense tools, this application obtains the attribute data of the attack and defense tools used by both sides in the network test range and the attack and defense tools; classifies the attack and defense tools and the attribute data to obtain classification results; inputs the classification results into a preset metadata model, so that the metadata model can generate a unified metadata structure based on the classification results, perform unified format processing on the attribute data, and fill it into the corresponding metadata structure; wherein, the preset metadata model is a metadata model for analyzing and managing the attack and defense tools and the attribute data constructed according to preset mapping rules. This involves acquiring attack and defense tools and their corresponding attribute data, classifying this data, and then organizing the attack and defense tools and their related attribute data. The organized classification results are then input into the metadata model, which generates a unified metadata structure based on the classification results and populates the attribute data into the corresponding metadata structure. This unifies and hierarchizes the data stored in the metadata model, avoiding the situation where the management efficiency of attack and defense tools and their related data is low due to too many types of attack and defense tools and messy data information.

[0065] For example, refer to Figure 5 , Figure 5 This is a flowchart illustrating the second embodiment of the network range data management method of this application. Based on the first embodiment of the network range data management method of this application described above, a second embodiment is proposed, wherein the method further includes: Step S210: Obtain the execution data of the attack tool when it performs the corresponding attack function; The execution data of the attack tool when implementing the corresponding attack function includes the corresponding usage scenario, usage order and usage effect of the attack tool, which can be obtained through a knowledge database.

[0066] The execution data is mainly used to represent the attack level of the attack tool when it implements the attack function. For example, the execution data can be used to determine whether the attack tool attacks a specific vulnerability through its attack function, or to determine whether the attack tool is mainly used to obtain a certain type of data from the defender.

[0067] The execution data refers to the corresponding attack and defense effects generated during attack and defense exercises between the red and blue teams within the federal range. For example, within the federal range, the red attacker uses attack tools to break through the firewall and tamper with the data stored by the blue defender. In other words, the execution data includes the attack target, attack process, and attack results when using attack tools, as well as the different attack effects generated at different attack stages.

[0068] Step S220: Based on the execution data, determine the attack intent, attack route, attack characteristics, and attack orientation of the attack function; Based on the execution data, the attack target, attack process, and attack result when the attack function is implemented can be determined. This allows for the further identification of the four attack levels embodied by the attack function, including attack intent, attack route, attack characteristics, and attack orientation.

[0069] The attack intent refers to the attack target that the attack tool's attack function can achieve. Based on the attack target, the attack intent can be determined. For example, if the attack target is a certain encrypted file, the attack intent can be determined to be to obtain the encrypted file and parse it, thereby obtaining confidential content.

[0070] The attack flow refers to the steps or technical routes taken when the attack tool is used. For example, it might first attack the blue defender's external firewall, then attack the blue defender's operating system, preventing the blue defender from performing corresponding operations through the operating system. This flow can also be reasonably inferred based on the node resources that enable the attack. Furthermore, since the attack flow includes the technical route to achieve the attack, the attack characteristics can be further determined when the technical route is identified. For example, the red attacker needs to first break through the outer firewall defenses, then further break through the encryption method of the encrypted file, and execute the parsing process; these are all attack characteristics.

[0071] The attack result is the weakness of the blue defender targeted by the attack function.

[0072] Step S230: Based on the attack intent, the attack route, the attack characteristics, and the attack orientation, classify the attack tools and corresponding attribute data according to the attack level to obtain the first classification result; After dividing the attack into four attack levels—attack intent, attack route, attack characteristics, and attack orientation—the attack and defense tools and attribute data are classified according to the different attack levels to obtain the first classification result.

[0073] Dividing attacks by attack level more clearly shows the characteristics of each attack tool. For example, different attack tools correspond to different defensive weaknesses. Also, when using a particular attack tool, the technical route and technical characteristics of that tool are clearly presented to the user, thereby improving the user's efficiency in selecting from the compiled data.

[0074] Step S240: Determine the defense location to which the defense function is applied, and determine the defense means corresponding to the defense function at different defense locations; Defense tools are mainly divided into three categories: endpoint defense tools, perimeter defense tools, and comprehensive analysis defense tools. The difference lies in the application scenario of the defense tools and the different defense locations. For example, defense can be deployed at the endpoint, at the boundary of the system or platform, or as a whole within the system or platform.

[0075] Among them, endpoint defense tools are further divided into endpoint antivirus defense tools, endpoint EDR (Endpoint Detection and Response) defense tools, and other defense tools.

[0076] Among them, boundary defense tools are further divided into firewall blocking defense tools, intrusion detection bypass detection defense tools, and other defense tools.

[0077] Furthermore, it is possible to determine the defensive measures corresponding to the defensive functions of the defensive tools at different defensive locations. For example, defensive measures include blocking external intrusions, security monitoring, virus disinfection, and other means used to maintain the data and communication security of the blue defense party.

[0078] Step S250: Based on the defense methods, classify the defense tools and corresponding attribute data according to the defense content to obtain a second classification result.

[0079] Based on the defense methods, the defense tools and corresponding attribute data are classified into three categories according to their location: terminal defense tools, perimeter defense tools, and comprehensive analysis defense tools. Then, they are further classified according to the defense methods corresponding to their defense functions. This is the second classification result obtained from the above subdivision of various defense tools.

[0080] In this embodiment, execution data of the attack tool when implementing the corresponding attack function is obtained; based on the execution data, the attack intent, attack route, attack characteristics, and attack orientation of the attack function are determined; based on the attack intent, attack route, attack characteristics, and attack orientation, the attack tool and corresponding attribute data are classified according to attack levels to obtain a first classification result; the defense position to which the defense function is applied is determined, and the defense means corresponding to the defense function at different defense positions are determined; based on the defense means, the defense tool and corresponding attribute data are classified according to defense content to obtain a second classification result. That is, by obtaining relevant execution data and defense position data of the attack and defense tools, the attack and defense tools are further classified, resulting in a first classification result obtained from the relevant characteristics of the attack tools, and a second classification result obtained from the relevant characteristics of the defense tools. This achieves the effect of detailed classification of various defense tools, thereby improving the efficiency of subsequent users in calling or managing defense tools.

[0081] For example, refer to Figure 6 , Figure 6 This is a flowchart illustrating the third embodiment of the network range data management method of this application. Based on the first and second embodiments of the network range data management method of this application described above, a third embodiment is proposed, wherein the method further includes: Step S310: Transform the attribute data in the classification results to obtain a metadata object; The attribute data in the classification results needs to be input into the metadata model, and the attribute data is added to the corresponding metadata structure as tags. In order to meet the construction of the metadata model, the attribute data in the classification results needs to be transformed first, that is, the data with different data types and formats is uniformly transformed, and the data in the classification results is transformed into metadata objects.

[0082] The metadata object includes the metadata corresponding to the attribute data, as well as the attribute information corresponding to the metadata.

[0083] For example, the step of transforming the attribute data in the classification result to obtain a metadata object includes: Step h: Transform the attribute data in the classification results to obtain a metadata file describing the characteristics of the attack and defense tools; Step i: Parse the metadata file to obtain a metadata object composed of the metadata corresponding to the attribute data and the attribute information corresponding to the metadata.

[0084] The attribute data is transformed into metadata suitable for the metadata model. This transformation process uses different transformation rules depending on the type of attribute data to convert it into metadata.

[0085] For example, attribute data can be ordinary data types (integer, floating-point, etc.) or file data. Therefore, when converting attribute data into metadata, the file data also needs to be processed accordingly to extract the content in the file data that describes the characteristics of attack and defense tools.

[0086] Metadata files are files from which the attribute information corresponding to the metadata cannot be directly extracted. For such files, file parsing processing is required to obtain the corresponding metadata and the attribute information corresponding to the metadata.

[0087] Metadata objects include metadata and their corresponding attribute information. This attribute information describes the characteristic attributes of attack and defense tools, mainly including information describing the name, purpose, function, and corresponding characteristics of the attack and defense tools.

[0088] Step S320: Perform metadata governance on the metadata object to remove abnormal content, and obtain the governance result; Metadata objects include metadata and corresponding attribute information. However, there is a certain information gap when obtaining attribute data before obtaining such metadata. For example, the description of the same attack and defense tool may be different on different platforms and systems. Therefore, after obtaining the metadata object, a certain metadata governance process is required. This process may include removing duplicate data and correcting data with abnormal format or content (such as missing content, abnormal format, content that does not correspond to the attack and defense tool, or invalid metadata).

[0089] The governance process specifically includes addressing issues such as missing metadata fields, abnormal metadata, key attribute uniqueness, duplicate metadata attributes, invalid metadata attributes, and invalid custom data formats.

[0090] For example, the process of governing metadata can be achieved by users or administrators modifying the attribute information of metadata in a customized way (adding, deleting, adjusting field content, or correcting and updating erroneous content, etc.), or by directly governing the data automatically through the process of data screening and verification, and obtaining the governance results.

[0091] When updating the attribute information of metadata, it is necessary to compare the existing data and the data to be updated, identify the differences, and add the differences to the existing metadata.

[0092] Step S330: Input the governance results into the preset metadata model.

[0093] The governance results are input into a preset metadata model so that the metadata model can perform steps such as constructing the corresponding metadata structure and adding attribute tags corresponding to the metadata structure for the metadata that has been removed from anomalies.

[0094] In this embodiment, the attribute data in the classification results is transformed to obtain a metadata object. The metadata object is then subjected to metadata governance to remove abnormal content, resulting in a governance result. This governance result is then input into a preset metadata model. In other words, by uniformly transforming the attribute data of the classification results into a metadata object and performing metadata governance on the metadata object, the reliability of the data input into the metadata model is ensured. This improves the accuracy of generating corresponding metadata structures and attribute tags based on the metadata object in the subsequent process, thereby enhancing the management efficiency when updating and modifying data for attack and defense tools.

[0095] Furthermore, this application also provides a network range data management device, which includes: The acquisition module is used to acquire the attack and defense tools used by both sides in the network test range and the attribute data of the attack and defense tools. The classification module is used to classify the attack and defense tools and the attribute data to obtain classification results; The input module is used to input the classification results into a preset metadata model, so that the metadata model can generate a unified metadata structure based on the classification results, perform format unification processing on the attribute data, and populate it into the corresponding metadata structure; wherein, the preset metadata model is a metadata model constructed according to preset mapping rules to analyze and manage the attack and defense tools and the attribute data.

[0096] For example, the classification module includes: The first determining submodule is used to determine the attack tool corresponding to the attacker in the network range and the defense tool corresponding to the defender in the network range based on the type information of the attack and defense tools. The second determining submodule is used to determine the attack function of the attack tool and the defense function of the defense tool; The classification submodule is used to classify the attack and defense tools and the attribute data according to the attack function and the defense function, and obtain the classification result.

[0097] For example, the classification submodule includes: The acquisition unit is used to acquire the execution data of the attack tool when it performs the corresponding attack function; The first determining unit is used to determine the attack intent, attack route, attack characteristics, and attack orientation of the attack function based on the execution data. The first classification unit is used to classify the attack tool and the corresponding attribute data according to the attack intent, the attack route, the attack characteristics and the attack orientation, and obtain the first classification result. The second determining unit is used to determine the defensive position to which the defensive function is applied, and to determine the defensive means corresponding to the defensive function at different defensive positions; The second classification unit is used to classify the defense tools and corresponding attribute data according to the defense methods to obtain a second classification result.

[0098] For example, the second determining submodule includes: The third determining unit is used to determine the attack function of the basic attack tool if the attack tool is a basic attack tool. The fourth determining unit is used to determine each basic attack tool in the complex attack tool if the attack tool is a complex attack tool composed of multiple basic attack tools, and to determine the attack function of each basic attack tool respectively.

[0099] For example, the input module includes: The transformation submodule is used to transform the attribute data in the classification results to obtain metadata objects; The governance submodule is used to perform metadata governance on the metadata object to remove abnormal content and obtain the governance result; The input submodule is used to input the governance results into a preset metadata model.

[0100] For example, the conversion submodule includes: The transformation unit is used to transform the attribute data in the classification results to obtain a metadata file describing the characteristics of the attack and defense tools. The parsing unit is used to parse the metadata file to obtain a metadata object composed of the metadata corresponding to the attribute data and the attribute information corresponding to the metadata.

[0101] For example, the input module further includes: The third determining submodule is used to determine the data processing rules when the classification result is input into the metadata model; The storage submodule is used to store the attack and defense tools and the attribute data in a classified storage manner according to the data processing rules.

[0102] The specific implementation of the network range data management device in this application is basically the same as the embodiments of the network range data management method described above, and will not be repeated here.

[0103] In addition, this application also provides a network range data management device. For example... Figure 7 As shown, Figure 7 This is a schematic diagram of the hardware operating environment involved in the embodiments of this application.

[0104] For example, Figure 7 This can be a schematic diagram of the hardware operating environment of the network range data management device.

[0105] like Figure 7 As shown, the network range data management device may include a processor 701, a communication interface 702, a memory 703, and a communication bus 704. The processor 701, the communication interface 702, and the memory 703 communicate with each other through the communication bus 704. The memory 703 is used to store computer programs. When the processor 701 executes the program stored in the memory 703, it implements the steps of the network range data management method.

[0106] The communication bus 704 mentioned in the aforementioned network range data management equipment can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus 704 can be divided into an address bus, a data bus, and a control bus, etc. For ease of illustration, it is represented by only one thick line in the figure, but this does not indicate that there is only one bus or one type of bus.

[0107] Communication interface 702 is used for communication between the aforementioned network range data management device and other devices.

[0108] The memory 703 may include random access memory (RMD) or non-volatile memory (NM), such as at least one disk storage device. Optionally, the memory 703 may also be at least one storage device located remotely from the aforementioned processor 701.

[0109] The processor 701 mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0110] The specific implementation of the network range data management device in this application is basically the same as the embodiments of the network range data management method described above, and will not be repeated here.

[0111] Furthermore, embodiments of this application also propose a computer-readable storage medium storing a network range data management program, which, when executed by a processor, implements the steps of the network range data management method described above.

[0112] The specific implementation of the computer-readable storage medium in this application is basically the same as the embodiments of the network range data management method described above, and will not be repeated here.

[0113] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0114] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0115] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0116] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A method for managing network range data, characterized in that, The network range data management method includes the following steps: Obtain the attack and defense tools used by both sides in the network test range and the attribute data of the attack and defense tools; The attack and defense tools and the attribute data are classified to obtain classification results. The classification process is used to organize the attack and defense tools and their related attribute data. The classification process is also used to make the data stored in the metadata model hierarchical. Input the classification result into a preset metadata model so that the metadata model can generate a unified metadata structure based on the classification result, perform format unification processing on the attribute data, and populate it into the corresponding metadata structure; The preset metadata model is a metadata model constructed according to preset mapping rules to analyze and manage the attack and defense tools and the attribute data. The step of classifying the attack and defense tools and the attribute data to obtain classification results includes: Based on the type information of the attack and defense tools, the attack tools corresponding to the attacker in the network range and the defense tools corresponding to the defender in the network range are determined. The type information includes the user of the attack and defense tools. The attack function of the attack tool and the defense function of the defense tool are determined. The attack function and the defense function are determined based on the description file obtained from the data source of the attack and defense tool, or the attack function and the defense function are determined based on the attributes of the attack and defense tool, or the attack function and the defense function are determined directly based on a knowledge database, or the attack function and the defense function are determined based on the method of testing the attack and defense tool. Based on the attack function and the defense function, the attack and defense tools and the attribute data are classified to obtain the classification result.

2. The network range data management method as described in claim 1, characterized in that, The classification result includes a first classification result corresponding to the attack tool and a second classification result corresponding to the defense tool. The step of classifying the attack and defense tools and the attribute data according to the attack function and the defense function to obtain the classification result includes: Obtain the execution data of the attack tool when it performs the corresponding attack function; Based on the execution data, the attack intent, attack route, attack characteristics, and attack orientation of the attack function are determined; Based on the attack intent, attack route, attack characteristics, and attack orientation, the attack tools and corresponding attribute data are classified according to attack levels to obtain a first classification result; Determine the defensive location to which the defensive function is applied, and determine the corresponding defensive measures for the defensive function at different defensive locations; Based on the aforementioned defense methods, the defense tools and corresponding attribute data are classified according to their defense content to obtain a second classification result.

3. The network range data management method as described in claim 1, characterized in that, The step of determining the attack functionality of the attack tool includes: If the attack tool is a basic attack tool, then the attack function of the basic attack tool is determined; If the attack tool is a complex attack tool composed of multiple basic attack tools, then each basic attack tool in the complex attack tool is identified, and the attack function of each basic attack tool is determined respectively.

4. The network range data management method as described in claim 1, characterized in that, The step of inputting the classification result into the preset metadata model includes: The attribute data in the classification results are transformed to obtain a metadata object; Metadata governance is performed on the metadata object to remove abnormal content, and the governance result is obtained; Input the governance results into the preset metadata model.

5. The network range data management method as described in claim 4, characterized in that, The step of transforming the attribute data in the classification results to obtain metadata objects includes: The attribute data in the classification results are transformed to obtain a metadata file describing the characteristics of the attack and defense tools; The metadata file is parsed to obtain a metadata object consisting of the metadata corresponding to the attribute data and the attribute information corresponding to the metadata.

6. The network range data management method as described in claim 1, characterized in that, After the step of inputting the classification result into the preset metadata model, the following steps are included: Determine the data processing rules when the classification results are input into the metadata model; According to the data processing rules, the attack and defense tools and the attribute data are stored in a classified storage manner.

7. A network range data management device, characterized in that, The network range data management device includes: The acquisition module is used to acquire the attack and defense tools used by both sides in the network range and the attribute data of the attack and defense tools; The classification module is used to classify the attack and defense tools and the attribute data to obtain classification results. The classification process is used to organize the attack and defense tools and their related attribute data. The classification process is also used to make the data stored in the metadata model hierarchical. The input module is used to input the classification results into a preset metadata model, so that the metadata model can generate a unified metadata structure based on the classification results, perform format unification processing on the attribute data, and populate it into the corresponding metadata structure; wherein, the preset metadata model is a metadata model for analyzing and managing the attack and defense tools and the attribute data, constructed according to preset mapping rules; The network range data management device is also used to achieve: Based on the type information of the attack and defense tools, the attack tools corresponding to the attacker in the network range and the defense tools corresponding to the defender in the network range are determined. The type information includes the user of the attack and defense tools. The attack function of the attack tool and the defense function of the defense tool are determined. The attack function and the defense function are determined based on the description file obtained from the data source of the attack and defense tool, or the attack function and the defense function are determined based on the attributes of the attack and defense tool, or the attack function and the defense function are determined directly based on a knowledge database, or the attack function and the defense function are determined based on the method of testing the attack and defense tool. Based on the attack function and the defense function, the attack and defense tools and the attribute data are classified to obtain the classification result.

8. A network range data management device, characterized in that, The device includes: a memory, a processor, and a network range data management program stored in the memory and executable on the processor, the network range data management program being configured to implement the steps of the network range data management method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a network range data management program, which, when executed by a processor, implements the steps of the network range data management method as described in any one of claims 1 to 6.

Images