Network connection establishment method, device, equipment and storage medium

Abstract

The embodiments of the present invention provide a network connection construction method, apparatus, device and storage medium, and relate to the field of artificial intelligence technology. The method includes: performing lexical analysis on the acquired network connection text information to generate a text lexical analysis structure, then generating semi-structured field content based on the text lexical analysis structure and a preset field identifier, generating semi-structured network data according to the semi-structured field content, and constructing a network connection according to the semi-structured network data. Since the lexical structure in the text information is automatically extracted by lexical analysis, and the semi-structured field content is extracted based on the lexical structure, the problem that the data structure learning threshold of the semi-structured network data is high and the demand for timely linkage response cannot be met is overcome. At the same time, the network connection is constructed according to the semi-structured field content, avoiding the problem of low construction efficiency caused by manual deployment, thereby achieving the effect of improving the construction efficiency and accuracy of the network defense route.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network connection establishment method, apparatus, device and storage medium. Background Art

[0002] A cyber range is a multi-role collaborative network system simulation platform used to support cybersecurity talent development, cyber attack and defense training, security product evaluation, and the verification of new network technologies. In recent years, cyber range attack and defense drills have been steadily advancing, becoming regularized and large-scale. Conducting cybersecurity activities in a cyber range not only avoids the occupation and consumption of real-world resources but also allows for the reuse of resources. Because the extent of damage caused by each security test is controllable and detectable, the collected test data can be analyzed and studied after the test. Without affecting the real-world environment, cyber ranges can enhance the skills of cybersecurity practitioners and identify vulnerabilities in security products, thereby improving their performance and security.

[0003] In related technologies, network connection construction is often done manually, resulting in low efficiency and accuracy. For example, in a cyber shooting range, the Red Team represents the attacker and the Blue Team represents the defender. The Blue Team's role is to quickly build network defense routes, formulate defense strategies to minimize exposure, and promptly coordinate responses to block attack paths. However, the current Blue Team faces two major issues when constructing defense routes: 1) Deploying defense routes using defense tools is often done manually, resulting in low efficiency and accuracy; 2) Blue Team members often communicate about defense routes using instant messaging tools, and the specific deployment uses semi-structured JSON data to describe the routes. This data structure has a high learning curve and cannot meet the requirements for timely coordinated responses. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to propose a network connection establishment method, device, equipment and storage medium, which can improve the efficiency and accuracy of network connection establishment.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application provides a method for establishing a network connection, comprising:

[0006] Get network connection text information;

[0007] Performing lexical analysis on the network connection text information to generate a text lexical analysis structure;

[0008] Generating semi-structured field content based on the text lexical analysis structure and preset fields;

[0009] generating semi-structured network data according to the semi-structured field content;

[0010] A network connection is constructed according to the semi-structured network data.

[0011] In some embodiments, performing lexical analysis on the network connection text information to generate a text lexical analysis structure includes:

[0012] Performing a word segmentation operation on the network connection text information to obtain a plurality of text words;

[0013] Performing sentence part-of-speech analysis on the multiple text words to obtain the parts of speech of the text words;

[0014] The text lexical analysis structure is generated based on the text words and the parts of speech of the text words.

[0015] In some embodiments, the preset fields include: a first preset field and a second preset field; and generating semi-structured field content based on the text lexical analysis structure includes:

[0016] Extracting information from the text lexical analysis structure based on preset keywords to obtain first network connection information of a first preset field;

[0017] Obtaining second network connection information of the second preset field by querying a preset network information database based on the first network connection information;

[0018] generating first field content according to the first preset field and the first network connection information, and generating second field content according to the second preset field and the second network connection information;

[0019] The semi-structured field content is generated according to the first field content and the second field content.

[0020] In some embodiments, the part of speech includes subject pronouns; the preset keywords include prepositional keywords and verb keywords; and extracting information from the text lexical analysis structure based on the preset keywords to obtain the first network connection information of the first preset field includes:

[0021] Extracting initial virtual machine information from the text lexical analysis structure based on the prepositional keywords;

[0022] Extracting initial tool information from the text lexical analysis structure based on the verb keyword;

[0023] Obtaining creator information according to the subject pronoun of the text lexical analysis structure;

[0024] The first network connection information is obtained according to the creator information, the initial virtual machine information, and the initial tool information.

[0025] In some embodiments, obtaining the first network connection information according to the creator information, the initial virtual machine information, and the initial tool information includes:

[0026] querying the preset network information database to determine a first state of the initial virtual machine information, where the first state is a positive state, indicating that the initial virtual machine information is true information;

[0027] querying the preset network information database to determine a second state of the initial tool information, wherein when the second state is a positive state, it indicates that the initial tool information is true information;

[0028] When both the first state and the second state are positive states, the first network connection information is obtained according to the creator information, the initial virtual machine information, and the initial tool information.

[0029] In some embodiments, the first preset field includes: a creator, a virtual machine name, and a tool name; and generating the first field content according to the first preset field and the first network connection information includes:

[0030] Generate creator field information of the creator according to the creator information;

[0031] Generate virtual machine name field information of the virtual machine name according to the initial virtual machine information;

[0032] Generating tool name field information of the tool name according to the initial tool information;

[0033] The first field content is generated according to the creator field information, the virtual machine name field information, and the tool name field information.

[0034] In some embodiments, the preset network information database includes: a user information data table, a virtual machine information data table, and a network tool data table; and querying the preset network information database based on the first network connection information to obtain the second network connection information identified by the second preset field includes:

[0035] Obtaining network solution information by querying the user information data table based on the creator information;

[0036] Obtaining virtual machine attribute information by querying the virtual machine information data table based on the initial virtual machine information;

[0037] Obtaining tool attribute information by querying the network tool data table based on the initial tool information;

[0038] The second network connection information is obtained according to the network solution information, the virtual machine attribute information, and the tool attribute information.

[0039] In some embodiments, the second preset field includes: a network solution, virtual machine attributes, and tool attributes; and generating the second field content according to the second preset field and the second network connection information includes:

[0040] generating network solution field information of the network solution according to the network solution information;

[0041] Generate virtual machine attribute field information of the virtual machine attribute according to the initial virtual machine information;

[0042] Generating tool attribute field information of the tool attribute according to the initial tool information;

[0043] The second field content is generated according to the network solution field information, the virtual machine attribute field information, and the tool attribute field information.

[0044] In some embodiments, generating semi-structured network data according to the semi-structured field content includes:

[0045] Obtaining a preset semi-structured network data structure;

[0046] The preset semi-structured network data structure is filled with the first field content and the second field content to obtain the semi-structured network data.

[0047] In some embodiments, establishing a network connection based on the semi-structured network data includes:

[0048] Sending the semi-structured network data to a first target topic for message persistence based on a distributed message subscription system to obtain a first topic message;

[0049] Sending the first topic message to a virtual machine, so that the virtual machine can obtain network tool information according to the first topic message;

[0050] receiving a verification result generated by the virtual machine verifying the network tool information;

[0051] The network connection is established according to the verification result, the semi-structured network data and a first judgment condition; the first judgment condition includes that the verification result is verification passed.

[0052] In some embodiments, the distributed message subscription system is a Kafka system, and the multiple virtual machines constitute a Kafka cluster; the distributed message subscription system sends the semi-structured network data to a first target topic for message persistence to obtain a first topic message, including:

[0053] Select one of the virtual machines from the Kafka cluster;

[0054] Send an addressing request to the virtual machine to apply for a producer number from the Kafka transaction manager;

[0055] Sending the semi-structured network data to the first target topic based on the producer number, and sending a persistence request to the Kafka transaction manager;

[0056] After receiving the response information of the persistence request, the first topic message is obtained.

[0057] In some embodiments, sending the first topic message to a virtual machine so that the virtual machine can obtain network connection information according to the first topic message includes:

[0058] The first topic message is sent to each of the virtual machines so that when the virtual machine receives the first topic message, it queries the local name in the first topic message. If the virtual machine name field information of the first topic message contains the local name, the local deployment tool content is read from the tool name field information of the first topic message, and the corresponding network tool is downloaded according to the local deployment tool content.

[0059] In some embodiments, the receiving of a verification result generated by the virtual machine verifying the network tool information is generated by the virtual machine performing the following steps:

[0060] Downloading the network tool to a local file system;

[0061] Calculate the verification value of each network tool, match the verification value with the tool attribute field information, and determine whether the network tool has been completely downloaded. If it has been completely downloaded, generate the verification result indicating that the verification has passed; otherwise, generate the verification result indicating that the verification has failed.

[0062] In some embodiments, establishing the network connection according to the verification result and the semi-structured network data includes:

[0063] determining one or more target virtual machines based on the semi-structured network data;

[0064] Obtaining the verification results of all the target virtual machines;

[0065] If the verification results are all verified to be passed, the network connection is established according to the semi-structured network data.

[0066] To achieve the above objectives, a second aspect of an embodiment of the present application proposes a defense route construction method, which is applied to the defender of a network range, comprising:

[0067] Get defense route text information;

[0068] Performing lexical analysis on the defense route text information to generate a defense text lexical analysis structure;

[0069] Generating semi-structured defense field content based on the defense text lexical analysis structure and the preset defense field;

[0070] generating semi-structured defense route data according to the semi-structured defense field content;

[0071] A defense route is constructed according to the semi-structured defense route data.

[0072] To achieve the above objectives, a third aspect of an embodiment of the present application provides a network connection establishment device, comprising:

[0073] A text information acquisition module is used to obtain network connection text information;

[0074] A lexical analysis module, configured to perform lexical analysis on the network connection text information and generate a text lexical analysis structure;

[0075] A field content generation module, configured to generate semi-structured field content based on the text lexical analysis structure and preset field identifiers;

[0076] A network connection data generating module, configured to generate semi-structured network data according to the semi-structured field content;

[0077] The network connection building module is used to build a network connection according to the semi-structured network data.

[0078] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the method described in the first or second aspect above when executing the computer program.

[0079] To achieve the above-mentioned purpose, the fifth aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium and stores a computer program. When the computer program is executed by a processor, it implements the method described in the first or second aspect above.

[0080] The network connection construction method, device, equipment and storage medium proposed in the embodiment of the present application obtain network connection text information, perform lexical analysis on the network connection text information, generate a text lexical analysis structure, and then generate semi-structured field content based on the text lexical analysis structure and preset field identifiers. Then, semi-structured network data is generated according to the semi-structured field content, and finally, a network connection is constructed according to the semi-structured network data. The embodiment of the present application adopts a lexical analysis method to automatically extract the lexical structure in the text information, and then extracts the semi-structured field content based on the lexical structure. This overcomes the problem that the data structure learning threshold of semi-structured network data is high, resulting in the inability to meet the demand for timely linkage response. At the same time, the network connection is constructed according to the semi-structured field content, avoiding the problem of low construction efficiency caused by manual deployment, thereby achieving the effect of improving the construction efficiency and accuracy of the network defense route. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Figure 1 The figure is a flow chart of a method for establishing a network connection provided by an embodiment of the present invention.

[0082] Figure 2 yes Figure 1 Flowchart of step S120 in .

[0083] Figure 3 It is a schematic diagram of a text lexical analysis structure of a network connection establishment method provided by another embodiment of the present invention.

[0084] Figure 4 It is a schematic diagram of a text lexical analysis structure of a network connection establishment method provided by another embodiment of the present invention.

[0085] Figure 5 It is a schematic diagram of a semi-structured network data structure of a network connection establishment method provided by another embodiment of the present invention.

[0086] Figure 6 yes Figure 1 Flowchart of step S130 in .

[0087] Figure 7 yes Figure 6 Flowchart of step S131 in .

[0088] Figure 8 yes Figure 7 Flowchart of step S1314 in .

[0089] Figure 9 yes Figure 6 Flowchart of step S132 in .

[0090] Figure 10 yes Figure 6Flowchart of step S133 in .

[0091] Figure 11 It is a schematic diagram of a semi-structured network data structure of a network connection establishment method provided by another embodiment of the present invention.

[0092] Figure 12 Another embodiment of the present invention provides Figure 6 Flowchart of step S133 in .

[0093] Figure 13 yes Figure 1 Flowchart of step S140 in .

[0094] Figure 14 yes Figure 1 Flowchart of step S150 in .

[0095] Figure 15 yes Figure 14 Flowchart of step S151 in .

[0096] Figure 16 yes Figure 14 Flowchart of step S154 in .

[0097] Figure 17 This is a structural block diagram of a network connection establishment device provided by another embodiment of the present invention.

[0098] Figure 18 It is a schematic diagram of the hardware structure of the electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0099] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0100] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in a different order than the module division in the device or the order in the flowchart.

[0101] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention pertains. The terms used herein are for the purpose of describing embodiments of the present invention only and are not intended to limit the present invention.

[0102] First, some terms involved in this invention are analyzed:

[0103] JSON (JacaScript Object Natation) is a lightweight data exchange format that is easy for humans to read and write, as well as easy for machines to parse and generate. JSON uses a completely language-independent text format, but also uses conventions similar to the C family of languages, making it an ideal data exchange language.

[0104] Structured data, also known as relational data, is data that follows a strict schema, with all data sharing the same fields or attributes. Structured data is typically stored in database tables with rows and columns, where a key column indicates the relationship between one row in a table and data in another row in another table. This shared schema allows for easy searching of this data using query languages ​​like Structured Query Language (SQL). This feature makes this data style well-suited for applications such as CRM systems, reservations, and inventory management.

[0105] Semi-structured web data: Semi-structured web data is less organized than structured data and, because its fields don't conform to a strict table, row, and column structure, isn't stored in a relational format. Semi-structured web data contains tags, such as key / value pairs, that highlight the data's organization and hierarchy. Also known as non-relational data or NoSQL data, this type of data's representation and structure are defined by a serialization language. Three common formats exist for semi-structured web data: XML, JSON, and YAML.

[0106] Unstructured data: Unstructured data is data whose organizational structure is difficult to discern. Unstructured data is typically found in the form of files, such as photos or videos. Video files themselves may have an overall structure and semi-structured metadata, but data including video files is unstructured. Therefore, photos, videos, and other similar files are categorized as unstructured data.

[0107] PurpleSharp: An adversary simulation tool for Windows environments written in C#, PurpleSharp introduces the ability to execute flexible and customizable automated adversary simulation playbooks against Active Directory environments, allowing defenders to measure detection coverage across different scenarios and variations of the same techniques. It also implements different behaviors across the entire attack lifecycle, including execution, persistence, privilege escalation, credential access, and lateral movement, according to the MITRE ATT&CK framework.

[0108] Cuckoo Sandbox: An open-source tool for automated malware detection, Cuckoo launches in an isolated, real-world environment and tricks malware into believing it has already infected the host. It then records the malware's activity and generates detailed reports. Cuckoo not only helps users identify and remove malware, but also helps them understand the malware's attack steps and targets. It automates the task of evaluating malicious files on Windows, Linux, Android, and macOS. Cuckoo's design and open-source nature allow users to customize the analysis environment, results processing, and reporting phases.

[0109] W3af: A web application attack and inspection framework. The project has over 130 plugins, including those that check for SQL injection, cross-site scripting (XSS), and local and remote file security. This framework is used to find and exploit web application security vulnerabilities.

[0110] Kafka is an open source stream processing platform developed by the Apache Software Foundation and written in Scala and Java. It is a high-throughput distributed publish-subscribe messaging system that can handle all streams of consumer activity on websites. Kafka's purpose is to unify online and offline message processing through Hadoop's parallel loading mechanism and to provide real-time messaging across clusters.

[0111] A cyber range is a multi-role collaborative network system simulation platform used to support cybersecurity talent development, cyber attack and defense training, security product evaluation, and the verification of new network technologies. In recent years, cyber range attack and defense drills have been steadily advancing, becoming regularized and large-scale. Conducting cybersecurity activities in a cyber range not only avoids the occupation and consumption of real-world resources but also allows for the reuse of resources. Because the extent of damage caused by each security test is controllable and detectable, the collected test data can be analyzed and studied after the test. Without affecting the real-world environment, cyber ranges can enhance the skills of cybersecurity practitioners and identify vulnerabilities in security products, thereby improving their performance and security.

[0112] In related technologies, the Red Team represents the attackers in a cyber range, while the Blue Team represents the defenders. The Blue Team's role is to build a network defense route as quickly as possible, formulate defense strategies to narrow exposure, and promptly coordinate responses to block attack paths. However, the Blue Team currently faces two major challenges in building a defense route: 1) Building a defense route in a range requires deploying a large number of defense tools, which is currently mostly done manually. This requires Blue Team members to expend considerable time and effort performing repetitive installation and deployment of defense tools on multiple virtual machines, significantly slowing down the defense route construction process. 2) Defense routes are described using semi-structured JSON data. In the security defense field, semi-structured JSON data is a medium for communication between humans and computers, with strict syntax rules, but it is difficult to read and understand, and presents a certain learning threshold. Blue Team members often communicate about defense routes using instant messaging tools. Therefore, deploying the defense route requires machine learning capabilities to convert the communication into semi-structured JSON data. This approach fails to meet the requirements for timely coordinated responses.

[0113] Based on this, the embodiments of the present invention provide a network connection construction method, device, equipment and storage medium, which automatically extracts the lexical structure in the text information by lexical analysis, and then extracts the semi-structured field content based on the lexical structure, overcoming the problem that the data structure learning threshold of semi-structured network data is high, resulting in the inability to meet the needs of timely linkage response. At the same time, the network connection is constructed according to the semi-structured field content, avoiding the problem of low construction efficiency caused by manual deployment, thereby achieving the effect of improving the construction efficiency and accuracy of the network defense route.

[0114] The embodiments of the present invention provide a network connection establishment method, apparatus, device, and storage medium, which are specifically described through the following embodiments. First, the network connection establishment method in the embodiments of the present invention is described.

[0115] The following describes a method for establishing a network connection in an embodiment of the present invention.

[0116] Figure 1 This is an optional flowchart of the network connection establishment method provided by an embodiment of the present invention. Figure 1 The method may include but is not limited to steps S110 to S130. Figure 1 The order of step S110 to step S130 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0117] Step S110: Acquire network connection text information.

[0118] In one embodiment, the network connection text information includes content related to the network connection, such as text information input by the user in a chat dialog box, or text information obtained by performing text recognition on the user's spoken content.

[0119] For example, in a virtual attack and defense scenario in a Red-Blue cyber range, a Blue user enters network connection text information about the defense in the chat input box on the terminal's front-end interface. This network connection text information represents the defense route. Clicking the "Send" icon sends it to the server. The front-end encodes the network connection text information generated during the conversation, for example using base64 encoding, then encapsulates the encoded text into a message body and sends it to the server. The server decodes the received message body to determine the sender, receiver, and network connection text information about the defense. The sender and receiver can be determined using the chat dialog ID or the user IDs of the two chat parties. The server then performs two actions: first, sending the network connection text information about the defense to the receiver via the WebSocket protocol, and then performing the following steps to parse the network connection text information.

[0120] In one embodiment, the server backend notifies the sender through the websocket protocol that defense route information has been found in the conversation content, and prompts the front-end to confirm whether a deployment task needs to be performed on the route. If the user clicks confirm, the following steps will be entered to perform the text parsing process, otherwise the entire process ends.

[0121] Step S120: performing lexical analysis on the network connection text information to generate a text lexical analysis structure.

[0122] In one embodiment, since different parts of speech represent different meanings, the purpose of lexical analysis is to obtain the parts of speech of words in the network connection text information, and then analyze the meaning of the network connection text information.

[0123] In one embodiment, in the virtual attack and defense of the red and blue network range, the text lexical analysis structure is a defensive text lexical analysis structure.

[0124] In one embodiment, a text lexical analysis structure is generated using natural language processing technology. Figure 2 , is a specific implementation flow chart of step S120 shown in an embodiment. In this embodiment, the steps of performing lexical analysis on the network connection text information and generating a text lexical analysis structure include:

[0125] Step S121: performing a word segmentation operation on the network connection text information to obtain a plurality of text words.

[0126] In one embodiment, a dictionary-based word segmentation method can be used to segment text information to obtain a word segmentation sequence consisting of multiple text words. This method matches the character string to be matched in the text information with words in a pre-established dictionary according to a preset strategy. Pre-set strategies include forward maximum matching, reverse maximum matching, and bidirectional matching word segmentation.

[0127] In one embodiment, a natural language processing toolkit in the related art is used to perform a word segmentation operation, such as using the Stanford NLP toolkit to perform a text segmentation operation to obtain multiple text words. It is understood that the text words here can be single words or phrases.

[0128] For example, if the input network connection text information is "I want to deploy defense tool 1, defense tool 2, defense tool 3, and defense tool 4 on virtual machine 1 and virtual machine 2", after the word segmentation operation, we get: "I", "want", "on", "virtual machine 1, virtual machine 2", "on", "deploy", "defense tool 1, defense tool 2, defense tool 3, and defense tool 4".

[0129] Step S122: performing sentence part-of-speech analysis on the multiple text words to obtain the parts of speech of the text words.

[0130] In one embodiment, different words have different components in a sentence. Sentence components include: subject, predicate, object, attributive, adverbial, complement, etc. Different components correspond to different parts of speech. For example, the subject is often a noun or pronoun; the predicate is a verb, the object is the same as the subject; the attributive is an adjective, noun, or adverb; the adverbial is an adjective, adverb, or prepositional phrase; and the complement is a noun, adjective, or adverb. Therefore, in this embodiment, part-of-speech analysis is performed on multiple text words to obtain the part of speech of the text words and their components in the sentence.

[0131] Step S123: Generate a text lexical analysis structure based on the text words and the parts of speech of the text words.

[0132] In one embodiment, a text lexical analysis structure is generated based on text words and corresponding parts of speech. Figure 3, the network connection text information is "I want to deploy defense tool 1, defense tool 2, defense tool 3 and defense tool 4 on virtual machine 1 and virtual machine 2", and the text terms are represented as: "I", "want", "in", "virtual machine 1, virtual machine 2", "on", "deploy", "defense tool 1, defense tool 2, defense tool 3", among which "I" is a pronoun, "want" is an adverb, "in" is a preposition, "virtual machine 1, virtual machine 2" is a noun group, "on" is a preposition, "deploy" is a verb, and "defense tool 1, defense tool 2, defense tool 3" is a noun group. It can be understood that commas are used to separate information in noun groups. Among them, "I", "virtual machine 1, virtual machine 2" and "defense tool 1, defense tool 2, defense tool 3" are information related to the defense route.

[0133] In one embodiment, the Chinese model file "chinesePCFG.ser.gz" in the "lexparser" directory of the Stanford NLP toolkit is used to perform sentence part-of-speech analysis on multiple text words using the StanfordParser module. The part-of-speech of the text words and their components in the sentence can be obtained. The part-of-speech of each word is marked using words or phrases as the basic units for dividing components, and a text lexical analysis structure is generated in a hierarchical order based on the collocation of the above six components.

[0134] In one embodiment, referring to Figure 4 For example, in the text lexical analysis structure, "I want to deploy PurpleSharp, Cukoo Sandbox, and W3af on VM 1 and VM 2." In the text lexical analysis structure, S represents a sentence, NP indicates a noun, VP indicates a verb, NN represents a noun or pronoun, AP represents an adverb, PP represents a preposition, and VV represents a verb. Therefore, the corresponding relationships in the diagram are: NN: I; AD: want; PP: on...; NN: VM 1 and VM 2; VV: deploy; NN: PurpleSharp, Cukoo Sandbox, and W3af. Preset keywords are indicated by five-pointed stars in the diagram.

[0135] In one embodiment, referring to Figure 5 In the scenario of blue team defense, the semi-structured network data structure is a JSON data structure. The specifically constructed semi-structured JSON data structure contains two parts: preset fields and corresponding field contents. In this embodiment, the preset fields of the semi-structured network data structure include: a first preset field and a second preset field.

[0136] Reference Figure 5The first preset field includes: creator (created_by), virtual machine name (instance_id) and tool name (tool_name); the second preset field includes: network plan, virtual machine attributes and tool attributes, among which the network plan includes: plan name (scheme_name), updater (updated_by) and project number (project_id); virtual machine attributes include: virtual system type (os_type1) and virtual machine number (vm_name); tool attributes include: tool system type (os_type2), tool check value (check_num), file suffix (file_ext) and tool number (tool_id); among which, virtual system type refers to the operating system of the virtual machine, such as Windows, Linux, etc.; tool system type refers to the system type that supports tool operation; the tool check value can be an MD5 check value.

[0137] Reference Figure 5 The creator-related fields of the first preset field and the network solution-related fields of the second preset field constitute the root node. Starting from root node 10, a first child node 20 is generated. This first child node 20 represents a list of virtual machines. A corresponding number of second child nodes 21 are generated based on the number of virtual machines used. Each second child node 21 represents virtual machine information, which is composed of virtual machine name-related fields from the first preset field and virtual machine attribute-related fields from the second preset field. For each virtual machine, the deployment of relevant network tools is required to implement defense functions. Therefore, each second child node 21 generates a third child node 30. This third child node 30 represents a list of tools. A corresponding number of fourth child nodes 31 are generated based on the number of network tools used. Each fourth child node 31 represents network tool information, which is composed of tool name-related fields from the first preset field and tool attribute-related fields from the second preset field. It is understood that defense tools can be tools such as PurpleSharp, CukooSandbox, and W3af.

[0138] From the above, it can be seen that before executing the following steps, the data structure of the semi-structured network data can be pre-built, and the semi-structured network data can be generated after the text lexical analysis structure is obtained.

[0139] Step S130: Generate semi-structured field content based on the text lexical analysis structure and preset field identifiers.

[0140] In one embodiment, referring to Figure 6, is a specific implementation flowchart of step S130 shown in one embodiment. In this embodiment, the step of generating semi-structured field content based on the text lexical analysis structure and the preset field identifier includes:

[0141] Step S131: extracting information from a text lexical analysis structure based on preset keywords to obtain first network connection information of a first preset field.

[0142] In one embodiment, the preset keywords include prepositional keywords and verbal keywords. For example, the prepositional keyword may be "on / above...", and the verbal keyword may be "deploy," "configure," or "set." It is understood that the network connection text information may include corresponding preset keywords or similar words to the preset keywords through a pre-agreed manner to improve the efficiency and accuracy of information extraction. The preset keywords may be set based on actual circumstances.

[0143] In one embodiment, the part of speech in the text lexical analysis structure also includes subject pronouns, and the first preset field includes: creator, virtual machine name, and tool name. Therefore, step S131 needs to extract the content about the creator, virtual machine name, and tool name from the text lexical analysis structure. Figure 7 , which is a specific implementation flowchart of step S131 shown in one embodiment. In this embodiment, the step of extracting information from a text lexical analysis structure based on preset keywords to obtain first network connection information of a first preset field includes:

[0144] Step S1311: extracting initial virtual machine information from the text lexical analysis structure based on prepositional keywords.

[0145] In one embodiment, the prepositional keyword may be "on...", referring to Figure 3 The text lexical analysis structure includes: "on / virtual machine 1, virtual machine 2 / ", so according to the prepositional keyword "on...", the content between the prepositional keywords is extracted, and the initial virtual machine information obtained is: virtual machine 1, virtual machine 2, where the semicolon is used to separate, that is, the initial virtual machine information includes two virtual machines.

[0146] Step S1312: extracting initial tool information from the text lexical analysis structure based on the verb keywords.

[0147] In one embodiment, the verb keyword may be "deploy", referring to Figure 3The text lexical analysis structure includes: "deployment / defense tool 1, defense tool 2, defense tool 3". Therefore, according to the verb keyword "deploy", the content after the verb keyword is extracted, and the initial tool information obtained is: defense tool 1, defense tool 2, defense tool 3, where the comma is used to separate, that is, the initial tool information includes three defense tools.

[0148] Step S1313: Obtain creator information based on the subject pronoun of the text lexical analysis structure.

[0149] In one embodiment, referring to Figure 3 The subject pronoun is "I," so the sender of the message is considered the actual person "I." The message sender's information is obtained based on the chat dialog ID or the user IDs of both parties, and the creator's information is then derived from the message sender. The creator information here refers to the creator of the defense network. It is understood that the subject pronoun can also be "you," "he," or a specific person, and the creator information is determined based on information such as the user ID corresponding to the subject pronoun.

[0150] Step S1314: Obtain first network connection information according to the creator information, the initial virtual machine information, and the initial tool information.

[0151] In one embodiment, after obtaining the initial virtual machine information and initial tool information, it is necessary to verify the authenticity of the information to ensure that the virtual machine information and the corresponding tool information are authentic and reliable. Figure 8 , is a specific implementation flowchart of step S1314 shown in one embodiment. In this embodiment, the step of obtaining the first network connection information based on the creator information, the initial virtual machine information, and the initial tool information includes:

[0152] Step S810: querying a preset network information database to determine a first state of initial virtual machine information.

[0153] In one embodiment, the preset network information database stores relevant information of available virtual machines, and the corresponding information can be queried by the name of the virtual machine. Therefore, this embodiment queries the preset network information database for the initial virtual machine information obtained above, and the query result is a first state. The first state here includes two, one is a positive state and the other is a negative state. The positive state indicates that the initial virtual machine information can be queried in the preset network information database, which is true information. The negative state indicates that the initial virtual machine information cannot be queried in the preset network information database, which is false information.

[0154] Step S820: querying a preset network information database to determine the second status of the initial tool information.

[0155] In one embodiment, the preset network information database also stores relevant information of available defense tools, and the corresponding information can be queried by the name of the defense tool. Therefore, this embodiment queries the preset network information database for the initial tool information obtained above, and the query result is a second state. The second state here includes two, one is a positive state and the other is a negative state. The positive state indicates that the initial tool information can be queried in the preset network information database and is true information. The negative state indicates that the initial tool information cannot be queried in the preset network information database and is false information.

[0156] Step S830: When both the first state and the second state are positive, first network connection information is obtained according to the creator information, the initial virtual machine information, and the initial tool information.

[0157] In one embodiment, only when the initial virtual machine information and the initial tool information are both real information, the first network connection information is generated accordingly. The first network connection information includes: creator information, initial virtual machine information, and initial tool information.

[0158] Step S132: Based on the first network connection information, query the preset network information database to obtain second network connection information of a second preset field.

[0159] In one embodiment, the preset network information database includes: a user information data table, a virtual machine information data table, and a network tool data table. The user information data table stores information related to network solutions, such as solution name, updater, and project number. The virtual machine information data table stores information related to virtual machine attributes, such as virtual system type and virtual machine number. The network tool data table also stores information related to tool attributes of defense tools, such as tool system type, tool checksum, file extension, and tool number.

[0160] In one embodiment, referring to Figure 9 , is a specific implementation flowchart of step S132 shown in one embodiment. In this embodiment, the step of obtaining second network connection information of a second preset field by querying a preset network information database based on the first network connection information includes:

[0161] Step S1321: Based on the creator information, query the user information data table to obtain network solution information.

[0162] Step S1322: Based on the initial virtual machine information, query the virtual machine information data table to obtain virtual machine attribute information.

[0163] Step S1323: Based on the initial tool information, query the network tool data table to obtain tool attribute information.

[0164] Step S1324: Obtain second network connection information according to the network solution information, the virtual machine attribute information, and the tool attribute information.

[0165] In one embodiment, the second network connection information is supplemented based on the obtained creator information, initial virtual machine information, and initial tool information. Specifically, based on the creator information, the user information data table is queried to obtain the solution name, updater, and project number. Based on the initial virtual machine information, the virtual system type and virtual machine number are queried from the virtual machine information data table. Based on the initial tool information, the network tool data table is queried to obtain the tool system type, tool checksum, file suffix, and tool number. Finally, the obtained information is aggregated into the second network connection information. It is understood that when constructing the preset network information database, the corresponding fields described above can be set as needed to store the relevant information.

[0166] Step S133: Generate first field content according to the first preset field and the first network connection information, and generate second field content according to the second preset field and the second network connection information.

[0167] In one embodiment, based on Figure 5 The data structure of the semi-structured network data shown is shown in Figure 10 The step of filling a first preset field in the semi-structured network data according to the first network connection information to obtain the first field content includes:

[0168] Step S1331: Generate the creator field information of the creator according to the creator information.

[0169] Step S1332: Generate virtual machine name field information of the virtual machine name according to the initial virtual machine information.

[0170] Step S1333: Generate tool name field information of the tool name according to the initial tool information.

[0171] Step S1334: Generate first field content according to the creator field information, the virtual machine name field information, and the tool name field information.

[0172] In one embodiment, assuming that the network connection text information is: "I want to deploy PurpleSharp on virtual machine 3", and the user number of the sender of the message "I" is: Creator 1, then the creator field information is expressed as: {Creator: Creator 1}; the virtual machine name field information is expressed as: {Virtual machine name: Virtual Machine 3}; the tool name field information is expressed as: {Tool name: PurpleSharp}.

[0173] Reference Figure 11 , the first field content is expressed as:

[0174] Creator: Creator1;

[0175] Virtual machine name: virtual machine 1;

[0176] Tool name: PurpleSharp;

[0177] In one embodiment, referring to Figure 12 The step of filling the second preset field according to the second network connection information to obtain the second field content includes:

[0178] Step S1335: Generate network solution field information of the network solution according to the network solution information.

[0179] Step S1336: Generate virtual machine attribute field information of the virtual machine attributes according to the initial virtual machine information.

[0180] Step S1337: Generate tool attribute field information of tool attributes according to the initial tool information.

[0181] Step S1338: Generate second field content according to the network solution field information, the virtual machine attribute field information, and the tool attribute field information.

[0182] In one embodiment, assuming that the plan name is Plan 1, the updater is Updater 1, and the project number is Project 1, the network plan field information is expressed as: {Network Plan: Plan 1, Updater 1, Project 1}; it can be further refined into: {Plan Name: Plan 1}, {Updater: Updater 1} and {Project Number: Project 1}.

[0183] Assuming that the virtual system type is virtual machine type 3 and the virtual machine number is virtual machine number 3, the virtual machine attribute field information is expressed as: {virtual machine attribute: [virtual machine type 3, virtual machine number 3]}, which can be further refined into: {[virtual machine type: virtual machine type 1], [virtual machine number: virtual machine number 1]}.

[0184] Assuming that the tool system type is tool system type 3, the tool check value is check value 3, the file suffix is ​​suffix 3, and the tool number is tool number 3, the tool attribute field information is expressed as: {tool attribute: [tool system type 3, check value 3, suffix 3, tool number 3]}, which can be further refined as: {[tool system type: tool system type 3], [check value: check value 3], [suffix: suffix 3], [tool number: tool number 3]}.

[0185] Reference Figure 11 , the second field content is expressed as:

[0186] Plan name: Plan 1;

[0187] Updater: Updater1;

[0188] Project number: Project 1;

[0189] Virtual machine type: virtual machine type 1;

[0190] Virtual machine number: virtual machine number 1;

[0191] Tool system type: Tool system type 3;

[0192] Check value: check value 3;

[0193] Suffix: suffix3;

[0194] Tool number: Tool number 3;

[0195] In one embodiment, after obtaining the first field content and the second field content, the following steps may be further performed to obtain semi-structured network data.

[0196] Step S134: Generate semi-structured field content according to the first field content and the second field content.

[0197] In one embodiment, the semi-structured field content can be obtained by integrating the first field content and the second field content.

[0198] Step S140: Generate semi-structured network data according to the semi-structured field content.

[0199] In one embodiment, referring to Figure 13 The step of generating semi-structured network data according to the semi-structured field content in step S140 includes:

[0200] Step S141: Acquire a preset semi-structured network data structure.

[0201] Step S142: Filling a preset semi-structured network data structure with the first field content and the second field content to obtain semi-structured network data.

[0202] In one embodiment, the preset semi-structured network data structure may be Figure 5 As shown in the data structure, as in the above embodiment, the first field content and the second field content are used to fill the preset semi-structured network data structure to obtain semi-structured network data, referring to Figure 11 , semi-structured network data is represented as:

[0203] Creator: Creator1;

[0204] Plan name: Plan 1;

[0205] Updater: Updater1;

[0206] Project number: Project 1;

[0207] Virtual machine name: virtual machine 1;

[0208] Virtual machine type: virtual machine type 1;

[0209] Virtual machine number: virtual machine number 1;

[0210] Tool name: PurpleSharp;

[0211] Tool system type: Tool system type 3;

[0212] Check value: check value 3;

[0213] Suffix: suffix3;

[0214] Tool Number: Tool Number 3.

[0215] In one embodiment, after receiving the information confirming the execution of the deployment task, the server backend will match the word information in the text lexical analysis structure with the preset fields of the predefined semi-structured network data structure. The first field content of the first preset field can be directly obtained based on the word information in the text lexical analysis structure. The second field content of the second preset field will be queried and completed by the server backend based on the information corresponding to the three fields of creator, virtual machine name and tool name in the preset network information database including: user information data table, virtual machine information data table and network tool data table, to generate semi-structured data in JSON format, that is, to obtain semi-structured network data. Compared with unstructured text, this data type has the characteristics of easy scalability and high compatibility in the cross-platform data transmission process. Virtual machines running on virtual machines in different target ranges can directly apply the data after receiving it without the need for secondary parsing.

[0216] In one embodiment, the correspondence between the text lexical analysis structure and some fields of the semi-structured network data is shown below.

[0217]

[0218] From the above, it can be seen that the embodiment of the present application will perform lexical analysis on the acquired network connection text information to generate a text lexical analysis structure, and then generate semi-structured field content based on the text lexical analysis structure and preset field identifiers, and then generate semi-structured network data based on the semi-structured field content. The semi-structured network data here is used to describe the defense route. It is a semi-structured JSON data with corresponding grammatical rules that can be recognized by a computer.

[0219] Next, the embodiment of the present application describes how to implement the deployment of the defense route after obtaining the semi-structured network data of the defense route.

[0220] Step S150: constructing a network connection according to the semi-structured network data.

[0221] In one embodiment, the network range uses the Kafka distributed publish-subscribe messaging system for network deployment. Figure 14 , is a specific implementation flowchart of step S150 shown in one embodiment. In this embodiment, the step of establishing a network connection based on semi-structured network data includes:

[0222] Step S151: sending the semi-structured network data to the first target topic for message persistence based on the distributed message subscription system to obtain a first topic message.

[0223] In one embodiment, multiple virtual machines constitute a Kafka cluster, each of which can receive relevant information through Kafka's distributed message subscription system. In Kafka, a topic is a logical concept for storing messages and can be considered a collection of messages. Each message sent to a Kafka cluster has a category. Physically, messages from different topics are stored separately. Each topic can be divided into one or more partitions, and different partitions within the same topic contain different messages. A message is the most basic unit of data in Kafka. In Kafka, a message consists of a key and a value. When sending a message, you can specify the key, and the producer uses the key to determine the partition to which the message should be sent and stored. When each message is added to a partition, it is assigned an offset, which is a unique identifier for the message within that partition. Kafka uses offsets to ensure the order of messages within a partition. Offsets do not cross partitions; that is, Kafka only guarantees the order of messages within the same partition. Each topic can have multiple producers sending messages to it and multiple consumers consuming its messages.

[0224] In one embodiment, referring to Figure 15 , is a specific implementation flowchart of step S151 shown in one embodiment. In this embodiment, based on the distributed message subscription system, semi-structured network data is sent to the first target topic for message persistence. The steps of obtaining the first topic message include:

[0225] Step S1511: Select a virtual machine from the Kafka cluster.

[0226] In one embodiment, in a Kafka-based defense route delivery transaction implementation mechanism, the server backend selects a machine from the Kafka cluster, which can be a pre-set virtual machine or a random selection.

[0227] Step S1512: Send an addressing request to the virtual machine to apply for a producer number from the Kafka transaction manager.

[0228] In one embodiment, a message request for addressing is sent to the above-selected virtual machine, with the purpose of applying for a producer number, represented as a producer ID, from the Kafka transaction manager (TC). The producer can send data directly to the primary partition, and different producers are distinguished by the producer ID.

[0229] Step S1513: Send the semi-structured network data to the first target topic based on the producer ID, and send a persistence request to the Kafka transaction manager.

[0230] Step S1514: After receiving the response information of the persistence request, the first topic message is obtained.

[0231] In one embodiment, after receiving the producer ID assigned by the Kafka transaction manager, the server backend, acting as the producer, sends the semi-structured network data describing the defense route information to a first target topic, which may be named "DP_TASK." It also sends a persistence request to the Kafka transaction manager to persist the semi-structured network data to the "DP_TASK" topic. Upon receiving the persistence request, the Kafka transaction manager persists the structured data to the first target topic. If the persistence is successful, the Kafka transaction manager immediately sends a persistence success response to the server backend, along with a message containing the semi-structured network data in the first target topic.

[0232] Step S152: Send the first topic message to the virtual machine, so that the virtual machine can obtain network tool information according to the first topic message.

[0233] In one embodiment, the background thread of the Kafka transaction manager continuously pulls first topic messages from the queue and sends them to each Kafka partition. A virtual machine is deployed as a consumer in a partition. Therefore, when a virtual machine receives the first topic message under the "DP_TASK" topic as a consumer, it first saves the read identifier to its corresponding partition and returns a response message indicating successful message reception to the Kafka transaction manager. After the Kafka transaction manager receives a successful response from all partitions, it persists a transaction completion message to a topic named "__transaction_state" responsible for persisting transaction messages. Simultaneously, each virtual machine queries the received first topic message for its local name, where the local name is the virtual machine name of the virtual machine. If the virtual machine name field of the first topic message contains the local name, the virtual machine deployment tool content is read from the tool name field of the first topic message. The local deployment tool content here refers to the tool to be deployed on the virtual machine. Based on the local deployment tool content, the corresponding network tool is downloaded from the minio distributed file storage system to the local file system.

[0234] Step S153: receiving a verification result generated by the virtual machine through verification of the network tool information.

[0235] In one embodiment, the verification result is generated by the virtual machine. The specific generation process is: after the virtual machine downloads the network tool to the local file system, it calculates the verification value of each network tool, and matches the verification value with the tool verification value in the tool attribute field information to determine whether the network tool has been completely downloaded. If it is completely downloaded, a verification result of passing the verification is generated, otherwise a verification result of failing the verification is generated.

[0236] In one embodiment, after the virtual machine downloads the relevant file package of the defense tool to the local file system, it calculates the MD5 value of each defense tool respectively and matches it with the tool verification value in the semi-structured network data to determine whether the defense tool has been completely downloaded, and sends the verification result to the server backend.

[0237] Step S154: Establish a network connection according to the verification result, the semi-structured network data and the first judgment condition.

[0238] In one embodiment, the first judgment condition refers to: the verification results returned by all virtual machines that need to deploy defense tools in the semi-structured network data collected by the server backend are all verified passed. Figure 16 In this embodiment, based on the verification result, the semi-structured network data, and the first judgment condition, the step of establishing a network connection includes:

[0239] Step S1541: Determine one or more target virtual machines according to the semi-structured network data.

[0240] Step S1542: Obtain verification results of all target virtual machines.

[0241] Step S1543: If the verification results are all verified to be passed, a network connection is established according to the semi-structured network data.

[0242] In one embodiment, one or more virtual machines (VMs) where defense tools need to be deployed are first identified as target VMs based on semi-structured network data. Verification results for all target VMs are then tallied to determine if they all pass, indicating that each VM has fully downloaded the defense tools. If all verification results pass, a network connection is established based on the semi-structured network data. If any verification fails, the front-end is notified of the defense route deployment failure via a pop-up window or message notification via the WebSocket protocol.

[0243] As can be seen from the above, the network connection construction method based on text semantic processing proposed in the embodiment of the present application is universal and can be widely applied to the generation and deployment of blue team defense routes in the network range. The lexical structure of the unstructured defense route text structure is automatically extracted by lexical analysis. Then, based on the lexical structure, the semi-structured field content is extracted to realize the operation of attribute information extraction, field association, and information completion. The network connection text information is converted into semi-structured network data of the defense route based on the pre-set semi-structured grammar. Then, the virtual machine is notified to execute the defense deployment task through the publish / subscribe model. It takes into account the ease of use of machine-oriented data and the readability of user-oriented data, effectively lowering the learning threshold for blue team users to execute defense route deployment in the shooting range, avoiding the problem of being unable to meet the requirements of timely linkage response due to the high learning threshold of the data structure of semi-structured network data. At the same time, the network connection is constructed according to the semi-structured field content, avoiding the low construction efficiency and easy deployment errors caused by manual deployment, thereby achieving the effect of improving the construction efficiency and accuracy of the network defense route.

[0244] In response to the virtual attack and defense of a network target range, an embodiment of the present invention also provides a method for constructing a defense route during the defense process of the defender (blue team), which specifically includes the following steps: obtaining defense route text information, performing lexical analysis on the defense route text information, generating a defense text lexical analysis structure, generating semi-structured defense field content based on the defense text lexical analysis structure and preset defense fields, generating semi-structured defense route data based on the semi-structured defense field content, and constructing a defense route based on the semi-structured defense route data.

[0245] The specific implementation of the defense route construction method of this embodiment is basically the same as the specific implementation of the above-mentioned network connection construction method, wherein the defense route text information is the network connection text information of the network connection construction method, the defense text lexical analysis structure is the text lexical analysis structure of the network connection construction method, the preset defense field is the preset field of the network connection construction method, the semi-structured defense field content is the semi-structured field content of the network connection construction method, the semi-structured defense route data is the semi-structured network data of the network connection construction method, and the network connection of the defense route network connection construction method, the specific execution process will not be repeated here.

[0246] The embodiment of the present invention also provides a network connection construction device, which can implement the above-mentioned network connection construction method, referring to Figure 17 , the device comprises:

[0247] The text information acquisition module 1710 is used to acquire network connection text information.

[0248] The lexical analysis module 1720 is used to perform lexical analysis on the network connection text information and generate a text lexical analysis structure.

[0249] The field content generation module 1730 is used to generate semi-structured field content based on the text lexical analysis structure and preset field identifiers.

[0250] The network connection data generating module 1740 is configured to generate semi-structured network data according to the semi-structured field contents.

[0251] The network connection building module 1750 is used to build a network connection according to the semi-structured network data.

[0252] The specific implementation of the network connection establishment device of this embodiment is basically the same as the specific implementation of the above-mentioned network connection establishment method, and will not be repeated here.

[0253] An embodiment of the present invention further provides an electronic device, including:

[0254] at least one memory;

[0255] at least one processor;

[0256] at least one program;

[0257] The program is stored in the memory, and the processor executes the at least one program to implement the network connection establishment method of the present invention. The electronic device can be any intelligent terminal including a mobile phone, a tablet computer, a personal digital assistant (PDA), an in-vehicle computer, etc.

[0258] See also Figure 18 , Figure 18 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0259] The processor 1801 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided by the embodiments of the present invention.

[0260] The memory 1802 can be implemented in the form of ROM (Read Only Memory), static storage device, dynamic storage device or RAM (Random Access Memory). The memory 1802 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1802 and is called by the processor 1801 to execute the network connection establishment method of the embodiment of the present invention;

[0261] Input / output interface 1803, used to implement information input and output;

[0262] Communication interface 1804, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.); and

[0263] Bus 1805 , which transmits information between various components of the device (e.g., processor 1801 , memory 1802 , input / output interface 1803 , and communication interface 1804 );

[0264] The processor 1801 , the memory 1802 , the input / output interface 1803 and the communication interface 1804 are connected to each other in communication within the device via the bus 1805 .

[0265] An embodiment of the present application further provides a storage medium, which is a computer-readable storage medium and stores a computer program. When the computer program is executed by a processor, the above-mentioned network connection establishment method is implemented.

[0266] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0267] The network connection construction method, network connection construction device, electronic device, and storage medium proposed in the embodiments of the present invention obtain network connection text information, perform lexical analysis on the network connection text information, generate a text lexical analysis structure, and then generate semi-structured field content based on the text lexical analysis structure and preset field identifiers. Then, semi-structured network data is generated according to the semi-structured field content, and finally, a network connection is constructed according to the semi-structured network data. The embodiment of the present application adopts a lexical analysis method to automatically extract the lexical structure in the text information, and then extracts the semi-structured field content based on the lexical structure. This overcomes the problem that the data structure learning threshold of semi-structured network data is high, resulting in the inability to meet the demand for timely linkage response. At the same time, the network connection is constructed according to the semi-structured field content, avoiding the problem of low construction efficiency caused by manual deployment, thereby achieving the effect of improving the construction efficiency and accuracy of the network defense route.

[0268] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0269] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0270] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0271] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0272] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0273] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0274] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0275] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0276] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0277] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0278] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A method for establishing a network connection, characterized in that: include: Get network connection text information; Performing lexical analysis on the network connection text information to generate a text lexical analysis structure; Extracting information from the text lexical analysis structure based on preset keywords to obtain first network connection information of a first preset field; querying a preset network information database based on the first network connection information to obtain second network connection information of a second preset field; generating first field content based on the first preset field and the first network connection information; generating second field content based on the second preset field and the second network connection information; and generating semi-structured field content based on the first field content and the second field content, wherein the preset keywords include: preposition keywords and verb keywords; generating semi-structured network data according to the semi-structured field content; Building a network connection based on the semi-structured network data; The method of extracting information from the text lexical analysis structure based on preset keywords to obtain first network connection information of a first preset field includes: extracting initial virtual machine information from the text lexical analysis structure based on the prepositional keywords, extracting initial tool information from the text lexical analysis structure based on the verb keywords, obtaining creator information based on the subject pronoun of the text lexical analysis structure, and obtaining the first network connection information based on the creator information, the initial virtual machine information, and the initial tool information.

2. The network connection establishment method according to claim 1, characterized in that: The performing lexical analysis on the network connection text information to generate a text lexical analysis structure includes: Performing a word segmentation operation on the network connection text information to obtain a plurality of text words; Performing sentence part-of-speech analysis on the multiple text words to obtain the parts of speech of the text words; The text lexical analysis structure is generated based on the text words and the parts of speech of the text words.

3. The network connection establishment method according to claim 1, characterized in that: The obtaining the first network connection information according to the creator information, the initial virtual machine information, and the initial tool information includes: querying the preset network information database to determine a first state of the initial virtual machine information, where the first state is a positive state, indicating that the initial virtual machine information is true information; querying the preset network information database to determine a second state of the initial tool information, wherein when the second state is a positive state, it indicates that the initial tool information is true information; When both the first state and the second state are positive states, the first network connection information is obtained according to the creator information, the initial virtual machine information, and the initial tool information.

4. The network connection establishment method according to claim 1, characterized in that: The first preset field includes: creator, virtual machine name, and tool name; generating the first field content according to the first preset field and the first network connection information includes: Generate creator field information of the creator according to the creator information; Generate virtual machine name field information of the virtual machine name according to the initial virtual machine information; Generating tool name field information of the tool name according to the initial tool information; The first field content is generated according to the creator field information, the virtual machine name field information, and the tool name field information.

5. The network connection establishment method according to claim 1, characterized in that: The preset network information database includes: a user information data table, a virtual machine information data table, and a network tool data table; the second network connection information identified by the second preset field obtained by querying the preset network information database based on the first network connection information includes: Obtaining network solution information by querying the user information data table based on the creator information; Obtaining virtual machine attribute information by querying the virtual machine information data table based on the initial virtual machine information; Obtaining tool attribute information by querying the network tool data table based on the initial tool information; The second network connection information is obtained according to the network solution information, the virtual machine attribute information, and the tool attribute information.

6. The network connection establishment method according to claim 5, characterized in that: The second preset field includes: a network solution, virtual machine attributes, and tool attributes; and generating the second field content according to the second preset field and the second network connection information includes: generating network solution field information of the network solution according to the network solution information; Generate virtual machine attribute field information of the virtual machine attribute according to the initial virtual machine information; Generating tool attribute field information of the tool attribute according to the initial tool information; The second field content is generated according to the network solution field information, the virtual machine attribute field information, and the tool attribute field information.

7. The network connection establishment method according to claim 1, characterized in that: Generating semi-structured network data according to the semi-structured field content includes: Obtaining a preset semi-structured network data structure; The preset semi-structured network data structure is filled with the first field content and the second field content to obtain the semi-structured network data.

8. The network connection establishment method according to any one of claims 1 to 7, characterized in that: The step of establishing a network connection according to the semi-structured network data includes: Sending the semi-structured network data to a first target topic for message persistence based on a distributed message subscription system to obtain a first topic message; Sending the first topic message to a virtual machine, so that the virtual machine can obtain network tool information according to the first topic message; receiving a verification result generated by the virtual machine verifying the network tool information; The network connection is established according to the verification result, the semi-structured network data and a first judgment condition; the first judgment condition includes that the verification result is verification passed.

9. The network connection establishment method according to claim 8, characterized in that: The distributed message subscription system is a Kafka system, and the multiple virtual machines constitute a Kafka cluster; the distributed message subscription system sends the semi-structured network data to the first target topic for message persistence to obtain a first topic message, including: Select one of the virtual machines from the Kafka cluster; Send an addressing request to the virtual machine to apply for a producer number from the Kafka transaction manager; Sending the semi-structured network data to the first target topic based on the producer number, and sending a persistence request to the Kafka transaction manager; After receiving the response information of the persistence request, the first topic message is obtained.

10. The network connection establishment method according to claim 9, characterized in that: The sending the first topic message to the virtual machine so that the virtual machine can obtain network connection information according to the first topic message includes: The first topic message is sent to each of the virtual machines so that when the virtual machine receives the first topic message, it queries the local name in the first topic message. If the virtual machine name field information of the first topic message contains the local name, the local deployment tool content is read from the tool name field information of the first topic message, and the corresponding network tool is downloaded according to the local deployment tool content.

11. The network connection establishment method according to claim 10, characterized in that: The receiving a verification result generated by the virtual machine verifying the network tool information, wherein the verification result is generated by the virtual machine executing the following steps: Downloading the network tool to a local file system; Calculate the verification value of each network tool, match the verification value with the tool attribute field information, and determine whether the network tool has been completely downloaded. If it has been completely downloaded, generate the verification result indicating that the verification has passed; otherwise, generate the verification result indicating that the verification has failed.

12. The network connection establishment method according to claim 11, characterized in that: The establishing the network connection according to the verification result and the semi-structured network data includes: determining one or more target virtual machines based on the semi-structured network data; Obtaining the verification results of all the target virtual machines; If the verification results are all verified to be passed, the network connection is established according to the semi-structured network data.

13. A defense route construction method, applied to the defender of a network range, characterized in that: The method for establishing a network connection according to any one of claims 1 to 12 is implemented as follows: Get defense route text information; Performing lexical analysis on the defense route text information to generate a defense text lexical analysis structure; Generating semi-structured defense field content based on the defense text lexical analysis structure and the preset defense field; generating semi-structured defense route data according to the semi-structured defense field content; A defense route is constructed according to the semi-structured defense route data.

14. A network connection establishment device, characterized in that: include: A text information acquisition module is used to obtain network connection text information; A lexical analysis module, configured to perform lexical analysis on the network connection text information and generate a text lexical analysis structure; a field content generation module, configured to extract information from the text lexical analysis structure based on preset keywords to obtain first network connection information for a first preset field, query a preset network information database based on the first network connection information to obtain second network connection information for a second preset field, generate first field content based on the first preset field and the first network connection information, generate second field content based on the second preset field and the second network connection information, and generate semi-structured field content based on the first field content and the second field content, wherein the preset keywords include prepositional keywords and verb keywords; A network connection data generating module, configured to generate semi-structured network data according to the semi-structured field content; A network connection building module, configured to build a network connection according to the semi-structured network data; The method of extracting information from the text lexical analysis structure based on preset keywords to obtain first network connection information of a first preset field includes: extracting initial virtual machine information from the text lexical analysis structure based on the prepositional keywords, extracting initial tool information from the text lexical analysis structure based on the verb keywords, obtaining creator information based on the subject pronoun of the text lexical analysis structure, and obtaining the first network connection information based on the creator information, the initial virtual machine information, and the initial tool information.

15. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the network connection construction method according to any one of claims 1 to 12, or the defense route construction method according to claim 13.

16. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the network connection establishment method according to any one of claims 1 to 12 or the defense route establishment method according to claim 13 is implemented.

Images