Information security detection method, device, equipment and medium

Abstract

The application discloses an information security detection method, device, equipment and medium, and the method comprises the following steps: creating an attack tree corresponding to a preset attack list, and determining a workflow corresponding to each attack path of the attack tree; acquiring a metric of a leaf node of the attack path, determining a first weight value of the workflow corresponding to the attack path according to the metric; sorting the workflow according to the first weight value, performing attack test on each workflow according to the sorting order, and obtaining a detection result of the attack test of each workflow. The application improves the timeliness of attack test on the attack path with a higher priority.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer technology, and in particular to an information security detection method, device, equipment and medium. BACKGROUND

[0002] For network security threats, the inspection mechanisms of different security detection methods are different, and the detection content covers various aspects such as intrusion detection and zombie detection. The existing scheme mainly uses a detection system to identify network attacks and generate alarms, and security personnel complete alarm information screening and threat assessment. However, as the number of network assets is increasing, the number and types of attacks threatening the network are increasing, and it is impossible to timely and efficiently test a large number of attack paths, and higher-level network attacks cannot be detected in time, resulting in major network security incidents. SUMMARY

[0003] The main purpose of the present application is to provide an information security detection method, device, equipment and medium, which aims to solve the problem of how to timely detect higher-level network attacks.

[0004] To achieve the above purpose, the information security detection method provided by the present application comprises the following steps:

[0005] Create an attack tree corresponding to a preset attack list, and determine a workflow corresponding to each attack path of the attack tree;

[0006] Obtain a metric of a leaf node of the attack path, and determine a first weight value of the workflow corresponding to the attack path according to the metric;

[0007] Sort the workflows according to the first weight value, and perform attack testing on each workflow in the order of sorting to obtain a detection result of the attack testing of each workflow.

[0008] In an embodiment, the step of obtaining a metric of a leaf node of the attack path and determining a first weight value of the workflow corresponding to the attack path according to the metric comprises:

[0009] Obtain a metric of a leaf node of the attack path, wherein the metric comprises at least one or more of consumption, consumption time, influence, complexity and / or attack range of the attack on the leaf node;

[0010] Determine a second weight value of the leaf node according to the metric;

[0011] Determine the second weight value of each node in the attack path according to the second weight value;

[0012] determining a first weight value of the corresponding workflow according to the second weight value of each node in the attack path.

[0013] In an embodiment, the step of determining the second weight value of each node in the attack path according to the second weight value comprises:

[0014] obtaining a logical connection relationship between a child node and a parent node in the attack path, wherein the child node comprises the leaf node;

[0015] determining the second weight value of the parent node according to the second weight value of the child node and the logical connection relationship;

[0016] updating the parent node as the child node, and returning to the step of determining the second weight value of the parent node according to the second weight value of the child node and the logical connection relationship until the second weight value of each node in the attack path is determined.

[0017] In an embodiment, the step of determining the second weight value of the parent node according to the second weight value of the child node and the logical connection relationship comprises:

[0018] when the logical connection relationship is an AND gate, determining the second weight value of the parent node according to a product value of the second weight values of all the child nodes of the parent node;

[0019] when the logical connection relationship is an OR gate, determining the second weight value of the parent node according to a minimum value of the second weight values of all the child nodes of the parent node.

[0020] In an embodiment, the step of creating the attack tree corresponding to the preset attack list comprises:

[0021] determining an initial attack tree according to the preset attack list and a preset attack tree model;

[0022] determining database information corresponding to each node in the initial attack tree according to a preset mapping relationship, and marking the corresponding database information in each node;

[0023] determining the attack tree according to the initial attack tree marked with the database information.

[0024] In an embodiment, before the step of determining the workflow corresponding to each attack path of the attack tree, the method further comprises:

[0025] obtaining database information marked by the leaf node of the attack path, and deleting the leaf node if the database information does not belong to the root node in the attack path;

[0026] if the logical connection relationship between the deleted leaf node and the corresponding parent node is an AND gate, the attack path is deleted;

[0027] if the logical connection relationship between the deleted leaf node and the corresponding parent node is an OR gate, all leaf nodes of the attack path are deleted;

[0028] the attack tree is updated according to the deleted attack tree.

[0029] In an embodiment, the step of determining the workflow corresponding to each attack path of the attack tree comprises:

[0030] according to the logical connection relationship between the child node and the parent node in the attack path, the logical connection relationship comprises an AND gate or an OR gate;

[0031] the workflow corresponding to the attack path is generated according to the logical connection relationship.

[0032] To achieve the above object, the present application further provides an information security detection device, which comprises:

[0033] a creating module, configured to create an attack tree corresponding to a preset attack list, and determine a workflow corresponding to each attack path of the attack tree;

[0034] a determining module, configured to obtain a metric of a leaf node of the attack path, and determine a first weight value of the workflow corresponding to the attack path according to the metric;

[0035] a detecting module, configured to sort the workflows according to the first weight value, perform attack test on each workflow according to the sorting order, and obtain a detection result of the attack test of each workflow.

[0036] To achieve the above object, the present application further provides an information security detection device, which comprises a memory, a processor, and an information security detection program stored in the memory and executable on the processor, and each step of the information security detection method is implemented when the information security detection program is executed by the processor.

[0037] To achieve the above object, the present application further provides a computer readable storage medium, which stores an information security detection program, and each step of the information security detection method is implemented when the information security detection program is executed by a processor.

[0038] The application provides an information security detection method, device, equipment and medium, an attack tree corresponding to a preset attack list is created, and a workflow corresponding to each attack path of the attack tree is determined; a metric of a leaf node of the attack path is acquired, a first weight value of the workflow corresponding to the attack path is determined according to the metric; the workflow is sorted according to the first weight value, each workflow is tested according to an order of the sorting, and a detection result of the attack test of each workflow is obtained. The first weight value of the workflow is determined to sort the workflow, the attack path with a higher first weight value is tested preferentially, the timeliness of the attack test of the attack path with a higher priority is improved, and a major network security event is avoided. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 A hardware structure schematic diagram of an information security detection equipment related to an embodiment of the application;

[0040] Figure 2 A flowchart of a first embodiment of an information security detection method of the application;

[0041] Figure 3 A schematic diagram of an attack tree of an information security detection method of the application;

[0042] Figure 4 A detailed flowchart of step S20 of a second embodiment of an information security detection method of the application;

[0043] Figure 5 A detailed flowchart of step S10 of a third embodiment of an information security detection method of the application;

[0044] Figure 6 A schematic diagram of an attack tree model of an information security detection method of the application;

[0045] Figure 7 A logic structure schematic diagram of an information security detection device of the application.

[0046] The implementation, functional features and advantages of the application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0047] It should be understood that the specific embodiments described herein are merely intended to explain the application and are not intended to limit the application.

[0048] The main solution of the embodiment of the application is: an attack tree corresponding to a preset attack list is created, and a workflow corresponding to each attack path of the attack tree is determined; a metric of a leaf node of the attack path is acquired, a first weight value of the workflow corresponding to the attack path is determined according to the metric; the workflow is sorted according to the first weight value, each workflow is tested according to an order of the sorting, and a detection result of the attack test of each workflow is obtained.

[0049] The first weight value of the workflow is determined to sort the workflow, and the attack path with a higher first weight value is tested preferentially, so that the timeliness of the attack test of the attack path with a higher priority is improved, and a major network security event is avoided.

[0050] As an implementation scheme, the information security detection device can be as shown in Figure 1 .

[0051] The embodiment of the application relates to an information security detection device, and the information security detection device comprises a processor 101, such as a CPU, a memory 102, and a communication bus 103. The communication bus 103 is used for realizing the connection and communication among the components.

[0052] The memory 102 can be a high-speed RAM memory or a stable memory (non-volatile memory), such as a disk memory. As shown in Figure 1 , the memory 102 serving as a computer readable storage medium can include an information security detection program; and the processor 101 can be used for calling the information security detection program stored in the memory 102 and performing the following operations:

[0053] An attack tree corresponding to a preset attack list is created, and a workflow corresponding to each attack path of the attack tree is determined;

[0054] A metric of a leaf node of the attack path is acquired, and a first weight value of the workflow corresponding to the attack path is determined according to the metric;

[0055] The workflow is sorted according to the first weight value, each workflow is tested according to an order of the sorting, and a detection result of the attack test of each workflow is obtained.

[0056] In an embodiment, the processor 101 can be used for calling the information security detection program stored in the memory 102 and performing the following operations:

[0057] The metric of the leaf node of the attack path includes at least one or more of a consumption amount of attacking the leaf node, a consumption time length, an influence, a complexity and / or an attack range;

[0058] determining a second weight value of each node in the attack path according to the second weight value of the leaf node;

[0059] determining a second weight value of each node in the attack path according to the second weight value of the leaf node;

[0060] determining a first weight value of the corresponding workflow according to the second weight value of each node in the attack path.

[0061] In an embodiment, the processor 101 can be configured to invoke the information security detection program stored in the memory 102, and perform the following operations:

[0062] obtaining a logical connection relationship between a child node and a parent node in the attack path, wherein the child node includes the leaf node;

[0063] determining a second weight value of the parent node according to the second weight value of the child node and the logical connection relationship;

[0064] updating the parent node to the child node, and returning to perform the step of determining the second weight value of the parent node according to the second weight value of the child node and the logical connection relationship until the second weight value of each node in the attack path is determined.

[0065] In an embodiment, the processor 101 can be configured to invoke the information security detection program stored in the memory 102, and perform the following operations:

[0066] when the logical connection relationship is an AND gate, determining the second weight value of the parent node according to a product value of the second weight values of all the child nodes of the parent node;

[0067] when the logical connection relationship is an OR gate, determining the second weight value of the parent node according to a minimum value in the second weight values of all the child nodes of the parent node.

[0068] In an embodiment, the processor 101 can be configured to invoke the information security detection program stored in the memory 102, and perform the following operations:

[0069] determining an initial attack tree according to a preset attack list and a preset attack tree model;

[0070] determining database information corresponding to each node in the initial attack tree according to a preset mapping relationship, and marking the corresponding database information in each node;

[0071] determining the attack tree according to the initial attack tree marked with the database information.

[0072] In an embodiment, the processor 101 can be configured to invoke the information security detection program stored in the memory 102, and perform the following operations:

[0073] obtain database information of a leaf node label of the attack path, and if the database information does not belong to a root node in the attack path, delete the leaf node;

[0074] if the logical connection relationship between the deleted leaf node and the corresponding parent node is an AND gate, delete the attack path;

[0075] if the logical connection relationship between the deleted leaf node and the corresponding parent node is an OR gate, delete all leaf nodes of the attack path;

[0076] update the attack tree according to the deleted attack tree.

[0077] In an embodiment, the processor 101 can be configured to invoke the information security detection program stored in the memory 102, and perform the following operations:

[0078] according to the logical connection relationship between the child node and the parent node in the attack path, the logical connection relationship includes an AND gate or an OR gate;

[0079] generate the work flow corresponding to the attack path according to the logical connection relationship.

[0080] Based on the hardware architecture of the information security detection device, embodiments of the information security detection method are provided.

[0081] Referring to Figure 2 , Figure 2 For the first embodiment of the information security detection method, the information security detection method comprises the following steps:

[0082] Step S10, creating an attack tree corresponding to a preset attack list, and determining a work flow corresponding to each attack path of the attack tree.

[0083] Specifically, the preset attack list includes data such as target components of attacks and attack methods, and an attack tree corresponding to the preset attack list is created, wherein the attack tree includes multiple attack paths, the root node of the attack tree is the target component of the attack test, the specific attack behavior that the attacker may take is taken as a leaf node, and other nodes can also be included between the root node and the leaf node.

[0084] Optionally, before determining the workflow corresponding to each attack path of the attack tree, the leaf nodes of the attack tree can also be pruned to narrow the scope of the attack. The database information marked by the leaf nodes of the attack path is obtained, and if the database information does not belong to the root node in the attack path, the leaf node is deleted; if the logical connection relationship between the deleted leaf node and the corresponding parent node is an AND gate, i.e., an AND gate, the attack path is deleted; if the logical connection relationship between the deleted leaf node and the corresponding parent node is an OR gate, i.e., an OR gate, all leaf nodes of the attack path are deleted; and the attack tree is updated according to the deleted attack tree.

[0085] determining the workflow corresponding to each attack path of the attack tree, according to the logical connection relationship between the child nodes and the parent nodes in the attack path, the logical connection relationship including an AND gate or an OR gate; and generating the workflow corresponding to the attack path according to the logical connection relationship. For example, as shown in the attack tree, Figure 3 b1 and b2 are connected to c by an OR gate, the attack tree corresponds to three workflows, i.e., a1 to a2 to b1 to c, a3 to b2 to c, and a4 to b2 to c.

[0086] In step S20, the metric of the leaf node of the attack path is obtained, and the first weight value of the workflow corresponding to the attack path is determined according to the metric.

[0087] Specifically, the metric of the leaf node of the attack path is obtained, wherein the metric is used to measure the importance of the attack leaf node, and the metric at least includes the consumption amount, i.e., the money spent on attacking the leaf node; the consumption time, i.e., the time spent on attacking the leaf node; the loss amount, i.e., the loss amount of the leaf node after a successful attack; the complexity, i.e., the difficulty of attacking the leaf node; and the attack range, i.e., whether the attack is within the test range, etc.

[0088] The first weight value of the workflow corresponding to the attack path is determined according to the metric of the leaf node. Optionally, the second weight value of the leaf node is determined according to the metric of the leaf node, and the first weight value of the corresponding workflow is determined according to the product of the second weight values. Optionally, the second weight value of the leaf node is determined according to the metric of the leaf node, the second weight value of each node in the attack path is determined according to the second weight value, and the first weight value of the corresponding workflow is determined according to the product of the second weight values of each node.

[0089] In step S30, the workflows are sorted according to the first weight values, and each workflow is attacked and tested in the order of the sorting, to obtain the detection result of the attack test of each workflow.

[0090] Specifically, the first weight value higher indicates that the priority of the attack path is higher, and the attack test needs to be performed in priority; the first weight value lower indicates that the priority of the attack path is lower, and the attack test does not need to be performed in priority. According to the first weight value, the workflows are sorted, and optionally, the workflows are sorted in descending order of the first weight value, and one or more workflows are attacked in a linear or parallel manner, and optionally, the workflows with high first weight values are attacked in priority. After the attack test, each workflow corresponds to a detection result, wherein the detection result includes attack success or attack failure. When the detection result is attack failure, it is necessary to determine whether the mapping relationship of the database information of the attack tree is correct, if not, delete the mapping relationship, and the attack success workflow is marked as low permission. When the detection result is attack success, the attack test of the next workflow is performed, and the attack success workflow is marked as high permission.

[0091] In the technical scheme of the embodiment, a preset attack list corresponding attack tree is created, and a workflow corresponding to each attack path of the attack tree is determined; a metric of a leaf node of the attack path is obtained, and a first weight value of the workflow corresponding to the attack path is determined according to the metric; the workflows are sorted according to the first weight value, and each workflow is attacked according to the sorting order to obtain a detection result of the attack test of each workflow. By determining the first weight value of the workflow to sort the workflow, the attack path with a higher first weight value is tested in priority, which improves the timeliness of the attack test of the attack path with a higher priority and avoids major network security incidents.

[0092] Reference Figure 4 , Figure 4 For the second embodiment of the information security detection method of the present application, based on the first embodiment, the step S20 comprises:

[0093] Step S21, obtaining a metric of a leaf node of the attack path, the metric comprising at least one or more of consumption amount, consumption time, influence, complexity and / or attack range of the attack on the leaf node;

[0094] Step S22, determining a second weight value of the leaf node according to the metric;

[0095] Step S23, determining the second weight value of each node in the attack path according to the second weight value;

[0096] Step S24, determining a first weight value of the corresponding workflow according to the second weight value of each node in the attack path.

[0097] Specifically, the metrics of the leaf nodes of the attack path are obtained, wherein the metrics are used to measure the importance of the attack leaf nodes, and the metrics at least include consumption, i.e., the money spent on attacking the leaf nodes; consumption time, i.e., the time spent on attacking the leaf nodes; loss, i.e., the loss of the leaf nodes after a successful attack; complexity, i.e., the difficulty of attacking the leaf nodes; and attack range, i.e., whether the attack is within the test range.

[0098] The second weight value of each node in the attack path is determined according to the second weight value of the leaf node. Optionally, the logical connection relationship between the child nodes and the parent node in the attack path is obtained, wherein the child nodes include the leaf nodes. The second weight value of the parent node is determined according to the second weight value of the child node and the logical connection relationship. Optionally, when the logical connection relationship is an AND gate, the second weight value of the parent node is determined according to the product value of the second weight values of all child nodes of the parent node. Optionally, when the logical connection relationship is an OR gate, the second weight value of the parent node is determined according to the minimum value in the second weight values of all child nodes of the parent node. Optionally, when the logical connection relationship is an AND gate, the second weight value of the parent node is determined according to the weighted average value of the second weight values of all child nodes of the parent node. Optionally, when the logical connection relationship is an OR gate, the second weight value of the parent node is determined according to the maximum value in the second weight values of all child nodes of the parent node.

[0099] After the second weight value of the parent node is determined according to the second weight value of the child node and the logical connection relationship, the parent node is updated to the child node, and the step of determining the second weight value of the parent node according to the second weight value of the child node and the logical connection relationship is executed again until the second weight value of each node in the attack path is determined.

[0100] In the technical scheme of the embodiment, the metrics of the leaf nodes of the attack path are obtained, and the metrics at least include one or more of the consumption, the consumption time, the influence, the complexity, and / or the attack range of the attack leaf nodes; the second weight value of the leaf node is determined according to the metrics; the second weight value of each node in the attack path is determined according to the second weight value; and the first weight value of the corresponding workflow is determined according to the second weight value of each node in the attack path. The second weight value of the leaf node of the attack path is determined by the metrics, and then the second weight value of each node in the attack path is determined, and the first weight value of the workflow is determined according to the second weight value of each node, so that the workflow that needs to be attacked and tested first is accurately determined, so that important workflows can be attacked and tested in time, and a major network security event can be avoided.

[0101] Referring to Figure 5 , Figure 5 For the second embodiment of the information security detection method, based on the first embodiment, the step S10 includes:

[0102] Step S11, determining an initial attack tree according to a preset attack list and a preset attack tree model;

[0103] Step S12, determining database information corresponding to each node in the initial attack tree according to a preset mapping relationship, and marking the corresponding database information in each node;

[0104] Step S13, determining the attack tree according to the initial attack tree marked with the database information.

[0105] Specifically, the preset attack list includes data such as target components and attack methods of attacks, and the preset attack tree model has three types, as shown in the following table. Figure 6 The attack tree model a represents an or gate, the attack tree model b represents an and gate, and the attack tree model c represents a sequential and gate. The initial attack tree is determined according to the preset attack list and the preset attack tree model, and the attack tree model can be added with a new attack path or sorted by an attack tree model editor. The initial attack tree includes multiple attack paths, and the root node of the initial attack tree is the target component of the attack test. Optionally, if the target component of the attack tree is a database protected by a firewall and uses the HTTP (Hyper Text Transfer Protocol) protocol to transmit data, the attack tree model is designed to be attached to the firewall, and each leaf node on the attack tree model is attached to a second attack tree model, the second attack tree mainly attacks the HTTP channel, and then the leaf nodes of the second attack tree are attached to a third attack tree instance, and so on. Optionally, the target component of the attack tree can be a database or a firewall, and the attack methods of the database include SQL (Structured Query Language) injection and DLL hijacking. For example, an attack path of "reading data from a database" corresponds to two nodes "using SQL injection" and "traffic sniffing", and the two nodes are connected by an or gate.

[0106] The database information corresponding to each node in the initial attack tree is determined according to a preset mapping relationship, and the corresponding database information is marked in each node. For example, SQL injection is marked as "SQL", and cross-site scripting is marked as "user input". After determining the database information corresponding to each node, the attack tree is determined according to the initial attack tree marked with the database information.

[0107] In the technical scheme of the embodiment, the initial attack tree is determined according to the preset attack list and the preset attack tree model; the database information corresponding to each node in the initial attack tree is determined according to the preset mapping relationship, and the corresponding database information is marked in each node; and the attack tree is determined according to the initial attack tree marked with the database information. By using the generated attack tree marked with the database information, the attack path can be accurately determined, and the work flow corresponding to the attack path can be tested in time.

[0108] With reference to Figure 7 The application further provides an information security detection device, which comprises:

[0109] A creating module 100 is configured to create an attack tree corresponding to a preset attack list, and determine a work flow corresponding to each attack path of the attack tree;

[0110] A determining module 200 is configured to acquire a metric of a leaf node of the attack path, and determine a first weight value of the work flow corresponding to the attack path according to the metric;

[0111] A detecting module 300 is configured to sort the work flows according to the first weight values, test each work flow according to the sorting order, and obtain a detection result of the attack test of each work flow.

[0112] In an embodiment, in the process of acquiring a metric of a leaf node of the attack path, and determining a first weight value of the work flow corresponding to the attack path according to the metric, the determining module 200 is specifically configured to:

[0113] acquire the metric of the leaf node of the attack path, wherein the metric at least includes one or more of a consumption amount, a consumption time length, an influence, a complexity and / or an attack range of the attack on the leaf node;

[0114] determine a second weight value of the leaf node according to the metric;

[0115] determine the second weight value of each node in the attack path according to the second weight value;

[0116] determine the first weight value of the corresponding work flow according to the second weight value of each node in the attack path.

[0117] In an embodiment, in the process of determining the second weight value of each node in the attack path according to the second weight value, the determining module 200 is specifically configured to:

[0118] acquire a logical connection relationship between a child node and a parent node in the attack path, wherein the child node includes the leaf node;

[0119] determining the second weight value of the parent node according to the second weight value of the child node and the logical connection relationship;

[0120] updating the parent node as the child node, and returning to execute the step of determining the second weight value of the parent node according to the second weight value of the child node and the logical connection relationship until the second weight value of each node in the attack path is determined.

[0121] In an embodiment, in the aspect of determining the second weight value of the parent node according to the second weight value of the child node and the logical connection relationship, the determining module 200 is specifically configured to:

[0122] when the logical connection relationship is an AND gate, determining the second weight value of the parent node according to the product value of the second weight values of all the child nodes of the parent node;

[0123] when the logical connection relationship is an OR gate, determining the second weight value of the parent node according to the minimum value of the second weight values of all the child nodes of the parent node.

[0124] In an embodiment, in the aspect of creating the attack tree corresponding to the preset attack list, the creating module 100 is specifically configured to:

[0125] determining an initial attack tree according to the preset attack list and a preset attack tree model;

[0126] determining the database information corresponding to each node in the initial attack tree according to the preset mapping relationship, and marking the corresponding database information in each node;

[0127] determining the attack tree according to the initial attack tree marked with the database information.

[0128] In an embodiment, in the aspect of determining the workflow corresponding to each attack path of the attack tree, the creating module 100 is specifically configured to:

[0129] obtaining the database information marked by the leaf node of the attack path, and if the database information does not belong to the root node in the attack path, deleting the leaf node;

[0130] if the logical connection relationship between the deleted leaf node and the corresponding parent node is an AND gate, deleting the attack path;

[0131] if the logical connection relationship between the deleted leaf node and the corresponding parent node is an OR gate, deleting all the leaf nodes of the attack path;

[0132] updating the attack tree according to the attack tree after the deletion.

[0133] In an embodiment, the creating module 100 is specifically configured to:

[0134] According to the logical connection relationship between the child node and the parent node in the attack path, the logical connection relationship comprises an AND gate or an OR gate.

[0135] According to the logical connection relationship, the attack path corresponds to the workflow.

[0136] The present application also provides an information security detection device, which comprises a memory, a processor, and an information security detection program stored in the memory and executable on the processor, and each step of the information security detection method according to the above embodiment is implemented when the information security detection program is executed by the processor.

[0137] The present application also provides a computer readable storage medium, which stores an information security detection program, and each step of the information security detection method according to the above embodiment is implemented when the information security detection program is executed by a processor.

[0138] The above-mentioned embodiment numbers of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments.

[0139] It should be noted that, in this document, the term "comprising" or "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, system, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such a process, system, article or device. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, system, article or device including the element.

[0140] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment system can be realized by means of software and necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a computer readable storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for making a terminal device (which can be a mobile phone, computer, parking management device, air conditioner, or network device, etc.) execute the system described in each embodiment of the present application.

[0141] The above merely describes the preferred embodiments of the present application, and is not intended to limit the patent scope of the present application, and any equivalent structure or equivalent process conversion, or direct or indirect application in other related technical fields, which are made by using the content of the present application specification and drawings, are also included in the patent protection scope of the present application.

Claims

1. An information security detection method, characterized in that, The information security detection method includes: Create an attack tree corresponding to a pre-defined attack list; Obtain the database information of the leaf node markers of the attack path of the attack tree. If the database information does not belong to the root node in the attack path, delete the leaf node. If the logical connection between the deleted leaf node and its corresponding parent node is an AND gate, then the attack path is deleted. If the logical connection between the deleted leaf node and its corresponding parent node is an OR gate, then all leaf nodes of the attack path are deleted. Update the attack tree based on the deleted attack tree; Determine the workflow corresponding to each attack path in the attack tree; Obtain the metric of the leaf node of the attack path, and determine the first weight value of the workflow corresponding to the attack path based on the metric; The workflows are sorted according to the first weight value, and attack tests are performed on each workflow in the sorting order to obtain the detection results of the attack tests for each workflow.

2. The information security detection method as described in claim 1, characterized in that, The step of obtaining the metric of the leaf node of the attack path and determining the first weight value of the workflow corresponding to the attack path based on the metric includes: Obtain the metrics of the leaf nodes of the attack path, wherein the metrics include at least one or more of the following: the amount of consumption, duration of consumption, impact, complexity, and / or attack range of the attack on the leaf nodes. The second weight value of the leaf node is determined based on the metric. The second weight value is determined for each node in the attack path based on the second weight value; The first weight value of the workflow is determined based on the second weight value of each node in the attack path.

3. The information security detection method as described in claim 2, characterized in that, The step of determining the second weight value of each node in the attack path based on the second weight value includes: Obtain the logical connection relationship between child nodes and parent nodes in the attack path, wherein the child nodes include the leaf nodes; The second weight value of the parent node is determined based on the second weight value of the child node and the logical connection relationship; Update the parent node to the child node, and return to the step of determining the second weight value of the parent node based on the second weight value of the child node and the logical connection relationship, until the second weight value of each node in the attack path is determined.

4. The information security detection method as described in claim 3, characterized in that, The step of determining the second weight value of the parent node based on the second weight value of the child node and the logical connection relationship includes: When the logical connection relationship is an AND gate, the second weight value of the parent node is determined based on the product of the second weight values ​​of all the child nodes of the parent node; When the logical connection relationship is an OR gate, the second weight value of the parent node is determined based on the minimum value among all the second weight values ​​of the parent node's child nodes.

5. The information security detection method as described in claim 1, characterized in that, The steps for creating the attack tree corresponding to the preset attack list include: The initial attack tree is determined based on the preset attack list and the preset attack tree model; The database information corresponding to each node in the initial attack tree is determined according to the preset mapping relationship, and the corresponding database information is marked in each node; The attack tree is determined based on the initial attack tree marked with database information.

6. The information security detection method as described in claim 1, characterized in that, The step of determining the workflow corresponding to each attack path of the attack tree includes: Based on the logical connection relationship between child nodes and parent nodes in the attack path, the logical connection relationship includes AND gates or OR gates; The workflow corresponding to the attack path is generated based on the logical connection relationship.

7. An information security detection device, characterized in that, The information security detection device includes: A creation module is used to create an attack tree corresponding to a preset attack list; obtain database information of leaf node markers for attack paths; if the database information does not belong to the root node in the attack path, delete the leaf node; if the logical connection between the deleted leaf node and its corresponding parent node is an AND gate, delete the attack path; if the logical connection between the deleted leaf node and its corresponding parent node is an OR gate, delete all leaf nodes of the attack path; update the attack tree according to the deleted attack tree; and determine the workflow corresponding to each attack path in the attack tree. The determination module is used to obtain the metric of the leaf node of the attack path and determine the first weight value of the workflow corresponding to the attack path based on the metric. The detection module is used to sort the workflows according to the first weight value, perform attack tests on each workflow in the sorting order, and obtain the detection result of the attack test for each workflow.

8. An information security detection device, characterized in that, The information security detection device includes a memory, a processor, and an information security detection program stored in the memory and executable on the processor. When the information security detection program is executed by the processor, it implements the various steps of the information security detection method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an information security detection program, which, when executed by a processor, implements the steps of the information security detection method as described in any one of claims 1-6.

Images