A security testing method, device, computer equipment and storage medium

Abstract

The present application provides a security testing method, device, computer equipment and storage medium, which can be applied to cloud computing or intelligent transportation fields, etc., to solve the problem of low accuracy and reliability of security test results. The method includes: in a cloud-native security testing environment, performing a cloud-native security attack test on a target host to obtain a first attack test result; based on the first attack test result, obtaining a first usage permission of the target host, and accessing the local area network security testing environment corresponding to the target host based on the first usage permission; in the local area network security testing environment, performing a local area network security attack test on a core network server to obtain a second attack test result; using the first attack test result and the second attack test result as the target security test result to avoid destroying the correlation between the vulnerabilities and improve the accuracy and reliability of the security test results obtained in the cloud-native scenario.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a security testing method, apparatus, computer equipment, and storage medium. Background Art

[0002] Cloud Native is a methodology for developing and running applications based on cloud technology. With the continuous development of cloud native technology, more and more devices can run cloud native applications based on cloud native technology, and data can be exchanged between devices through their own cloud native applications.

[0003] During data exchange, cloud-native applications running on devices are vulnerable to security attacks, posing security risks to the data exchange process. Therefore, it is necessary to conduct security testing for potential security vulnerabilities in the data exchange process, identify the security vulnerabilities that need to be fixed, and then perform the vulnerability repair process.

[0004] In the traditional security testing process, it is necessary to build corresponding test environments for various security vulnerabilities that may exist in the data interaction process, and conduct security tests independently based on various test environments.

[0005] However, during data interaction in cloud-native scenarios, cloud-native security vulnerabilities may be correlated with other security vulnerabilities. Existing security testing processes, when conducted independently in the cloud-native test environment and in other security test environments, disrupt the correlation between other security vulnerabilities and cloud-native security vulnerabilities. Even if there are related security vulnerabilities requiring remediation in the other security test environment, these cannot be detected through independent security testing. Consequently, the security test results obtained indicate that there are no security vulnerabilities requiring remediation in the other security test environment, creating security risks in the data interaction process.

[0006] It can be seen that under relevant technologies, the security test results obtained in cloud-native scenarios have low accuracy and reliability. Summary of the Invention

[0007] Embodiments of the present application provide a security testing method, apparatus, computer device, and storage medium for improving the accuracy and reliability of security testing results in cloud-native scenarios.

[0008] In a first aspect, a security testing method is provided, comprising:

[0009] In the cloud-native security testing environment, use the preset cloud-native attack testing strategies to conduct cloud-native security attack tests on the target host to obtain the first attack test results.

[0010] Based on the first attack test result, obtaining a first usage permission of the target host machine, and accessing a local area network security test environment corresponding to the target host machine based on the first usage permission;

[0011] In the LAN security test environment, using preset LAN attack test strategies, performing a LAN security attack test on the core network server to obtain a second attack test result;

[0012] The first attack test result and the second attack test result are used as target security test results.

[0013] In a second aspect, a safety testing device is provided, comprising:

[0014] A first processing module is configured to perform a cloud native security attack test on a target host machine using preset cloud native attack test strategies in a cloud native security test environment to obtain a first attack test result;

[0015] The first processing module is further configured to obtain a first usage permission of the target host machine based on the first attack test result, and access a local area network security test environment corresponding to the target host machine based on the first usage permission;

[0016] A second processing module is configured to perform a LAN security attack test on the core network server using preset LAN attack strategies in the LAN security test environment to obtain a second attack test result;

[0017] The second processing module is further configured to use the first attack test result and the second attack test result as target security test results.

[0018] Optionally, the first processing module is further configured to:

[0019] In the cloud-native security testing environment, a cloud-native security attack test is performed on a target host using various preset cloud-native attack test strategies. Before obtaining the first attack test result, the installation files of each pre-stored cloud-native application are obtained, wherein each installation file is pre-installed with a cloud-native security vulnerability corresponding to the cloud-native application.

[0020] Generate corresponding vulnerability image files based on the respective installation files pre-installed with the cloud native security vulnerabilities corresponding to the cloud native applications;

[0021] Based on the vulnerability image files, the cloud native security testing environment is built.

[0022] Optionally, the first processing module is specifically configured to:

[0023] For each cloud-native application, perform the following operations:

[0024] Obtaining candidate files corresponding to respective installation versions of a cloud-native application, wherein the candidate files include installation files and application update logs of the cloud-native application;

[0025] Based on the application update logs included in each candidate file, select, from the candidate files, a candidate file whose installation file is pre-set with a cloud-native security vulnerability as the target file;

[0026] The installation file contained in the target file is used as the installation file of the cloud-native application.

[0027] Optionally, the first processing module is specifically configured to:

[0028] For each installation file, perform the following operations:

[0029] Based on the preset application coding policy, determine the file complexity of the first component file in an installation file that has a pre-set cloud native security vulnerability;

[0030] When it is determined that the file complexity is not greater than the complexity threshold, multiple candidate image templates matching the first component file are selected from the candidate image templates as target image templates;

[0031] The selected multiple target image templates are arranged and combined to generate a vulnerability image file for the cloud native security vulnerability.

[0032] Optionally, the first processing module is specifically configured to:

[0033] For each installation file, perform the following operations:

[0034] Extract the first component file with pre-installed cloud native security vulnerabilities from an installation file;

[0035] Determining, from the various cloud-native attack testing strategies, a cloud-native attack testing strategy corresponding to the vulnerability type of the cloud-native security vulnerability, and generating a second component file based on the determined cloud-native attack testing strategy;

[0036] The first component file and the second component file are jointly mirrored to obtain a vulnerability mirror file of the cloud native security vulnerability.

[0037] Optionally, the first processing module is specifically configured to:

[0038] Performing mirroring on the first component file and the second component file respectively to obtain a first component mirror file and a second component mirror file respectively;

[0039] Based on a pre-existing image file configuration policy, configuring an association relationship between the first component image file and the second component image file;

[0040] Based on the first component image file, the second component image file, and the association relationship, a vulnerability image file of the cloud native security vulnerability is generated.

[0041] Optionally, the first processing module is further configured to:

[0042] Before accessing the LAN security test environment corresponding to the target host machine based on the first usage permission, determining a network structure of the target LAN corresponding to the first usage permission;

[0043] Based on the network structure, generating a first configuration file, wherein the first configuration file is used to configure the target local area network according to each local area network attack test strategy;

[0044] generating a second configuration file based on a pre-stored operation and maintenance policy of the target local area network, wherein the second configuration file is used to maintain the target local area network;

[0045] The local area network security test environment is established based on the first configuration file and the second configuration file.

[0046] Optionally, the first processing module is specifically configured to:

[0047] Based on the network structure, determining an association relationship between various devices included in the network structure;

[0048] Determining configuration information of each device based on each LAN attack test strategy;

[0049] Based on the association relationship and various configuration information, a first configuration file is generated.

[0050] Optionally, the first processing module is specifically configured to:

[0051] Simulating each device included in the network structure with a virtual machine to obtain a virtual device corresponding to each device;

[0052] Based on the first configuration file and the second configuration file, respectively configure each virtual device;

[0053] Add network connections to the respective virtual devices to obtain the local area network security test environment.

[0054] Optionally, each of the cloud-native attack testing strategies includes multiple container escape testing strategies; and the first processing module is specifically configured to:

[0055] In the cloud-native security testing environment, executing each of the multiple container escape testing strategies in sequence, and during each execution, when it is determined that the first usage permission is obtained, generating the first attack test result indicating that a container escape vulnerability exists in the cloud-native security testing environment;

[0056] After executing the multiple container escape test strategies, when it is determined that the first usage permission is not obtained, the first attack test result is generated, indicating that no container escape vulnerability exists in the cloud-native security test environment.

[0057] Optionally, the second processing module is specifically configured to:

[0058] In the local area network security test environment, determining whether there is an unencrypted designated database;

[0059] When it is determined that an unencrypted designated database exists, adding a second usage permission of the core network server to the designated database, and generating a second attack test result indicating that an unauthorized database access vulnerability exists in the local area network security test environment based on the second usage permission;

[0060] When it is determined that no unencrypted designated database exists, a second attack test result is generated, indicating that no database unauthorized access vulnerability exists in the local area network security test environment.

[0061] Optionally, the second processing module is specifically configured to:

[0062] When it is determined that the first attack test result indicates the existence of a container escape vulnerability and the second attack test result indicates the existence of an unauthorized database access vulnerability, a target security test result is generated indicating that both the cloud native security test environment and the local area network security test environment have security test vulnerabilities;

[0063] When it is determined that the first attack test result indicates the existence of a container escape vulnerability and the second attack test result indicates the absence of a database unauthorized access vulnerability, a target security test result is generated indicating that only the cloud native security test environment has a security test vulnerability;

[0064] When it is determined that the first attack test result indicates that there is no container escape vulnerability, a target security test result is generated, indicating that there are no security test vulnerabilities in the cloud native security test environment and the local area network security test environment.

[0065] According to a third aspect, a computer program product is provided, comprising a computer program, which implements the method according to the first aspect when executed by a processor.

[0066] According to a fourth aspect, a computer device is provided, comprising:

[0067] a memory for storing program instructions;

[0068] The processor is configured to call the program instructions stored in the memory and execute the method described in the first aspect according to the obtained program instructions.

[0069] In a fifth aspect, a computer-readable storage medium is provided, wherein the storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the method described in the first aspect.

[0070] In the embodiment of the present application, a cloud-native security attack test is conducted on a target host based on a cloud-native security test environment. When a cloud-native security vulnerability exists, the first user permission of the target host can be obtained. This allows access to the local area network (LAN) security test environment corresponding to the target host based on the first user permission to conduct LAN security attack tests on core network servers. This complete attack test path is more consistent with a real cloud-native scenario, avoiding the destruction of the correlation between other security vulnerabilities and cloud-native security vulnerabilities when security tests are conducted independently in the cloud-native test environment and other security test environments. This improves the accuracy and reliability of security test results obtained in cloud-native scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 An application scenario of the security testing method provided in the embodiment of the present application;

[0072] Figure 2 A schematic diagram of a safety testing method provided in this embodiment of the application Figure 1 ;

[0073] Figure 3 A schematic diagram of the principle of the security testing method provided in the embodiment of the present application Figure 1 ;

[0074] Figure 4a A schematic diagram of a safety testing method provided in this embodiment of the application Figure 2 ;

[0075] Figure 4b A schematic diagram of the principle of the security testing method provided in the embodiment of the present application Figure 2 ;

[0076] Figure 4c A schematic diagram of the principle of the security testing method provided in the embodiment of the present application Figure 3 ;

[0077] Figure 5 A schematic diagram of a safety testing method provided in this embodiment of the application Figure 3 ;

[0078] Figure 6 A fourth schematic diagram of a principle of a security testing method provided in an embodiment of the present application;

[0079] Figure 7 A schematic diagram of the principle of the security testing method provided in the embodiment of the present application Figure 5 ;

[0080] Figure 8 A structural diagram of a safety testing device provided in an embodiment of the present application Figure 1 ;

[0081] Figure 9 A structural diagram of a safety testing device provided in an embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0082] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0083] Some of the terms used in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0084] (1) Cloud Native:

[0085] In cloud native, "Cloud" means that the application is located in the cloud, not in a traditional data center. "Native" means that the application is designed with the cloud environment in mind from the beginning. It is designed for the cloud and runs optimally on the cloud, fully leveraging the elasticity and distributed advantages of the cloud platform.

[0086] Cloud native technologies include containers, service meshes, microservices, immutable infrastructure, and declarative APIs.

[0087] (2)Docker:

[0088] Docker is an application container engine that can also achieve virtualization by packaging applications and dependent packages into a portable image and then publishing it to machines with operating systems such as Linux or Windows.

[0089] (3) Kubernetes:

[0090] In Kubernetes, you can create multiple containers, each of which runs an application instance. Through the built-in load balancing strategy, you can manage, discover, and access a group of application instances.

[0091] The embodiments of the present application relate to cloud computing technology and blockchain technology, and are designed based on cloud storage technology. They can be applied to the fields of artificial intelligence, smart transportation, or mapping, etc.

[0092] Cloud computing is a computing model that distributes computing tasks across a resource pool consisting of a large number of computers, enabling various application systems to access computing power, storage space, and information services as needed. The network that provides these resources is called the "cloud." To users, these resources appear infinitely scalable and can be accessed at any time, used on demand, expanded at any time, and paid for on a pay-per-use basis.

[0093] As a provider of cloud computing infrastructure, a cloud computing resource pool (referred to as a cloud platform, generally referred to as an Infrastructure as a Service (IaaS) platform) is established. Various types of virtual resources are deployed in the resource pool for external customers to choose and use. The cloud computing resource pool mainly includes: computing devices (virtualized machines, including operating systems), storage devices, and network devices.

[0094] Based on logical functional divisions, the Platform as a Service (PaaS) layer can be deployed on top of the IaaS layer, and the Software as a Service (SaaS) layer can be deployed on top of the PaaS layer. SaaS can also be deployed directly on top of IaaS. PaaS is a platform for software execution, such as databases and web containers. SaaS is a variety of business software, such as web portals and text messaging apps. Generally speaking, SaaS and PaaS are upper layers relative to IaaS.

[0095] Cloud storage is a new concept that has been extended and developed from the concept of cloud computing. A distributed cloud storage system (hereinafter referred to as a storage system) refers to a storage system that uses cluster applications, grid technology, and distributed storage file systems to bring together a large number of different types of storage devices (storage devices are also called storage nodes) in the network through application software or application interfaces to work together and provide external data storage and business access functions.

[0096] Currently, storage systems utilize a method for creating logical volumes. When creating a logical volume, physical storage space is allocated for each logical volume. This physical storage space may consist of disks on a specific storage device or several storage devices. When a client stores data on a logical volume, it stores the data on a file system. The file system divides the data into multiple parts, each of which is an object. An object contains not only the data but also additional information such as the data identifier (ID entity). The file system writes each object to the physical storage space of the logical volume and records the storage location information for each object. Therefore, when a client requests access to data, the file system can provide access based on the storage location information for each object.

[0097] The storage system allocates physical storage space to logical volumes by pre-dividing the physical storage space into stripes based on the estimated capacity of the objects to be stored in the logical volume (this estimate often has a large margin relative to the actual capacity of the objects to be stored) and the Redundant Array of Independent Disks (RAID) groupings. A logical volume can be understood as a stripe, thereby allocating physical storage space to the logical volume.

[0098] Blockchain is a new application model for computer technologies, including distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a series of data blocks linked using cryptographic methods. Each block contains information about a batch of online transactions, used to verify the validity of this information (to prevent counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, the platform product and service layer, and the application service layer.

[0099] The underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operation monitoring. Among them, the user management module is responsible for the identity information management of all blockchain participants, including maintaining public and private key generation (account management), key management, and maintaining the corresponding relationship between the user's real identity and the blockchain address (authority management), etc., and under authorization, it supervises and audits the transactions of certain real identities and provides risk control rule configuration (risk control audit); the basic service module is deployed on all blockchain node devices to verify the validity of business requests, and records the valid requests to the storage after consensus is reached. For a new business request, the basic service first adapts the interface to parse and authenticate the request (interface adaptation), and then encrypts the business information through the consensus algorithm (consensus management). The smart contract module is responsible for the registration, issuance, triggering and execution of contracts. Developers can define the contract logic in a programming language and publish it to the blockchain (contract registration). According to the logic of the contract terms, the contract logic is triggered by calling keys or other events to trigger execution. The contract logic is completed, and the contract upgrade and cancellation functions are also provided. The operation monitoring module is mainly responsible for the deployment, configuration modification, contract setting, cloud adaptation and real-time status visualization output of the product during the product release process, such as alarms, network status monitoring, and node equipment health status monitoring.

[0100] The platform's product service layer provides the basic capabilities and implementation framework for typical applications. Developers can build on these basic capabilities, overlay business features, and complete the blockchain implementation of business logic. The application service layer provides application services based on blockchain solutions for business participants to use.

[0101] It should be noted that in the embodiments of this application, when the user data involved is applied to specific products or technologies, user permission or consent must be obtained, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0102] The following is a brief introduction to the application areas of the security testing method provided in the embodiments of the present application.

[0103] With the continuous development of cloud-native technology, more and more devices can run cloud-native applications based on cloud-native technology, and data can be exchanged between devices through the cloud-native applications they run.

[0104] During data exchange, cloud-native applications running on devices are vulnerable to security attacks, posing security risks to the data exchange process. Therefore, it is necessary to conduct security testing for potential security vulnerabilities in the data exchange process, identify the security vulnerabilities that need to be fixed, and then perform the vulnerability repair process.

[0105] In the traditional security testing process, it is necessary to build corresponding test environments for various security vulnerabilities that may exist in the data interaction process, and conduct security tests independently based on various test environments.

[0106] However, during data interaction in cloud-native scenarios, cloud-native security vulnerabilities may be correlated with other security vulnerabilities. Existing security testing processes, when conducted independently in the cloud-native test environment and in other security test environments, disrupt the correlation between other security vulnerabilities and cloud-native security vulnerabilities. Even if there are related security vulnerabilities requiring remediation in the other security test environment, these cannot be detected through independent security testing. Consequently, the security test results obtained indicate that there are no security vulnerabilities requiring remediation in the other security test environment, creating security risks in the data interaction process.

[0107] It can be seen that under relevant technologies, the security test results obtained in cloud-native scenarios have low accuracy and reliability.

[0108] In order to solve the problem of low accuracy and reliability of security test results obtained in cloud-native scenarios, the present application proposes a security testing method. In this method, in a cloud-native security testing environment, various preset cloud-native attack test strategies are adopted to perform cloud-native security attack tests on the target host to obtain a first attack test result. Based on the first attack test result, the first usage permission of the target host is obtained, and the LAN security testing environment corresponding to the target host is accessed based on the first usage permission. In the LAN security testing environment, various preset LAN attack test strategies are adopted to perform LAN security attack tests on the core network server to obtain a second attack test result. The first attack test result and the second attack test result are used as the target security test result.

[0109] In the embodiment of the present application, a cloud-native security attack test is conducted on a target host based on a cloud-native security test environment. When a cloud-native security vulnerability exists, the first user permission of the target host can be obtained. This allows access to the local area network (LAN) security test environment corresponding to the target host based on the first user permission to conduct LAN security attack tests on core network servers. This complete attack test path is more consistent with a real cloud-native scenario, avoiding the destruction of the correlation between other security vulnerabilities and cloud-native security vulnerabilities when security tests are conducted independently in the cloud-native test environment and other security test environments. This improves the accuracy and reliability of security test results obtained in cloud-native scenarios.

[0110] The following describes the application scenarios of the security testing method provided in this application.

[0111] Please refer to Figure 1 , which is a schematic diagram of an application scenario of the security testing method provided in this application. The application scenario includes a client 101 and a server 102. The client 101 and the server 102 can communicate with each other. The communication method can be to use wired communication technology, such as communicating through a network cable or a serial port cable; or to use wireless communication technology, such as communicating through Bluetooth or wireless fidelity (WIFI) and other technologies, without specific limitation.

[0112] Client 101 generally refers to a device capable of performing security testing, such as a terminal device, a third-party application accessible by the terminal device, or a webpage accessible by the terminal device. Terminal devices include, but are not limited to, mobile phones, computers, intelligent transportation devices, and smart appliances. Server 102 generally refers to a device capable of establishing a secure testing environment, such as a terminal device or a server. Servers include, but are not limited to, cloud servers, local servers, or associated third-party servers. Both client 101 and server 102 can utilize cloud computing to reduce the use of local computing resources; similarly, cloud storage can be used to reduce the use of local storage resources.

[0113] As an embodiment, the client 101 and the server 102 can be the same device, and there is no specific limitation. In the embodiment of the present application, the client 101 and the server 102 are respectively the same server as an example for description.

[0114] The following is based on Figure 1 , the security testing method provided by the embodiment of this application is specifically introduced. Please refer to Figure 2 , which is a flow chart of the security testing method provided in an embodiment of the present application.

[0115] S201, in a cloud-native security testing environment, using preset cloud-native attack testing strategies, performs a cloud-native security attack test on a target host to obtain a first attack test result.

[0116] In the cloud-native security testing environment, the server can use preset cloud-native attack testing strategies to perform cloud-native security attack testing on the target host. The cloud-native security attack testing is used to obtain the first usage permission of the target host, so as to obtain the first attack test result.

[0117] Cloud-native attack testing strategies include strategies for conducting security attack tests on the management side of containerized applications in cloud platforms, such as the Kubernetes strategy for conducting security attack tests on the container orchestration engine Kubernetes. Cloud-native attack testing strategies also include strategies for conducting security attack tests on the container creation side of applications in cloud platforms, such as the Docker strategy for conducting security attack tests on the application container engine Docker. Cloud-native attack testing strategies also include cloud service configuration strategies for conducting security attack tests on cloud service configurations, etc., without specific restrictions.

[0118] Please refer to Figure 3 In the cloud-native security testing environment, the server can sequentially adopt Kubernetes policies, Docker policies, and cloud service configuration policies to perform cloud-native security attack tests on the target host in the isolation zone. The server passes the cloud-native security attack test and generates the corresponding first attack test results based on whether it obtains the first usage permission of the target host. The cloud-native security testing environment includes multiple scenarios and environments with different attack test angles, allowing the server to simulate different real cloud-native scenarios through the cloud-native security testing environment. The server can also use multiple cloud-native attack testing strategies for security testing, so as to obtain more accurate first attack test results.

[0119] For example, a strategy for conducting security attack testing on the container creation end of an application in a cloud platform can be a container escape testing strategy. There are many types of container escape testing strategies, such as strategies for escaping by exploiting privileges, strategies for escaping by exploiting copy commands in a container, namely CVE-2019-14271, and strategies for escaping by exploiting the destruction of private read-only memory mappings, namely the CVE-2016-5195 kernel vulnerability.

[0120] When a cloud-native attack testing strategy includes multiple container escape testing strategies, in a cloud-native security testing environment, the server may sequentially execute each of the multiple container escape testing strategies. During each execution, it determines whether the first usage permission has been obtained. If it is determined that the first usage permission has been obtained, the server may generate a first attack test result indicating that a container escape vulnerability exists in the cloud-native security testing environment. If it is determined that the first usage permission has not been obtained, the server may continue to execute the next container escape testing strategy. After executing multiple container escape testing strategies, if it is determined that the first usage permission has not been obtained, a first attack test result indicating that no container escape vulnerability exists in the cloud-native security testing environment is generated.

[0121] As an embodiment, the cloud-native security testing environment can be pre-built on the server, or it can be built in real time before using the cloud-native security testing environment, without any specific restrictions.

[0122] The following describes the process of building a cloud-native security testing environment.

[0123] The server can create vulnerability image files to build a cloud-native security testing environment. The server can first obtain the pre-existing installation files for each cloud-native application. Each installation file contains the cloud-native security vulnerability corresponding to the cloud-native application. After obtaining the installation files containing the cloud-native security vulnerabilities corresponding to the cloud-native application, the server can generate the corresponding vulnerability image files based on each installation file. This allows the server to build a cloud-native security testing environment based on the vulnerability image files.

[0124] Different cloud-native applications or application components can be targeted at different cloud-native security vulnerabilities. Different cloud-native applications or application components can also be targeted at different vulnerability versions of the same type of cloud-native security vulnerability, with no specific restrictions. Therefore, the server can pre-store the installation files for each cloud-native application or download them from network resources.

[0125] As an example, when obtaining the installation files for each cloud-native application, if multiple versions exist, the server can select the installation file corresponding to the version with the pre-installed cloud-native security vulnerability from among the multiple versions, thereby avoiding the situation where the obtained installation file does not contain the cloud-native security vulnerability. The following uses a cloud-native application as an example; the process for other cloud-native applications is similar and is not further described here.

[0126] The server can first obtain the alternative files corresponding to each installation version of a cloud-native application, where the alternative files include the installation files and application update logs of the cloud-native application. The installation files are used to install the corresponding installation version of the cloud-native application. The application update logs are used to record the updated content of each installation version of the cloud-native application compared to the previous installation version. The application update logs may include fixed content or new content of the cloud-native application, etc., without specific restrictions.

[0127] After obtaining the candidate files corresponding to each installation version of the cloud-native application, the server can select, based on the application update logs contained in each candidate file, the candidate file containing the installation file pre-installed with the cloud-native security vulnerability as the target file. After selecting the target file, the server can use the installation file contained in the target file as the installation file for the cloud-native application.

[0128] As an example, when generating corresponding vulnerability image files based on the installation files pre-installed with cloud-native security vulnerabilities corresponding to the cloud-native applications, if the file complexity of the installation files is not high, the server can generate the corresponding vulnerability image files based on the image template. The following uses an installation file as an example to describe the process of generating a vulnerability image file based on the image template. The process for other installation files is similar and is not repeated here.

[0129] The server can determine the file complexity of the first component file in the installation file that has a pre-set cloud native security vulnerability based on a preset application coding policy. For example, if the number of services included in the first component file is less than a specified number, the complexity of the first component file is determined to be low; if the number of services included in the first component file is more than a specified number, the complexity of the first component file is determined to be high. For another example, if the first component file contains fewer associations between services, the complexity of the first component file is determined to be low; if the first component file contains more associations between services, the complexity of the first component file is determined to be high.

[0130] After obtaining the file complexity of the first component file, the server determines whether the file complexity is greater than a complexity threshold. If the file complexity is not greater than the complexity threshold, it indicates that the process of generating a vulnerability image file for the cloud native security vulnerability based on the first component file pre-installed with the cloud native security vulnerability is relatively simple. Therefore, when it is determined that the file complexity is not greater than the complexity threshold, the server can select multiple alternative image templates that match the first component file from the pre-stored alternative image templates as target image templates. After obtaining multiple target image templates, the server can arrange and combine the selected multiple target image templates to generate a vulnerability image file for the cloud native security vulnerability.

[0131] For example, the server can generate a vulnerability image file corresponding to the installation file based on the various alternative image templates contained in the dockerfile. The various alternative image templates contained in the dockerfile include copy templates, add templates, run templates, set environment variable templates, build parameter templates, declaration templates, etc. The server can select multiple target image templates that match the first component file from the various alternative image templates, and arrange each target image template in sequence. The same target image template can be arranged multiple times to obtain a combination of multiple target image templates, so that the server can generate a vulnerability image file for cloud native security vulnerabilities based on the combination of multiple target image templates.

[0132] If the file complexity is greater than the complexity threshold, it means that the process of generating a vulnerability image file for the cloud native security vulnerability based on the first component file pre-installed with the cloud native security vulnerability is relatively complicated. Therefore, the server can independently create a basic image and then use the created basic image to create a polarity joint image to generate a vulnerability image file for the cloud native security vulnerability.

[0133] The server can also generate a vulnerability image file for cloud-native security vulnerabilities directly using a joint image creation method without checking file complexity. The following uses an installation file as an example.

[0134] The server can extract a first component file pre-configured with a cloud-native security vulnerability from the installation file. The server then determines, from various cloud-native attack testing strategies, the cloud-native attack testing strategy corresponding to the vulnerability type of the cloud-native security vulnerability and generates a second component file based on the determined cloud-native attack testing strategy. The server then creates a combined image of the first and second component files to obtain a vulnerability image file for the cloud-native security vulnerability.

[0135] For example, the server can download the system source code of the software or component with the container escape vulnerability and compile it to obtain the first component file. The server determines the cloud native attack test strategy corresponding to the vulnerability type of the container escape vulnerability from various cloud native attack test strategies, such as writing ssh public keys, or regularly executing scheduled tasks and other strategies. Based on the determined cloud native attack test strategy, the second component file is generated, and the first component file and the second component file are jointly mirrored to obtain the vulnerability image file of the cloud native security vulnerability. The server can also directly download the first component file and the second component file of the software or component with the cloud native security vulnerability from network resources, such as from dockerhub, and jointly mirror the first component file and the second component file to obtain the vulnerability image file of the cloud native security vulnerability.

[0136] As an embodiment, when jointly mirroring the first component file and the second component file, the server may obtain respective mirror files of the first component file and the second component file, and perform the joint mirroring based on the respective mirror files of the first component file and the second component file.

[0137] For example, the server can mirror the first component file and the second component file to obtain the first component image file and the second component image file, respectively. Taking the mirroring process of the first component file as an example, the server can create a container image based on the first component file. In the container image, the server can introduce the startup script of the first component file and introduce instructions or services for executing the first component file, thereby generating the first component image file.

[0138] After obtaining the first component image file and the second component image file, the server can configure an association relationship between the first component image file and the second component image file based on a pre-existing image file configuration policy. The association relationship can be an inclusion relationship or a parallel relationship between the files. For example, the server can use Docker Compose to configure an association relationship between the first component image file and the second component image file so that the first component image file and the second component image file can run together in a test environment.

[0139] After the association relationship is configured, the server can generate a vulnerability image file of the cloud native security vulnerability, such as a docker-compose.yml file, based on the first component image file, the second component image file, and the association relationship.

[0140] The following is an example of how to build a cloud-native security testing environment, using a container escape vulnerability as an example. Figure 4a , which is a flowchart of the process of building a cloud-native security testing environment.

[0141] S401, the server obtains the installation file of the cloud native application and extracts the first component file with the cloud native security vulnerability. Figure 4b ,When performing a security attack test on a container escape test vulnerability, the server can select a cloud ,native application that has a pre-installed container escape test vulnerability from various ,cloud native applications, and obtain the installation file of the cloud native application.

[0142] At step S402, the server determines the file complexity of the first component file and determines whether the file complexity of the first component file is greater than a complexity threshold. The server may use the number of services included in the first component file as the file complexity of the first component file. A greater number of services indicates a higher file complexity, and conversely, a smaller number of services indicates a lower file complexity.

[0143] When it is determined that the file complexity of the first component file is greater than the complexity threshold, S403 is executed; when it is determined that the file complexity of the first component file is not greater than the complexity threshold, S407 is executed.

[0144] At step S403, if it is determined that the file complexity of the first component file is greater than the complexity threshold, the server may compile the system source code of the first component file to create a base image file of the first component file, thereby obtaining a first component image file corresponding to the first component file. If the first component image file corresponding to the first component file exists in a network resource, the server may further download the first component image file corresponding to the first component file from the network resource.

[0145] S404, for the container escape test vulnerability, the server can select a cloud native attack test strategy corresponding to the vulnerability type of the container escape test vulnerability from various cloud native attack test strategies, and generate a second component file based on the selected cloud native attack test strategy.

[0146] For example, the cloud-native attack test strategy corresponding to the vulnerability type of the container escape test vulnerability can be a strategy of writing the secure shell protocol SSH public key in the database or cache, or a strategy of setting a scheduled task crontab. Then, the server can generate a second component file so that when the server executes the second component file, the secure shell protocol SSH public key can be written in the database or cache, or a specified scheduled task crontab can be set.

[0147] After obtaining the second component file, the server can obtain the second component image file corresponding to the second component file. The method of obtaining the second component image file corresponding to the second component file is similar to the method of obtaining the first component image file corresponding to the first component file, which will not be repeated here.

[0148] S405, after obtaining the first component image file and the second component image file, the server may associate the obtained first component image file and the second component image file using an image file configuration strategy, such as docker-compose, to obtain an association relationship between the first component image file and the second component image file;

[0149] S406, the first component image file and the second component image file correspond to a container service respectively. The server can orchestrate multiple container services together and generate a vulnerability image file of the cloud native security vulnerability based on the first component image file, the second component image file and the association relationship.

[0150] S407: When determining that the file complexity of the first component file is not greater than the complexity threshold, refer to Figure 4c The server can generate a vulnerability image file for the container escape test vulnerability based on each candidate image template. The server can select multiple target image templates that match the container escape test vulnerability from each candidate image template, and arrange and combine the multiple target image templates to generate a vulnerability image file for the container escape test vulnerability.

[0151] S202: Based on the first attack test result, obtain a first usage permission of the target host machine, and access a local area network security test environment corresponding to the target host machine based on the first usage permission.

[0152] After the server obtains the first attack test result, the first attack test result can indicate whether the server has obtained the first usage permission for the target host. Based on the first attack test result, the server can determine whether the server has obtained the first usage permission for the target host. If the server determines that the server has obtained the first usage permission for the target host, the server can access the local area network security testing environment corresponding to the target host based on the first usage permission. If the server determines that the server has not obtained the first usage permission for the target host, the server can continue security testing in the cloud-native security testing environment based on other cloud-native attack testing strategies.

[0153] As an embodiment, the LAN security test environment may be pre-built by the server, or may be built in real time before using the LAN security test environment, without specific limitation.

[0154] The following describes the process of setting up a LAN security testing environment.

[0155] The server can determine the network structure of the target LAN corresponding to the first usage permission and, based on the network structure, generate a first configuration file, wherein the first configuration file is used to configure the target LAN according to each LAN attack testing strategy. The server then generates a second configuration file based on the pre-stored operation and maintenance strategy of the target LAN, wherein the second configuration file is used to maintain the target LAN. A LAN security testing environment is established based on the first and second configuration files.

[0156] The first configuration file can be used to configure the web target machine scenario for the corresponding server contained in the target local area network; the first configuration file can also be used to configure the corresponding database in the target local area network; the first configuration file can also be used to configure the corresponding storage in the target local area network, etc., without specific restrictions.

[0157] As an embodiment, when generating the first configuration file based on the network structure, the server can determine the association relationship between the various devices included in the network structure based on the network structure, for example, the association relationship between the server and the switch included in the target local area network, the association relationship between the computer device and the router, etc.

[0158] The server can also determine the configuration information of each device based on each LAN attack test strategy. The configuration information can be used to enable each device to implement each LAN attack test strategy. For example, after configuring the corresponding device based on the configuration information, each device can implement a web target machine scenario, etc.; for another example, after configuring the corresponding device based on the configuration information, the corresponding device can implement database read and write vulnerabilities, or memory storage vulnerabilities, etc.

[0159] After obtaining the association relationship between the devices included in the target local area network and the configuration information of each device, the server can generate a first configuration file based on the association relationship and the configuration information corresponding to each local area network attack test strategy.

[0160] The second configuration file can be used to configure the domain controller operation and maintenance policy; the second configuration file can also be used to configure the network policy server (NPS) operation and maintenance policy, etc., without any specific limitation.

[0161] As an embodiment, when building a local area network security test environment based on the first configuration file and the second configuration file, the server can use virtual machines to simulate each device included in the network structure to obtain virtual devices corresponding to each device. The server can first download and run the virtual machine from a network resource, such as the official website of the Emulated Virtual Environment-NextGeneration (EVE-NG), and use EVE-NG to simulate different network devices. The server can also run the virtual machine directly in the network resource, for example, by converting the virtual disk format of the virtual machine to qcow2 format and running the virtual machine on the EVE-NG official website.

[0162] After running the virtual machine and logging into the unified management interface at the designated address, download an image supported by the QEMU processor and configure the virtual machine accordingly. After booting up, the corresponding icon turns blue, allowing you to establish a LAN security testing environment on the virtual machine. The server can configure each virtual device based on the first and second configuration files. Add a network connection to each virtual device to establish a LAN security testing environment.

[0163] For example, see Figure 5 , which gives an example of the process of setting up a LAN security testing environment.

[0164] S501 , based on the network structure of the target local area network, determining the association relationship between various devices, and based on the attack test strategy of each local area network, determining the respective configuration information of each device to generate a first configuration file.

[0165] Based on the network structure of the target LAN, the server can determine the various devices contained in the network structure and the association relationship between the various devices, so that the server can simulate each device separately with a virtual machine to obtain the virtual device corresponding to each device. At the same time, the server can also establish the association relationship between the various virtual devices to simulate the network structure of the target LAN.

[0166] The server can determine the configuration information of each device based on each LAN attack test strategy, and configure the corresponding device through the configuration information, so that the network structure formed by each device can simulate the attack test environment corresponding to each LAN attack test strategy.

[0167] The server may generate a first configuration file according to the association relationship between the various devices and the configuration information of the various devices.

[0168] S502 , running the virtual machine, and simulating each device in the network structure through the virtual machine image according to the first configuration file to obtain a virtual device corresponding to each device.

[0169] The server can download the simulator from a network resource and run a virtual machine in the simulator. After running the virtual machine, the server can download an image supported by simulation processor software, such as qemu, from the network resource. Thus, based on the image supported by the simulation processor software and in accordance with the first configuration file, the server can simulate each device in the virtual machine, build a virtual device corresponding to each device, and perform corresponding server configuration, database configuration, or memory configuration on each virtual device in the virtual machine, so that each virtual device simulates a different server, database, or memory, etc.

[0170] S503: After configuring each virtual device, the server may start each virtual device, including a server, a database, or a memory, etc., so as to establish an association relationship between each virtual device and simulate the network structure of the target local area network.

[0171] S504: The server may configure each virtual device based on the first configuration file and simulate each LAN attack test strategy respectively.

[0172] Based on the first configuration file, the server can configure the front-end server, database or memory, etc. respectively to simulate each LAN attack test strategy. For example, the server can configure the corresponding front-end server, etc. to simulate the web target machine scenario.

[0173] S505: Generate a second configuration file based on the pre-stored target LAN operation and maintenance policy. The operation and maintenance policy is used to perform corresponding tasks to maintain the stability and security of the LAN when the LAN security test environment is under attack. For example, the server may generate the second configuration file based on an operation and maintenance policy such as a domain controller or NPS. The server may configure each virtual device based on the second configuration file so that each virtual device simulates the target LAN operation and maintenance policy.

[0174] S506: After configuring each virtual device based on the first configuration file and the second configuration file, the server can add a network connection for each virtual device to obtain a built LAN security test environment.

[0175] S203 , in the LAN security test environment, using preset LAN attack test strategies, performs a LAN security attack test on the core network server to obtain a second attack test result.

[0176] In the LAN security test environment, the server can use various preset LAN attack test strategies to conduct LAN security attack tests on the core network server and obtain a second attack test result. There are various LAN attack test strategies, such as strategies for conducting LAN security attack tests against unauthorized database access vulnerabilities and strategies for conducting LAN security attack tests against domain environment vulnerabilities, and the like, without limitation.

[0177] As an embodiment, the server can determine whether there is an unencrypted designated database in the local area network security test environment, and the designated database can be used to store the second usage permission of the core network server. When it is determined that there is an unencrypted designated database, the server can add the second usage permission of the core network server in the designated database. For example, after forging the usage permission, the server writes the forged usage permission in the designated database as the second usage permission of the core network server. The server can also generate a second attack test result indicating that there is an unauthorized access vulnerability to the database in the local area network security test environment after writing the second usage permission. When it is determined that there is no unencrypted designated database, the server can generate a second attack test result indicating that there is no unauthorized access vulnerability to the database in the local area network security test environment.

[0178] S204: Use the first attack test result and the second attack test result as target security test results.

[0179] After obtaining the first attack test result and the second attack test result, the server may directly merge the first attack test result and the second attack test result, and use the merged first attack test result and the second attack test result as the standard security test result.

[0180] The server can also reintegrate the first attack test result and the second attack test result to generate a target security test result. When the server determines that the first attack test result indicates the existence of a container escape vulnerability and the second attack test result indicates the existence of an unauthorized database access vulnerability, it generates a target security test result that indicates that both the cloud native security test environment and the LAN security test environment have security test vulnerabilities. The first attack test result indicates the existence of a container escape vulnerability, indicating that the first usage permission of the target host can be obtained through the container escape vulnerability. The second attack test result indicates the existence of an unauthorized database access vulnerability, indicating that the second usage permission can be written to the core network server through the unauthorized database access vulnerability. Then the server can generate a target security test result that indicates that both the cloud native security test environment and the LAN security test environment have security test vulnerabilities.

[0181] When the server determines that the first attack test result indicates the existence of a container escape vulnerability and the second attack test result indicates the absence of an unauthorized database access vulnerability, it can generate a target security test result indicating that only the cloud-native security test environment has a security test vulnerability. The first attack test result indicates the existence of a container escape vulnerability, indicating that the first usage permission of the target host can be obtained through the container escape vulnerability. The second attack test result indicates the absence of an unauthorized database access vulnerability, indicating that the second usage permission cannot be written to the core network server through the unauthorized database access vulnerability. The server can then generate a target security test result indicating that the cloud-native security test environment has a security test vulnerability.

[0182] When the server determines that the first attack test result indicates the absence of a container escape vulnerability, it can generate a target security test result indicating that both the cloud-native security test environment and the local area network (LAN) security test environment are free of security test vulnerabilities. The first attack test result indicates the absence of a container escape vulnerability, indicating that the container escape vulnerability cannot be used to obtain the primary user privilege of the target host, and thus, cannot be used to access the target LAN. The server can then generate a target security test result indicating that both the cloud-native security test environment and the LAN security test environment are free of security test vulnerabilities.

[0183] Please refer to the following Figure 6 The following is a structural diagram of the security testing method provided in the embodiment of the present application, which is described as an example. The cloud-native security testing environment includes an isolation zone server, which is connected to a router, which is connected to a switch, which is connected to a local area network security testing environment. The local area network security testing environment includes a local area network server, a database, and storage. The local area network security testing environment includes a local area network server, a database, and storage connected to a core network server.

[0184] Please refer to Figure 7 The isolation zone and target LAN are divided into a three-layer network structure. The isolation zone IP segment is 192.168.9.1 / 24, the second-layer network structure IP segment is 192.168.5.1 / 24, and the third-layer network structure IP segment is 192.168.2.1 / 24. The dual network cards of the isolation zone servers provide external services and connect to the second-layer network structure respectively. The dual network cards of the servers and computers in the second-layer network structure are connected to the second-layer network structure and the third-layer network structure respectively. The servers and computers in the third-layer network structure are configured with only one network connection to access the third-layer network structure.

[0185] In the cloud-native security testing environment of the isolation zone, the server can use privileged methods, the replication method of the public vulnerability CVE-2019-14271, and the kernel Dirty COW vulnerability to escape the host and obtain the first-level usage permission of the target host.

[0186] In the LAN security test environment of the second-layer network structure, the server can use the Redis unauthorized access method, the Eternal Blue method, and web methods such as mailbox tasks to obtain the second usage permission of the core network server.

[0187] In the LAN security test environment of the third-layer network structure, the server can use the domain environment, such as capturing domain user passwords, obtaining user credentials, hash transmission, etc., to obtain domain control permissions or maintain permissions, so as to achieve the purpose of obtaining the second use permission of the core network server.

[0188] Therefore, the server can determine the target security test results based on whether it has obtained the first use permission of the target host machine and whether it has obtained the second use permission of the core network server. By performing cloud native security attack tests such as privilege escalation or escape in the cloud native security test environment, the target LAN boundary server permissions, that is, the first use permission of the target host machine, are obtained. After obtaining the first use permission of the target host machine, the LAN security attack test is simulated in the LAN security test environment to conduct LAN security attack tests, forming a complete attack test path, making the attack test process more consistent with the actual cloud native attack test scenario, and thus making the obtained security test results more authentic and reliable.

[0189] Based on the same inventive concept, the present invention provides a safety testing device that can implement the functions corresponding to the aforementioned safety testing method. Figure 8 , the device includes a first processing module 801 and a second processing module 802, wherein:

[0190] The first processing module 801 is configured to perform a cloud native security attack test on a target host machine using preset cloud native attack test strategies in a cloud native security test environment to obtain a first attack test result.

[0191] The first processing module 801 is further configured to obtain a first usage permission of the target host machine based on the first attack test result, and access a local area network security test environment corresponding to the target host machine based on the first usage permission;

[0192] The second processing module 802 is configured to perform a LAN security attack test on the core network server in the LAN security test environment using various preset LAN attack strategies to obtain a second attack test result;

[0193] The second processing module 802 is further configured to use the first attack test result and the second attack test result as target security test results.

[0194] In a possible embodiment, the first processing module 801 is further configured to:

[0195] In the cloud-native security testing environment, a cloud-native security attack test is performed on a target host using various preset cloud-native attack test strategies. Before obtaining the first attack test result, the installation files of each pre-stored cloud-native application are obtained, wherein each installation file is pre-installed with a cloud-native security vulnerability corresponding to the cloud-native application.

[0196] Generate corresponding vulnerability image files based on the installation files pre-installed with cloud-native security vulnerabilities corresponding to the cloud-native applications;

[0197] Build a cloud-native security testing environment based on various vulnerability image files.

[0198] In a possible embodiment, the first processing module 801 is specifically configured to:

[0199] For each cloud-native application, perform the following operations:

[0200] Obtain alternative files corresponding to each installation version of a cloud-native application, where the alternative files include the cloud-native application installation file and application update log;

[0201] Based on the application update logs contained in each candidate file, select the candidate file whose installation file contains a pre-set cloud native security vulnerability from each candidate file as the target file;

[0202] Use the installation files contained in the target file as the installation files for the cloud-native application.

[0203] In a possible embodiment, the first processing module 801 is specifically configured to:

[0204] For each installation file, perform the following operations:

[0205] Based on the preset application coding policy, determine the file complexity of the first component file in an installation file that has a pre-set cloud native security vulnerability;

[0206] When it is determined that the file complexity is not greater than the complexity threshold, multiple candidate image templates matching the first component file are selected from the candidate image templates as target image templates;

[0207] Arrange and combine multiple selected target image templates to generate vulnerability image files for cloud native security vulnerabilities.

[0208] In a possible embodiment, the first processing module 801 is specifically configured to:

[0209] For each installation file, perform the following operations:

[0210] Extract the first component file with pre-installed cloud native security vulnerabilities from an installation file;

[0211] Determine, from each cloud native attack testing strategy, a cloud native attack testing strategy corresponding to the vulnerability type of the cloud native security vulnerability, and generate a second component file based on the determined cloud native attack testing strategy;

[0212] The first component file and the second component file are jointly mirrored to obtain a vulnerability mirror file of the cloud native security vulnerability.

[0213] In a possible embodiment, the first processing module 801 is specifically configured to:

[0214] Performing mirroring on the first component file and the second component file respectively to obtain a first component mirror file and a second component mirror file respectively;

[0215] Based on a pre-existing image file configuration policy, configure an association relationship between the first component image file and the second component image file;

[0216] Based on the first component image file, the second component image file, and the association relationship, a vulnerability image file of the cloud native security vulnerability is generated.

[0217] In a possible embodiment, the first processing module 801 is further configured to:

[0218] Before accessing the local area network security test environment corresponding to the target host machine based on the first use permission, determining the network structure of the target local area network corresponding to the first use permission;

[0219] Based on the network structure, a first configuration file is generated, wherein the first configuration file is used to configure the target local area network according to each local area network attack test strategy;

[0220] generating a second configuration file based on a pre-stored operation and maintenance policy of the target local area network, wherein the second configuration file is used to maintain the target local area network;

[0221] A local area network security test environment is established based on the first configuration file and the second configuration file.

[0222] In a possible embodiment, the first processing module 801 is specifically configured to:

[0223] Based on the network structure, determine the association relationship between the various devices included in the network structure;

[0224] Based on each LAN attack test strategy, determine the configuration information of each device;

[0225] A first configuration file is generated based on the association relationship and the various configuration information.

[0226] In a possible embodiment, the first processing module 801 is specifically configured to:

[0227] Use virtual machines to simulate various devices included in the network structure to obtain virtual devices corresponding to each device;

[0228] Based on the first configuration file and the second configuration file, each virtual device is configured;

[0229] Add network connections to each virtual device to obtain a secure LAN testing environment.

[0230] In one possible embodiment, each cloud-native attack testing strategy includes multiple container escape testing strategies; the first processing module 801 is specifically configured to:

[0231] In the cloud-native security testing environment, each of the multiple container escape testing strategies is executed in sequence. During each execution, when it is determined that the first use permission is obtained, a first attack test result is generated indicating that a container escape vulnerability exists in the cloud-native security testing environment.

[0232] After executing multiple container escape test strategies, when it is determined that the first usage permission has not been obtained, a first attack test result is generated, indicating that there is no container escape vulnerability in the cloud native security test environment.

[0233] In a possible embodiment, the second processing module 802 is specifically configured to:

[0234] In the LAN security test environment, determine whether there is an unencrypted designated database;

[0235] When it is determined that an unencrypted designated database exists, a second usage permission of the core network server is added to the designated database, and based on the second usage permission, a second attack test result is generated indicating that an unauthorized database access vulnerability exists in the local area network security test environment;

[0236] When it is determined that no unencrypted designated database exists, a second attack test result is generated, indicating that no database unauthorized access vulnerability exists in the local area network security test environment.

[0237] In a possible embodiment, the second processing module 802 is specifically configured to:

[0238] When it is determined that the first attack test result indicates the existence of a container escape vulnerability, and the second attack test result indicates the existence of an unauthorized database access vulnerability, a target security test result is generated indicating that both the cloud native security test environment and the local area network security test environment have security test vulnerabilities.

[0239] When it is determined that the first attack test result indicates the existence of a container escape vulnerability and the second attack test result indicates the absence of a database unauthorized access vulnerability, a target security test result is generated indicating that only the cloud native security test environment has a security test vulnerability.

[0240] When it is determined that the first attack test result indicates that there is no container escape vulnerability, a target security test result is generated to indicate that there are no security test vulnerabilities in the cloud native security test environment and the local area network security test environment.

[0241] Please refer to Figure 9 The above-mentioned security testing device can be run on a computer device 900. The current version and historical versions of the data storage program and the application software corresponding to the data storage program can be installed on the computer device 900. The computer device 900 includes a processor 980 and a memory 920. In some embodiments, the computer device 900 may include a display unit 940, and the display unit 940 includes a display panel 941 for displaying a user interactive operation interface, etc.

[0242] In a possible embodiment, the display panel 941 may be configured in the form of a liquid crystal display (LCD) or an organic light-emitting diode (OLED).

[0243] The processor 980 is configured to read a computer program and then execute the method defined by the computer program. For example, the processor 980 reads a data storage program or file, thereby running the data storage program on the computer device 900 and displaying a corresponding interface on the display unit 940. The processor 980 may include one or more general-purpose processors and may also include one or more DSPs (Digital Signal Processors) to perform related operations to implement the technical solutions provided in the embodiments of the present application.

[0244] The memory 920 generally includes internal memory and external memory, and the internal memory can be a random access memory (RAM), a read-only memory (ROM), and a cache (CACHE), etc. The external memory can be a hard disk, an optical disk, a USB disk, a floppy disk or a tape drive, etc. The memory 920 is used to store computer programs and other data. The computer program includes an application corresponding to each client, etc. Other data may include data generated after the operating system or application is run, and the data includes system data (such as configuration parameters of the operating system) and user data. In the embodiment of the present application, program instructions are stored in the memory 920, and the processor 980 executes the program instructions in the memory 920 to implement any of the methods discussed in the previous figure.

[0245] The display unit 940 is used to receive input digital information, character information, or contact touch operations / contactless gestures, and to generate signal input related to user settings and function control of the computer device 900. Specifically, in the embodiment of the present application, the display unit 940 may include a display panel 941. The display panel 941, such as a touch screen, can collect user touch operations on or near it (such as operations performed by the user using a finger, stylus, or any other suitable object or accessory on or on the display panel 941) and drive corresponding connected devices according to a pre-set program.

[0246] In one possible embodiment, the display panel 941 may include a touch detection device and a touch controller. The touch detection device detects the player's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller. The touch controller receives the touch information from the touch detection device, converts it into touch point coordinates, and then sends it to the processor 980. The touch controller can also receive and execute commands from the processor 980.

[0247] The display panel 941 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the display unit 940, in some embodiments, the computer device 900 may further include an input unit 930. The input unit 930 may include an image input device 931 and other input devices 932. The other input devices may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, power keys, etc.), a trackball, a mouse, a joystick, and the like.

[0248] In addition to the above, the computer device 900 may also include a power supply 990 for powering other modules, an audio circuit 960, a near-field communication module 970, and an RF circuit 910. The computer device 900 may also include one or more sensors 950, such as an accelerometer, a light sensor, a pressure sensor, etc. The audio circuit 960 specifically includes a speaker 961 and a microphone 962. For example, the computer device 900 can use the microphone 962 to collect the user's voice and perform corresponding operations.

[0249] As an embodiment, the number of the processors 980 may be one or more, and the processor 980 and the memory 920 may be coupled or relatively independently configured.

[0250] As an example, Figure 9 The processor 980 in the embodiment can be used to implement the following Figure 8 The functions of the first processing module 801 and the second processing module 802 in FIG.

[0251] As an example, Figure 9 The processor 980 in can be used to implement the corresponding functions of the server or terminal device discussed above.

[0252] Those skilled in the art will appreciate that all or part of the steps of the above-mentioned method embodiments may be implemented by hardware associated with program instructions, and the aforementioned program may be stored in a computer-readable storage medium. When the program is executed, the program executes the steps of the above-mentioned method embodiments. The aforementioned storage medium includes various media that can store program codes, such as mobile storage devices, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0253] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention, or the part that contributes to the existing technology, can be embodied in the form of a software product, for example, through a computer program product, which is stored in a storage medium and includes a number of instructions for enabling a computer device to execute all or part of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0254] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A security testing method, characterized in that: include: In the cloud-native security testing environment, use the preset cloud-native attack testing strategies to conduct cloud-native security attack tests on the target host to obtain the first attack test results. Based on the first attack test result, obtaining a first usage permission of the target host machine, and accessing a local area network security test environment corresponding to the target host machine based on the first usage permission; In the LAN security test environment, using preset LAN attack test strategies, performing a LAN security attack test on the core network server to obtain a second attack test result; The first attack test result and the second attack test result are used as target security test results.

2. The method according to claim 1, characterized in that Before performing a cloud native security attack test on a target host machine using preset cloud native attack test strategies in a cloud native security test environment to obtain a first attack test result, the method further includes: Obtaining the respective installation files of each pre-existing cloud-native application, wherein each installation file is pre-installed with the cloud-native security vulnerability corresponding to the cloud-native application; Generate corresponding vulnerability image files based on the respective installation files pre-installed with the cloud native security vulnerabilities corresponding to the cloud native applications; Based on the vulnerability image files, the cloud native security testing environment is built.

3. The method according to claim 2, characterized in that Obtaining the installation files of each pre-stored cloud-native application includes: For each cloud-native application, perform the following operations: Obtaining candidate files corresponding to respective installation versions of a cloud-native application, wherein the candidate files include installation files and application update logs of the cloud-native application; Based on the application update logs included in each candidate file, select, from the candidate files, a candidate file whose installation file is pre-set with a cloud-native security vulnerability as the target file; The installation file contained in the target file is used as the installation file of the cloud-native application.

4. The method according to claim 2, characterized in that The generating of corresponding vulnerability image files based on the respective installation files pre-installed with the cloud native security vulnerabilities corresponding to the cloud native applications includes: For each installation file, perform the following operations: Based on the preset application coding policy, determine the file complexity of the first component file in an installation file that has a pre-set cloud native security vulnerability; When it is determined that the file complexity is not greater than the complexity threshold, multiple candidate image templates matching the first component file are selected from the candidate image templates as target image templates; The selected multiple target image templates are arranged and combined to generate a vulnerability image file for the cloud native security vulnerability.

5. The method according to claim 2, characterized in that The generating of corresponding vulnerability image files based on the respective installation files pre-installed with the cloud native security vulnerabilities corresponding to the cloud native applications includes: For each installation file, perform the following operations: Extract the first component file with pre-installed cloud native security vulnerabilities from an installation file; Determining, from the various cloud-native attack testing strategies, a cloud-native attack testing strategy corresponding to the vulnerability type of the cloud-native security vulnerability, and generating a second component file based on the determined cloud-native attack testing strategy; The first component file and the second component file are jointly mirrored to obtain a vulnerability mirror file of the cloud native security vulnerability.

6. The method according to claim 5, characterized in that The jointly mirroring the first component file and the second component file to obtain the vulnerability mirror file of the cloud native security vulnerability includes: Performing mirroring on the first component file and the second component file respectively to obtain a first component mirror file and a second component mirror file respectively; Based on a pre-existing image file configuration policy, configuring an association relationship between the first component image file and the second component image file; Based on the first component image file, the second component image file, and the association relationship, a vulnerability image file of the cloud native security vulnerability is generated.

7. The method according to claim 1, characterized in that Before accessing the local area network security test environment corresponding to the target host machine based on the first usage permission, the method further includes: Determining a network structure of a target local area network corresponding to the first usage permission; Based on the network structure, generating a first configuration file, wherein the first configuration file is used to configure the target local area network according to each local area network attack test strategy; generating a second configuration file based on a pre-stored operation and maintenance policy of the target local area network, wherein the second configuration file is used to maintain the target local area network; The local area network security test environment is established based on the first configuration file and the second configuration file.

8. The method according to claim 7, characterized in that The generating a first configuration file based on the network structure includes: Based on the network structure, determining an association relationship between various devices included in the network structure; Determining configuration information of each device based on each LAN attack test strategy; Based on the association relationship and various configuration information, a first configuration file is generated.

9. The method according to claim 7, characterized in that The step of establishing the local area network security test environment based on the first configuration file and the second configuration file includes: Simulating each device included in the network structure with a virtual machine to obtain a virtual device corresponding to each device; Based on the first configuration file and the second configuration file, respectively configure each virtual device; Add network connections to the respective virtual devices to obtain the local area network security test environment.

10. The method according to any one of claims 1 to 9, characterized in that Each of the cloud-native attack testing strategies includes multiple container escape testing strategies; Then, in the cloud native security testing environment, the preset cloud native attack testing strategies are used to perform a cloud native security attack test on the target host to obtain a first attack test result, including: In the cloud-native security testing environment, executing each of the multiple container escape testing strategies in sequence, and during each execution, when it is determined that the first usage permission is obtained, generating the first attack test result indicating that a container escape vulnerability exists in the cloud-native security testing environment; After executing the multiple container escape test strategies, when it is determined that the first usage permission is not obtained, the first attack test result is generated, indicating that no container escape vulnerability exists in the cloud-native security test environment.

11. The method according to any one of claims 1 to 9, characterized in that The step of performing a LAN security attack test on a core network server using preset LAN attack test strategies in the LAN security test environment to obtain a second attack test result includes: In the local area network security test environment, determining whether there is an unencrypted designated database; When it is determined that an unencrypted designated database exists, adding a second usage permission of the core network server to the designated database, and generating a second attack test result indicating that an unauthorized database access vulnerability exists in the local area network security test environment based on the second usage permission; When it is determined that no unencrypted designated database exists, a second attack test result is generated, indicating that no database unauthorized access vulnerability exists in the local area network security test environment.

12. The method according to any one of claims 1 to 9, characterized in that: The taking the first attack test result and the second attack test result as target security test results includes: When it is determined that the first attack test result indicates the existence of a container escape vulnerability and the second attack test result indicates the existence of an unauthorized database access vulnerability, a target security test result is generated indicating that both the cloud native security test environment and the local area network security test environment have security test vulnerabilities; When it is determined that the first attack test result indicates the existence of a container escape vulnerability and the second attack test result indicates the absence of a database unauthorized access vulnerability, a target security test result is generated indicating that only the cloud native security test environment has a security test vulnerability; When it is determined that the first attack test result indicates that there is no container escape vulnerability, a target security test result is generated, indicating that there are no security test vulnerabilities in the cloud native security test environment and the local area network security test environment.

13. A safety testing device, characterized in that: include: A first processing module is configured to perform a cloud native security attack test on a target host machine using preset cloud native attack test strategies in a cloud native security test environment to obtain a first attack test result; The first processing module is further configured to obtain a first usage permission of the target host machine based on the first attack test result, and access a local area network security test environment corresponding to the target host machine based on the first usage permission; A second processing module is configured to perform a LAN security attack test on the core network server using preset LAN attack strategies in the LAN security test environment to obtain a second attack test result; The second processing module is further configured to use the first attack test result and the second attack test result as target security test results.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

15. A computer device, characterized in that: include: a memory for storing program instructions; A processor is configured to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 12 according to the obtained program instructions.

16. A computer-readable storage medium, characterized in that The storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the method according to any one of claims 1 to 12.

Images