A test method, system, device and storage medium for simulating attacks

Abstract

A test method for simulating attacks, relating to the field of security testing. In this method, in response to a user testing a network security product operation, a first test case is obtained, the first test case being any one of the historical attack cases; a first attack orchestration plan corresponding to the first test case is queried from a preset attack orchestration library, the preset attack orchestration library including the correspondence between the first test case and the first attack orchestration plan; an attack command is generated according to the first attack orchestration plan; and the attack command is executed to simulate an attack on the network security product to be tested, and whether the network security product to be tested meets the requirements is determined according to the execution result. The technical solution provided by the present application is implemented to achieve the effect of automatically testing network security products.

Description

Technical Field

[0001] The present application relates to the field of security testing technology, and in particular to a testing method, system, electronic device and storage medium for simulating attacks. Background Art

[0002] With the development of science and technology, the complexity and harmfulness of network attack technology are also increasing. Hacker attack methods are becoming more and more diverse, which makes traditional network security protection technology face breakthroughs and network security protection needs to be continuously innovated.

[0003] Currently, before network security products leave the factory, manufacturers will conduct a series of tests on the products to ensure the quality and security of the products. These tests include functional testing, performance testing, vulnerability scanning, etc. to verify whether the various indicators of the product meet the requirements. For network security products that have been deployed in the production environment, regular testing is necessary. This helps to timely discover and fix potential security risks and improve product security. The current testing methods usually require different test plans to be designed for different test products, which is extremely inefficient.

[0004] Therefore, how to efficiently test products is a problem that those skilled in the art have been looking forward to solving. Summary of the invention

[0005] The present application provides a test method, system, device and storage medium for simulating attacks, which can match corresponding attack orchestration plans from an attack orchestration library according to the characteristics of a preset product, and simulate attacks on the product through the attack orchestration plan, thereby improving the efficiency of the test.

[0006] In a first aspect of the present application, a test method for simulating an attack is provided, which is applied to a simulation test platform, and the method comprises:

[0007] In response to a user testing a network security product operation, obtaining a first test case, wherein the first test case is any one of historical attack cases;

[0008] Querying a first attack orchestration plan corresponding to the first test case from a preset attack orchestration library, wherein the preset attack orchestration library includes a correspondence between the first test case and the first attack orchestration plan;

[0009] Generate an attack command according to the first attack arrangement plan; and

[0010] The attack command is executed to simulate an attack on the network security product to be tested, and whether the network security product to be tested meets the requirements is determined according to the execution result.

[0011] By adopting the above technical solution, it is possible to automatically respond to the user's operation of testing network security products, obtain the first test case, and query the corresponding attack orchestration plan from the preset attack orchestration library, so as to automatically generate and execute the attack command. This kind of automated testing can improve testing efficiency and reduce manual intervention and errors.

[0012] Optionally, the testing method further includes: constructing a correspondence between multiple test cases and multiple attack orchestration plans to establish a preset attack orchestration library.

[0013] By adopting the above technical solutions, the corresponding relationship between multiple test cases and multiple attack orchestration plans is constructed, and the preset attack orchestration library can cover more network security product functions and attack methods. This comprehensive test coverage can more comprehensively evaluate the performance and security of network security products.

[0014] Optionally, the step of constructing a correspondence between a plurality of test cases and a plurality of attack arrangement plans to establish a preset attack arrangement library includes:

[0015] Generate multiple attack orchestration templates according to the second test case, and estimate the attack success rates of the multiple attack orchestration templates, where a first attack success rate and a second attack success rate are any two attack success rates in the multiple attack orchestration templates, and the first attack success rate is greater than the second attack success rate;

[0016] A second attack orchestration plan is constructed according to the attack orchestration template corresponding to the first attack success rate, and a corresponding relationship between the second test case and the second attack orchestration plan is established.

[0017] By adopting the above technical solution, multiple attack orchestration templates are generated according to the second test case, and the attack success rates of these templates are estimated, so that the success probability of different attack methods on specific security functions can be evaluated. This estimation can help select a more effective attack method for testing and improve the accuracy and efficiency of the test. Constructing a corresponding attack orchestration plan based on the attack orchestration template corresponding to the first attack success rate can ensure that the test method selects the most effective attack method for simulated attack. This optimization can improve the accuracy and efficiency of the test while reducing unnecessary waste of resources.

[0018] Optionally, the second test case includes a first test sub-case and a second test sub-case, the test sub-case corresponds to an attack path between two nodes, the first test sub-case and the second test sub-case are any two attack paths in the second test case, and generating multiple attack orchestration templates according to the second test case includes: arranging and combining the first test sub-case and the second test sub-case to form multiple attack orchestration templates.

[0019] By adopting the above technical solution, the first test sub-case and the second test sub-case are arranged and combined to form multiple attack arrangement templates, which can comprehensively cover all attack paths of the second test case. This comprehensive test can ensure that all attack paths of network security products are effectively tested and verified.

[0020] Optionally, the arranging and combining the first test sub-case and the second test sub-case to form a plurality of attack arrangement templates includes:

[0021] Determine a first attack path corresponding to the first test sub-case and a second attack path corresponding to the second test sub-case, and combine the first attack path and the second attack path through a preset logical relationship to form a plurality of attack arrangement templates.

[0022] By adopting the above technical solution, by determining the successful attack paths corresponding to the first test sub-case and the second test sub-case, it is possible to clearly understand the attack methods that the attacker may take. This determination can provide clear guidance for generating multiple attack orchestration templates to ensure that the generated templates are targeted and effective. By combining successful attack paths through logical relationships, multiple attack orchestration templates can be formed. This logical relationship can construct a more complex attack sequence based on the logical relationship between different attack paths to test the performance of network security products when facing complex attacks.

[0023] Optionally, generating an attack command according to the first attack arrangement plan includes:

[0024] Calling the orchestration execution engine through the task executor to convert the attack orchestration plan into job execution logic data; and

[0025] The task executor sends an attack command to the use case executor according to the job execution logic data.

[0026] By adopting the above technical solution, based on the task executor calling the orchestration execution engine, the attack orchestration plan is converted into job execution logic data, which can realize the conversion of the preset attack orchestration plan into executable operations. This conversion can make the generation of attack commands more accurate and efficient.

[0027] Optionally, calling the orchestration execution engine by the task executor to convert the attack orchestration plan into job execution logic data includes:

[0028] Generate job execution process data according to the attack orchestration plan through the process building mechanism of the orchestration execution engine;

[0029] Querying the process that meets the conditions according to the job execution process data through the dependency checking mechanism of the orchestration execution engine, and obtaining executable job actions according to the process that meets the conditions;

[0030] Obtaining an actual job action executor according to the executable job action through the action registration mechanism of the orchestration execution engine, and executing the corresponding job using the process context information and the actual job action executor; and

[0031] Integrate the completed execution data into job execution logic data.

[0032] By adopting the above technical solutions, based on the process building mechanism, dependency checking mechanism, action registration mechanism and data integration of the orchestration execution engine, the attack orchestration plan is converted into a specific operation process, which improves the execution efficiency and accuracy of the attack commands and the processing efficiency and accuracy of the test results, providing a more complete and efficient attack command generation and execution mechanism for the testing and verification of network security products.

[0033] In a second aspect of the present application, a test system for simulating attacks is provided, the test system comprising a collection module, a query module, a command module and an execution module, wherein:

[0034] A collection module configured to obtain a first test case in response to a user testing a network security product operation, wherein the first test case is any one of the historical attack cases;

[0035] A query module configured to query a first attack orchestration plan corresponding to the first test case from a preset attack orchestration library, wherein the preset attack orchestration library includes a correspondence between the first test case and the first attack orchestration plan;

[0036] a command module, configured to generate an attack command according to the first attack arrangement plan; and

[0037] The execution module is configured to execute the attack command to simulate the attack on the network security product to be tested, and determine whether the network security product to be tested meets the requirements according to the execution result.

[0038] In the third aspect of the present application, an electronic device is provided, including a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are both used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes any one of the methods described above.

[0039] In a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores instructions, and when the instructions are executed, any of the methods described above is executed.

[0040] In summary, one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0041] 1. Through automated testing methods, testing efficiency can be improved and manual intervention and errors can be reduced.

[0042] 2. By testing specific security functions, the performance and security of network security products can be evaluated more accurately.

[0043] 3. Testing by simulating real network attacks can expose potential security vulnerabilities and provide valuable feedback for product improvements and upgrades.

[0044] 4. By building a correspondence between multiple test cases and multiple attack orchestration plans, the functions and attack methods of network security products can be fully covered, improving the accuracy and efficiency of testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flowchart of a test method for simulating attacks disclosed in an embodiment of the present application;

[0046] Figure 2 It is a schematic diagram of various logical relationships disclosed in the embodiments of the present application;

[0047] Figure 3 It is a flowchart of executing the attack arrangement plan disclosed in the embodiment of the present application;

[0048] Figure 4 It is a structural diagram of the orchestration execution engine disclosed in the embodiment of the present application;

[0049] Figure 5 It is a module schematic diagram of a test system for simulating attacks disclosed in an embodiment of the present application;

[0050] Figure 6 It is a structural schematic diagram of an electronic device disclosed in an embodiment of the present application.

[0051] Explanation of the accompanying drawings: 401, process management module; 402, action management module; 501, acquisition module; 502, query module; 503, command module; 504, execution module; 601, processor; 602, communication bus; 603, user interface; 604, network interface; 605, memory. DETAILED DESCRIPTION

[0052] In order to enable technicians in this field to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0053] In the description of the embodiments of the present application, words such as "for example" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "for example" or "for example" is intended to present related concepts in a specific way.

[0054] In the description of the embodiments of the present application, the meaning of the term "multiple" refers to two or more. For example, multiple systems refer to two or more systems, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0055] First explain the basic concepts:

[0056] Use case: A technical implementation used to simulate attack methods, allowing the simulation of attack behaviors in various environments by configuring parameters.

[0057] Use case script: Specific attack behavior code is the specific implementation of the use case. A use case is generally executed step by step by multiple scripts to fully simulate an attack method.

[0058] Scenario: A collection of use cases, generally used to organize a set of scripts that satisfy a certain usage scenario.

[0059] Attack orchestration template: An attack orchestration template scenario that combines a set of use cases according to logical relationships to simulate a certain attack chain. This scenario cannot be executed by the task execution engine and is only used to generate an attack orchestration plan that can create a task execution after configuring parameters.

[0060] Attack orchestration plan: An attack orchestration scenario that is generated by a configured attack orchestration template and can be input into the task execution engine for execution.

[0061] Task: The execution scheduling information generated by selecting a scene and entering scene parameters and task parameters is the execution concept of the scene.

[0062] Job: The execution scheduling information generated by a task based on the use cases and configuration parameters in a scenario is the execution concept of a use case.

[0063] Command: The instruction data generated by the specific script of the use case under the job is the execution concept of the use case script. The command is the actual input of the use case executor.

[0064] This embodiment discloses a test method for simulating an attack. Figure 1 is a flow chart of a test method for simulating attacks disclosed in an embodiment of the present application, such as Figure 1 As shown, the following steps are included:

[0065] S110, in response to a user testing a network security product operation, obtaining a first test case, where the first test case is any one of historical attack cases;

[0066] S120: Query a preset attack orchestration library for a first attack orchestration plan corresponding to the first test case, wherein the preset attack orchestration library includes a correspondence between the first test case and the first attack orchestration plan;

[0067] S130, generating an attack command according to the first attack arrangement plan; and

[0068] S140: Execute the attack command to simulate an attack on the network security product to be tested, and determine whether the network security product to be tested meets the requirements according to the execution result.

[0069] Security functions may include application access control, application data security, application vulnerability management, application identity authentication and authorization, application input verification, application security audit, application encryption and signature, and application security update and patch management. That is, the first test case may be any one of application access control, application data security, application vulnerability management, application identity authentication and authorization, application input verification, application security audit, application encryption and signature, and application security update and patch management. In the embodiment of the present application, the first test case is described as an example of application identity authentication and authorization.

[0070] Application access control: Ensure that only authorized users can access the application, and limit their access to specific functions or data of the application. Application data security: Protect the data processed and stored by the application to prevent data leakage, tampering or destruction. Application vulnerability management: Timely discover and fix vulnerabilities in the application to prevent potential security threats. Application identity authentication and authorization: Ensure correct identity authentication and authorization to prevent unauthorized access. Application input validation: Verify the data entered by the user to prevent malicious input from causing attacks on the application. Application security audit: Perform security audits on the application to detect and record potential security threats and violations. Application encryption and signing: Encrypt and sign sensitive data in the application to protect the confidentiality and integrity of the data. Application security update and patch management: Timely update and patch security vulnerabilities in the application to prevent potential security threats.

[0071] When the simulation test platform receives the test instruction, it obtains the first test case of the network security product to be tested, queries the first attack arrangement plan corresponding to the first test case from the preset attack arrangement library, and generates an attack command according to the first attack arrangement plan; executes the attack command to simulate the attack on the network security product to be tested, and judges whether the network security product to be tested meets the requirements according to the execution result. For example, when the first test case is identity authentication and authorization for the application, if the execution result is a successful login to the application, it indicates that the attack is successful and the network security product to be tested does not meet the security requirements; if the execution result is an unsuccessful login to the application, it indicates that the attack failed and the network security product to be tested meets the security requirements.

[0072] By determining the attack paths corresponding to the first test sub-case and the second test sub-case, and combining these paths through logical relationships, multiple attack orchestration templates can be formed to improve the accuracy and effectiveness of the test. Through simulated attack tests on the network security products to be tested, their security can be evaluated, potential security vulnerabilities and weaknesses can be discovered, and repair suggestions can be provided to improve the security of the products.

[0073] Optionally, the testing method further includes: constructing a correspondence between multiple test cases and multiple attack orchestration plans to establish a preset attack orchestration library.

[0074] The preset attack orchestration library includes multiple test cases and multiple attack orchestration plans. The preset attack orchestration library is established by constructing a corresponding relationship between each test case and the corresponding attack orchestration plan. For example, the preset attack orchestration library includes multiple test cases, such as application access control, application data security, application vulnerability management, application identity authentication and authorization, application input verification, application security audit, application encryption and signature, and application security update and patch management. The preset attack orchestration library also includes multiple attack orchestration plans, such as the first attack orchestration plan, the second attack orchestration plan, the third attack orchestration plan, etc. If the first attack orchestration plan is used to test the access control of the application, the relationship between the first attack orchestration plan and the access control of the application is established.

[0075] The establishment of a preset attack orchestration library enables the test method to simulate a variety of attack methods, including known and unknown attack modes, so as to more comprehensively evaluate the defense capabilities of network security products. By establishing a correspondence between test cases and attack orchestration plans, test cases and attack orchestration plans can be flexibly added, modified or deleted as needed, making the test method very flexible and scalable. Through the preset attack orchestration library, the attack orchestration plan corresponding to a specific test case can be quickly queried, thereby reducing the time and cost of test preparation and improving test efficiency.

[0076] Optionally, the step of constructing a correspondence between a plurality of test cases and a plurality of attack arrangement plans to establish a preset attack arrangement library includes:

[0077] Generate multiple attack orchestration templates according to the second test case, and estimate the attack success rates of the multiple attack orchestration templates, where a first attack success rate and a second attack success rate are any two attack success rates in the multiple attack orchestration templates, and the first attack success rate is greater than the second attack success rate;

[0078] A second attack orchestration plan is constructed according to the attack orchestration template corresponding to the first attack success rate, and a corresponding relationship between the second test case and the second attack orchestration plan is established.

[0079] The second test case in the embodiment of the present application may be equal to the first test case or different from the first test case. The second test case is only used to generate an attack orchestration template exemplarily, and does not limit the specific content of the second test case. Multiple attack orchestration templates are generated according to the second test case, and the attack success rates of the generated multiple attack orchestration templates are estimated based on historical data, and then the attack success rates of the multiple attack orchestration templates are sorted, and the attack orchestration template with the highest attack success rate is used to construct an attack orchestration plan, and a corresponding relationship between the attack orchestration plan and the second test case is established.

[0080] By generating multiple attack orchestration templates based on the second test case and estimating the attack success rates of multiple attack orchestration templates, the attack orchestration template with the highest attack success rate can be found, thereby optimizing the attack strategy and improving the accuracy and efficiency of the test. By building a corresponding attack orchestration plan based on the attack orchestration template with the highest attack success rate, personalized attack strategies can be formulated for different test cases and attack targets to improve the pertinence and effectiveness of the test. By establishing a correspondence between the second test case and the corresponding attack orchestration plan, the relevant test cases and attack orchestration plans can be quickly located and called, thereby improving the flexibility and efficiency of the test. By establishing a preset attack orchestration library, guidance can be provided for the defense strategy of network security products, helping developers identify potential attack patterns and weaknesses, thereby optimizing defense strategies and improving product security.

[0081] Optionally, the second test case includes a first test sub-case and a second test sub-case, the test sub-case corresponds to an attack path between two nodes, the first test sub-case and the second test sub-case are any two attack paths in the second test case, and generating multiple attack orchestration templates according to the second test case includes: arranging and combining the first test sub-case and the second test sub-case to form multiple attack orchestration templates.

[0082] For example, the second test case may be identity authentication and authorization for an application, the first test sub-case may be an attack path from node a to node b, the second test sub-case may be an attack path from node b to node c, and the combination of the first test sub-case and the second test sub-case may form an attack path from node a to node c. It is worth noting that the attack path between two nodes is not unique, therefore, the first test sub-case may be any attack path from node a to node b, and the second test sub-case may be any attack path from node b to node c.

[0083] The content of the second test case in this application is merely exemplary and does not limit the content of the second test case.

[0084] Since multiple attack orchestration templates are formed by permutations and combinations of the first test sub-case and the second test sub-case, the functions of the combination of the two test sub-cases can be tested. This combination test can more accurately evaluate the performance and security of network security products under the combination of multiple sub-functions. By selecting different permutations and combinations of the first test sub-case and the second test sub-case, multiple attack orchestration templates can be flexibly generated. This flexibility enables the test method to adapt to different test requirements and scenarios, improving the pertinence and effectiveness of the test.

[0085] Optionally, the arranging and combining the first test sub-case and the second test sub-case to form a plurality of attack arrangement templates includes:

[0086] Determine a first attack path corresponding to the first test sub-case and a second attack path corresponding to the second test sub-case, and combine the first attack path and the second attack path through a preset logical relationship to form a plurality of attack arrangement templates.

[0087] Figure 2 Schematic diagram of various logical relationships disclosed in the embodiments of this application, including simple dependency, multiple use case pre-position, multiple use case post-position, conditional dependency, use case group, and context parameter transfer. Figure 2 As shown in (a), simple dependency means that the execution order between use cases is established. If the predecessor use case is successfully executed, the successor use case can be executed. Figure 2 As shown in (b), multiple use case predecessors indicate that a use case can depend on multiple predecessors. Figure 2 As shown in (c), multiple use case postpositions indicate that a use case can have multiple postpositions. Figure 2 As shown in (d), conditional dependency means that dependency conditions can be set between use cases. For example, if the result of use case A is not intercepted, use case B will be executed; if the result is intercepted, use case C will be executed. Figure 2 As shown in (e), the use case group is used to reduce the complexity of use case arrangement, allowing a group of related use cases to be combined and externally presented as the behavior of a use case node. The use case group supports the following internal logic: any successful verification result is success, any failed verification result is failure, all successful verification results are success, and all failed verification results are failure. Figure 2 As shown in (f), context parameter transfer allows the output information of the preceding use case to be sent to the context after execution and can be used as the input parameter of the following use case. Attack orchestration materials can come from successful attack paths generated in previous real network attacks and defenses. Because each attack method has a specific use case implementation, writing an attack orchestration template can form an attack path by combining use cases through the above-mentioned multiple logical relationships.

[0088] By arranging and combining the first test sub-case and the second test sub-case, multiple attack orchestration templates can be formed to simulate multiple attack strategies, including known and unknown attack modes, and improve the diversity and effectiveness of the test. By combining successful attack paths through logical relationships, the logical relationships can be flexibly adjusted according to actual conditions to adapt to different test requirements and scenarios, thereby improving the flexibility and scalability of the test. By determining the successful attack paths corresponding to the first test sub-case and the second test sub-case, the relevant test cases and attack orchestration templates can be quickly located and called, reducing the time and cost of test preparation and improving test efficiency.

[0089] Optionally, generating an attack command according to the first attack arrangement plan includes:

[0090] Calling the orchestration execution engine through the task executor to convert the attack orchestration plan into job execution logic data; and

[0091] The task executor sends an attack command to the use case executor according to the job execution logic data.

[0092] Figure 3 is a flow chart of executing the attack arrangement plan disclosed in the embodiment of the present application, such as Figure 3 As shown, the first attack orchestration plan obtained by the query is input into the task executor, and the task executor divides the first attack orchestration plan into tasks and calls the orchestration execution engine to generate job execution logic data. The task executor schedules and executes tasks, generates corresponding commands, sends the commands to the use case executor, and the use case executor executes the commands to simulate the attack behavior, and then returns the execution result to the task executor. The task executor calls the orchestration execution engine again to update the job execution logic data according to the result returned by the use case executor. The security detection device detects the attack behavior and triggers an alarm and sends an alarm log. The alarm log collector receives the alarm log of the security detection device, filters out the relevant logs according to the use case executor address, and sends the relevant logs to the alarm log analyzer. The alarm log analyzer analyzes the alarm log generated by the security detection device, compares it with the attack behavior characteristics, and determines whether the security detection device is effective.

[0093] By calling the orchestration execution engine through the task executor to convert the attack orchestration plan into job execution logic data, and sending the attack command to the use case executor according to the job execution logic data, automatic execution can be achieved, reducing manual intervention and errors, and improving test efficiency. By converting the attack orchestration plan into job execution logic data, the execution order, parameters and conditions of each step can be precisely controlled to ensure the accuracy and consistency of the attack command. Through the cooperation of the task executor and the use case executor, the execution method and process of the attack command can be flexibly adjusted according to the actual situation to adapt to different testing needs and scenarios.

[0094] Optionally, calling the orchestration execution engine by the task executor to convert the attack orchestration plan into job execution logic data includes:

[0095] Generate job execution process data according to the attack orchestration plan through the process building mechanism of the orchestration execution engine;

[0096] Querying the process that meets the conditions according to the job execution process data through the dependency checking mechanism of the orchestration execution engine, and obtaining executable job actions according to the process that meets the conditions;

[0097] Obtaining an actual job action executor according to the executable job action through the action registration mechanism of the orchestration execution engine, and executing the corresponding job using the process context information and the actual job action executor; and

[0098] Integrate the completed execution data into job execution logic data.

[0099] Figure 4 is a schematic diagram of the structure of the orchestration execution engine disclosed in the embodiment of the present application, such as Figure 4 As shown, the orchestration execution engine includes a process management module 401 and an action management module 402. The process construction mechanism of the process management module 401 generates job execution process data according to the first attack orchestration plan. The dependency check mechanism of the process management module 401 queries the process that meets the conditions according to the job execution process data, and obtains the executable job action according to the process that meets the conditions. After obtaining the executable job action, the actual job action executor is obtained through the action registration mechanism. The action execution mechanism uses the process context information and the job action executor to trigger the job execution. After the action executor is executed, the result is fed back to the dependency update mechanism of the process management module 401. The dependency update mechanism updates the dependency state according to the execution result to determine the subsequent process execution action, and transmits the context information at the same time. If the service is restarted, the interruption recovery mechanism will restore the action execution before the restart.

[0100] Through the dependency checking mechanism of the orchestration execution engine, it is possible to query the processes that meet the conditions, and obtain executable job actions based on the processes that meet the conditions, thereby ensuring that the dependency of the attack command is met and avoiding errors and conflicts. Through the action registration mechanism of the orchestration execution engine, it is possible to obtain the actual job action executor based on the executable job action, and use the process context information and the actual job action executor to execute the corresponding job, thereby achieving high efficiency and accuracy in action registration and execution. By integrating the completed execution data into job execution logic data, it is convenient to analyze and evaluate the execution results of the attack command in the future, and improve the traceability and analyzability of the test. Through the coordinated use of the task executor and the orchestration execution engine, it can be expanded and maintained as needed to adapt to different test requirements and scenarios, and improve the scalability and maintainability of the test.

[0101] This embodiment also discloses a test system for simulating attacks. Figure 5 is a schematic diagram of a module of a test system for simulating attacks disclosed in an embodiment of the present application, such as Figure 5 As shown, the test system includes a collection module 501, a query module 502, a command module 503 and an execution module 504, wherein:

[0102] The acquisition module 501 is configured to obtain a first test case in response to a user testing a network security product operation, where the first test case is any one of the historical attack cases;

[0103] A query module 502 is configured to query a first attack orchestration plan corresponding to the first test case from a preset attack orchestration library, wherein the preset attack orchestration library includes a correspondence between the first test case and the first attack orchestration plan;

[0104] A command module 503, configured to generate an attack command according to the first attack arrangement plan; and

[0105] The execution module 504 is configured to execute the attack command to simulate the attack on the network security product to be tested, and determine whether the network security product to be tested meets the requirements according to the execution result.

[0106] Optionally, the test system further includes a library building module, and the library building module is configured to: construct a correspondence between multiple test cases and multiple attack orchestration plans to establish a preset attack orchestration library.

[0107] Optionally, the library building module is further configured to:

[0108] Generate multiple attack orchestration templates according to the second test case, and estimate the attack success rates of the multiple attack orchestration templates, where a first attack success rate and a second attack success rate are any two attack success rates in the multiple attack orchestration templates, and the first attack success rate is greater than the second attack success rate;

[0109] A second attack orchestration plan is constructed according to the attack orchestration template corresponding to the first attack success rate, and a corresponding relationship between the second test case and the second attack orchestration plan is established.

[0110] Optionally, the second test case includes a first test sub-case and a second test sub-case, the test sub-case corresponds to an attack path between two nodes, the first test sub-case and the second test sub-case are any two attack paths in the second test case, and the library building module is further configured to:

[0111] The first test sub-cases and the second test sub-cases are arranged and combined to form a plurality of attack arrangement templates.

[0112] Optionally, the library building module is further configured to:

[0113] Determine a first attack path corresponding to the first test sub-case and a second attack path corresponding to the second test sub-case, and combine the first attack path and the second attack path through a preset logical relationship to form a plurality of attack arrangement templates.

[0114] Optionally, the command module 503 is further configured to:

[0115] Calling the orchestration execution engine through the task executor to convert the attack orchestration plan into job execution logic data; and

[0116] The task executor sends an attack command to the use case executor according to the job execution logic data.

[0117] Optionally, the command module 503 is further configured to:

[0118] Generate job execution process data according to the attack orchestration plan through the process building mechanism of the orchestration execution engine;

[0119] Querying the process that meets the conditions according to the job execution process data through the dependency checking mechanism of the orchestration execution engine, and obtaining executable job actions according to the process that meets the conditions;

[0120] Obtaining an actual job action executor according to the executable job action through the action registration mechanism of the orchestration execution engine, and executing the corresponding job using the process context information and the actual job action executor; and

[0121] Integrate the completed execution data into job execution logic data.

[0122] It should be noted that: when the device provided in the above embodiment realizes its function, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0123] This embodiment also discloses an electronic device, referring to Figure 6 The electronic device may include: at least one processor 601 , at least one communication bus 602 , a user interface 603 , a network interface 604 , and at least one memory 605 .

[0124] The communication bus 602 is used to realize the connection and communication between these components.

[0125] The user interface 603 may include a display screen (Display) and a camera (Camera). The optional user interface 603 may also include a standard wired interface and a wireless interface.

[0126] The network interface 604 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0127] Among them, the processor 601 may include one or more processing cores. The processor 601 uses various interfaces and lines to connect various parts in the entire server, and executes various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 605, and calling data stored in the memory 605. Optionally, the processor 601 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 601 can integrate one or a combination of a central processing unit 601 (Central Processing Unit, CPU), an image processor 601 (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 601, and it can be implemented separately through a chip.

[0128] The memory 605 may include a random access memory 605 (RAM) or a read-only memory 605 (Read-Only Memory). Optionally, the memory 605 includes a non-transitory computer-readable storage medium. The memory 605 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 605 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 605 may also be at least one storage device located away from the aforementioned processor 601. As shown in the figure, the memory 605 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an application program for a test method for simulating attacks.

[0129] exist Figure 6 In the electronic device shown, the user interface 603 is mainly used to provide an input interface for the user and obtain data input by the user; and the processor 601 can be used to call the application program of the test method of simulating attack stored in the memory 605. When executed by one or more processors 601, the electronic device executes one or more methods in the above-mentioned embodiments.

[0130] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for the present application.

[0131] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0132] In the several embodiments provided in this application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0133] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0134] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0135] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory 605. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory 605 and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory 605 includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk.

[0136] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the disclosure of the specification and the truth of practice, it will be easy for those skilled in the art to think of other embodiments of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field that are not recorded in the present disclosure. The description and examples are regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A test method for simulating attacks, It is characterized in that Applied to a simulation test platform, the method comprises: In response to a user testing a network security product operation, obtaining a first test case, wherein the first test case is any one of historical attack cases; Querying a first attack orchestration plan corresponding to the first test case from a preset attack orchestration library, wherein the preset attack orchestration library includes a correspondence between the first test case and the first attack orchestration plan; Generate an attack command according to the first attack arrangement plan; and Execute the attack command to simulate the attack on the network security product to be tested, and determine whether the network security product to be tested meets the requirements according to the execution result. Generating an attack command according to the first attack arrangement plan includes: Calling the orchestration execution engine through the task executor to convert the first attack orchestration plan into job execution logic data; and Sending attack commands to the use case executor through the task executor according to the job execution logic data, The step of converting the first attack orchestration plan into job execution logic data by calling the orchestration execution engine through the task executor includes: Generate job execution process data according to the first attack orchestration plan through the process building mechanism of the orchestration execution engine; Querying the process that meets the conditions according to the job execution process data through the dependency checking mechanism of the orchestration execution engine, and obtaining executable job actions according to the process that meets the conditions; Obtaining an actual job action executor according to the executable job action through the action registration mechanism of the orchestration execution engine, and executing the corresponding job using the process context information and the actual job action executor; and Integrate the completed execution data into job execution logic data.

2. The test method for simulating an attack according to claim 1, It is characterized in that The test method also includes: Build a correspondence between multiple test cases and multiple attack orchestration plans to establish a preset attack orchestration library.

3. The test method for simulating an attack according to claim 2, It is characterized in that The constructing of a correspondence between a plurality of test cases and a plurality of attack arrangement plans to establish a preset attack arrangement library comprises: Generate multiple attack orchestration templates according to the second test case, and estimate the attack success rates of the multiple attack orchestration templates, where a first attack success rate and a second attack success rate are any two attack success rates in the multiple attack orchestration templates, and the first attack success rate is greater than the second attack success rate; A second attack orchestration plan is constructed according to the attack orchestration template corresponding to the first attack success rate, and a corresponding relationship between the second test case and the second attack orchestration plan is established.

4. The test method for simulating an attack according to claim 3, It is characterized in that The second test case includes a first test sub-case and a second test sub-case, the test sub-case corresponds to an attack path between two nodes, the first test sub-case and the second test sub-case are any two attack paths in the second test case, and generating multiple attack orchestration templates according to the second test case includes: The first test sub-cases and the second test sub-cases are arranged and combined to form a plurality of attack arrangement templates.

5. The test method for simulating an attack according to claim 4, It is characterized in that The arranging and combining the first test sub-case and the second test sub-case to form a plurality of attack arrangement templates includes: Determine a first attack path corresponding to the first test sub-case and a second attack path corresponding to the second test sub-case, and combine the first attack path and the second attack path through a preset logical relationship to form a plurality of attack arrangement templates.

6. A test system for simulating attacks, It is characterized in that The test system includes a collection module, a query module, a command module and an execution module, wherein: A collection module configured to obtain a first test case in response to a user testing a network security product operation, wherein the first test case is any one of the historical attack cases; A query module configured to query a first attack orchestration plan corresponding to the first test case from a preset attack orchestration library, wherein the preset attack orchestration library includes a correspondence between the first test case and the first attack orchestration plan; a command module, configured to generate an attack command according to the first attack arrangement plan; and an execution module configured to execute the attack command to simulate an attack on the network security product to be tested, and determine whether the network security product to be tested meets the requirements according to the execution result, The command module is also configured to: Calling the orchestration execution engine through the task executor to convert the first attack orchestration plan into job execution logic data; and Sending attack commands to the use case executor through the task executor according to the job execution logic data, The command module is also configured to: Generate job execution process data according to the first attack orchestration plan through the process building mechanism of the orchestration execution engine; Querying the process that meets the conditions according to the job execution process data through the dependency checking mechanism of the orchestration execution engine, and obtaining executable job actions according to the process that meets the conditions; Obtaining an actual job action executor according to the executable job action through the action registration mechanism of the orchestration execution engine, and executing the corresponding job using the process context information and the actual job action executor; and Integrate the completed execution data into job execution logic data.

7. An electronic device, It is characterized in that It includes a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the method as described in any one of claims 1-5.

8. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores instructions, and when the instructions are executed, the method steps according to any one of claims 1 to 5 are performed.

Images