Active simulation intrusion assessment and full-link visual protection system, method and equipment

Abstract

A system, method and equipment for active simulation of intrusion assessment and full-link visual protection, the system comprising a test module, a simulation module, a central control module, an attack display module, a monitoring module, an analysis module, a solution generation module, a defense module and an adaptation module; the present invention actively simulates attacks through the mutual collaboration of various modules, so as to be able to timely discover and evaluate potential security risks and business impacts, thereby helping enterprises to take measures in advance and reduce potential losses, thereby improving the initiative of security defense, and adopting the characteristics of the full-link visual attack path so that relevant personnel can intuitively understand the attack process and identify weak links, and then quickly respond and solve problems, shortening the window period of system maintenance, and making security protection more solid and continuously effective.

Description

Technical Field

[0001] The present invention relates to network protection means, belonging to the field of network security technology, and in particular to an active simulated intrusion assessment and full-link visual protection system, method and equipment. Background Art

[0002] Network security usually refers to the security of computer networks, but in fact it can also refer to the security of computer communication networks. A computer communication network is a system that interconnects several computers with independent functions through communication equipment or transmission media, and with the support of communication software, realizes information transmission and exchange between computers. A computer network refers to a system that uses communication means to connect several relatively dispersed independent computer systems, terminal devices and data devices for the purpose of sharing resources, and exchanges data under the control of protocols. The fundamental purpose of computer networks is resource sharing, and communication networks are the way to achieve network resource sharing. Therefore, if a computer network is secure, the corresponding computer communication network must also be secure and should be able to realize information exchange and resource sharing for network users. Therefore, network security includes both computer network security and computer communication network security.

[0003] In the current network security field, enterprises and organizations are facing an ever-increasing threat of network attacks. Traditional security defense mechanisms are mostly passive responses, and measures are often taken only after the attack occurs. This leads to insufficient identification and response speed of attack sources, attack links and weak points. In addition, existing network threat analysis technologies have problems such as limited big data processing capabilities, missing threat models, unstable data quality, lack of standards and specifications, and poor processing of unknown and small sample data, resulting in insufficient security. Summary of the invention

[0004] The purpose of the present invention is to overcome the defects and problems of hysteresis and insufficient security in the prior art, and to provide an active simulated intrusion assessment and full-link visual protection system, method and equipment that can actively protect to improve communication security.

[0005] To achieve the above objectives, the technical solution of the present invention is: an active simulated intrusion assessment and full-link visual protection system, the system comprising:

[0006] The test module is used to analyze the internal structure and logic of the protection system and build a prediction model;

[0007] The simulation module is used to simulate various network attacks based on predefined attack scenarios and strategies;

[0008] The central control module is used to connect various modules and coordinate and manage the operation of each module;

[0009] Attack display module, used to compare and display network attacks;

[0010] Monitoring module, used to continuously monitor network activities;

[0011] An analysis module, used to collect and analyze network activity data, identify potential threats and weaknesses in the protection system; the network activity data includes network configuration files, log files, and code libraries;

[0012] Solution generation module, used to generate solutions to network problems based on the analysis results of the analysis module, and provide repair suggestions and network security improvement strategies;

[0013] Defense module, which is used to actively simulate network attacks and transform security defense strategies to prevent potential threats;

[0014] The adaptation module is used to dynamically adjust the test scenarios and analysis strategies of the prediction model according to changes in network activities.

[0015] The operating logic of the test module is as follows:

[0016] First, a support vector machine algorithm is used to analyze and extract features that help identify security vulnerabilities from the protection system's network configuration files, log files, and code libraries. Then, based on the features, a predictive model is established to identify potential security vulnerabilities and weaknesses. The predictive model is continuously learned and updated to adapt to changes in the network environment and emerging threats. The features include insecure function calls, unexpected port openings, or incorrect permission settings.

[0017] The operation logic of the central control module is as follows:

[0018] The central control module monitors the overall status of the system in real time, uses a neural network-based optimization algorithm to coordinate and manage the various modules in the protection system, and intelligently allocates system resources and priorities by evaluating the performance and response time of each module. It also handles changes in the network environment and emerging threats by dynamically adjusting algorithm parameters.

[0019] The operation logic of the attack display module is as follows:

[0020] First, based on the ATT&CK framework, compare the ongoing attack behavior structure with the attack behavior structure in the ATT&CK framework to determine the attack type and strategy, and then display the attack source, attack path, and weak points of the attack behavior in a visual form.

[0021] The operating logic of the analysis module is as follows:

[0022] S1. Obtain target network related data, and integrate and process the target network data using a data integration algorithm to obtain target network data, and then use a target network noise reduction algorithm to perform noise reduction on the target network data to obtain target network noise reduction data; the target network related data includes log files, communication data, and API data;

[0023] S2. Use feature extraction technology to perform feature extraction processing on the target network noise reduction data to obtain target network data features, and then use semantic conversion algorithm to perform data semantic processing on the target network data features to obtain target network semantic data;

[0024] S3, preprocessing the target network semantic data to obtain a target network semantic specific data set, and then performing target network threat analysis on the target network semantic specific data set according to a preset large language model to obtain a target network threat inference result;

[0025] S4. Fine-tune the target network threat reasoning result using the target network fine-tuning technology to obtain the target network threat reasoning optimization result, and then use the adaptive adaptation technology to autonomously adapt the target network threat reasoning optimization result to obtain the target network threat adaptation result;

[0026] S5. Use the vulnerability detection and analysis algorithm to perform vulnerability correlation analysis on the target network threat adaptation results to obtain the target network threat vulnerability detection results, and then formulate a target network threat detection and analysis report based on the target network threat vulnerability detection results to execute the corresponding target network threat analysis management strategy.

[0027] The step of acquiring the target network data in step S1 includes:

[0028] S11. Collect and process the behavior data of the log files through the behavior collection technology to obtain the user behavior data of the target network; collect and process the communication data through the data collection tool to obtain the communication data of the target network; decrypt and analyze the API data using the API key of the multi-service provider through the multi-service provider API interface to obtain the target network API decryption data;

[0029] S12. Using a data integration algorithm, the target network user behavior data, the target network communication data, and the target network API decryption data are integrated and processed to obtain the target network data.

[0030] The operation logic of the solution generation module is as follows:

[0031] The solution generation module automatically marks and records detailed data when the protection system finds potential threats and vulnerabilities, and generates specific security reinforcement and repair solutions based on the identified potential threats and vulnerabilities.

[0032] An active simulated intrusion assessment and full-link visual protection method, which is applied to the above system, includes:

[0033] Step 1: Test the internal structure and logic of the protection system based on the white box testing method, and simulate various network attacks according to predefined attack scenarios and strategies;

[0034] Step 2: Compare the attack structures of various network attacks and display the entire chain, and continuously monitor and analyze network activities;

[0035] Step 3: Analyze and collect network activity data and network attack patterns to identify potential threats and weaknesses in the protection system;

[0036] Step 4: Generate problem solutions based on potential threats and weaknesses, and proactively simulate network attacks to change security defense strategies to prevent potential threats;

[0037] Step 5. Repeat steps 1 to 5, and dynamically adjust the test scenarios, analysis strategies, and security defense strategies based on changes in the network activity environment or emerging potential threats.

[0038] An active simulated intrusion assessment and full-link visual protection device, the device comprising a processor and a memory;

[0039] The memory is used to store computer program code and transmit the computer program code to the processor;

[0040] The processor is used to execute the above-mentioned active simulation intrusion assessment and full-link visual protection method according to the instructions in the computer program code.

[0041] A computer storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned active simulated intrusion assessment and full-link visual protection method.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] The present invention discloses an active simulation intrusion assessment and full-link visual protection system, the system comprising a test module, a simulation module, a central control module, an attack display module, a monitoring module, an analysis module, a solution generation module, a defense module, and an adaptation module; in application, the design actively simulates attacks through the mutual cooperation of various modules, so as to be able to timely discover and evaluate potential security risks and business impacts, thereby helping enterprises to take measures in advance and reduce potential losses, thereby improving the initiative of security defense, and adopting the characteristics of the full-link visual attack path so that relevant personnel can intuitively understand the attack process and identify weak links, and then quickly respond and solve problems, shortening the window period of system maintenance, and making security protection more solid and continuously effective. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a schematic diagram of the system structure of the present invention.

[0045] Figure 2 It is a flow chart of the method steps of the present invention.

[0046] Figure 3 It is a schematic diagram of the device structure of the present invention.

[0047] In the figure: test module 1, simulation module 2, central control module 3, attack display module 4, monitoring module 5, analysis module 6, solution generation module 7, defense module 8, adaptation module 9, processor 10, memory 11, computer program code 110. DETAILED DESCRIPTION

[0048] The present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0049] Embodiment 1:

[0050] See also Figure 1 , an active simulated intrusion assessment and full-link visual protection system, the system comprising:

[0051] Test module 1 is used to automatically analyze the internal structure and logic of the protection system and build a prediction model;

[0052] Furthermore, the operating logic of the test module 1 is as follows:

[0053] First, a support vector machine algorithm is used to analyze and extract features that help identify security vulnerabilities from the network configuration files, log files, and code libraries of the protection system through white-box testing methods. Then, based on the features, a predictive model for identifying potential security vulnerabilities and weaknesses is established. The predictive model is continuously learned and updated to adapt to changes in the network environment and emerging threats. The features include insecure function calls, unexpected port openings, or incorrect permission settings.

[0054] Furthermore, the support vector machine algorithm is used to implement the corresponding function, including the following steps:

[0055] 1. Data collection and preprocessing;

[0056] (1) Collect data: First, you need to collect data from network configuration files, log files, code libraries, and other relevant documents;

[0057] (2) Feature extraction: Analyze the collected data and extract features that help identify security vulnerabilities; for example, insecure function calls, unexpected port openings, incorrect permission settings, etc.

[0058] (3) Feature selection: Select the most meaningful features through principal component analysis (PCA) or through the knowledge of domain experts;

[0059] (4) Data cleaning: processing missing values, outliers and noise, standardizing or normalizing feature values ​​for SVM processing;

[0060] 2. Model training;

[0061] (1) Select the SVM kernel function: Select an appropriate kernel function according to the characteristics of the data, such as linear kernel, polynomial kernel, radial basis function (RBF) kernel, etc.

[0062] (2) Model training: Use the training data set to train the SVM model; this process includes selecting the optimal hyperparameters, such as the penalty parameter C and kernel function parameters;

[0063] (3) Cross-validation: Use k-fold cross-validation to evaluate the performance of the model and select the best parameters;

[0064] 3. Model evaluation;

[0065] (1) Performance evaluation: Use the test set to evaluate the performance of the SVM model. Common evaluation indicators include accuracy, recall, F1 score, etc.

[0066] (2) Error analysis: Analyze the misclassified samples to understand the shortcomings of the model;

[0067] 4. Model deployment;

[0068] (1) Model deployment: Deploy the trained model to the actual environment to monitor the security status of the network system in real time;

[0069] (2) Real-time monitoring: After deployment, the model can analyze network traffic and configuration changes in real time to identify security threats;

[0070] 5. Model updating and learning;

[0071] (1) Continuous learning: As the network environment and attack methods change, the model is regularly updated with newly collected data to maintain its accuracy;

[0072] (2) Adaptive mechanism: Online learning or incremental learning strategies can be introduced to enable the model to adapt to new data without retraining.

[0073] During the coding and implementation phase, programming languages ​​such as Python can be used to implement SVM using libraries such as scikit-learn.

[0074] Simulation module 2 is used to simulate various network attacks to test the anti-attack capability of the protection system according to predefined attack scenarios and strategies;

[0075] The central control module 3 is used to connect various modules and coordinate and manage the operation of various modules using a neural network-based optimization algorithm; its working principle includes monitoring network activities, formulating defense strategies based on intelligence and analysis results, and controlling the operation of attack display, monitoring, analysis, solution generation, defense and adaptation modules to protect the security of the network.

[0076] Furthermore, the operation logic of the central control module 3 is as follows:

[0077] The central control module 3 monitors the overall status of the system in real time, uses a neural network-based optimization algorithm to coordinate and manage the various modules in the protection system, and intelligently allocates system resources and priorities by evaluating the performance and response time of each module. At the same time, it handles changes in the network environment and emerging threats by dynamically adjusting algorithm parameters.

[0078] Attack display module 4, used to compare and display network attacks;

[0079] Furthermore, the operation logic of the attack display module 4 is as follows:

[0080] First, based on the ATT&CK framework, compare the ongoing attack behavior structure with the attack behavior structure in the ATT&CK framework to determine the attack type and strategy, and then display the attack source, attack path, and weak points of the attack behavior in a visual form.

[0081] Monitoring module 5 is used to continuously monitor and analyze network activities to timely discover potential threats and vulnerabilities; it identifies anomalies and potential threats by monitoring network traffic and behavior.

[0082] The analysis module 6 is used to collect network activity data, analyze network attacks, identify potential threats and weaknesses of the protection system, and use analysis algorithms to detect threats and generate reports.

[0083] Furthermore, the operating logic of the analysis module 6 is as follows:

[0084] S1. Obtain target network related data, and integrate and process it using a data integration algorithm to obtain target network data, and then use a target network noise reduction algorithm (such as a filter, an outlier detection method) to perform noise reduction on the target network data to obtain target network noise reduction data; the target network related data includes log files, communication data, and API data;

[0085] Furthermore, the step of acquiring the target network data in step S1 includes:

[0086] S11. Collect and process the behavior data of the log files through behavior collection technology (such as network monitoring tools, log management systems) to obtain the target network user behavior data; collect and process the communication data through data collection tools (such as Wireshark, tcpdump) to obtain the target network communication data; decrypt and analyze the API data using the API key pairs of multiple service providers through the API interface (such as AWS API, Google Cloud API, etc.) to obtain the target network API decryption data;

[0087] S12. Using a data integration algorithm (such as data fusion technology), the target network user behavior data, the target network communication data, and the target network API decryption data are integrated and processed to obtain the target network data.

[0088] S2. Use feature extraction technology (such as feature selection technology in machine learning algorithms) to perform feature extraction processing on the target network noise reduction data to obtain target network data features, and then use semantic transformation algorithm to perform data semantic processing on the target network data features to obtain target network semantic data;

[0089] S3, preprocessing the target network semantic data to obtain a target network semantic specific data set, and then performing target network threat analysis on the target network semantic specific data set according to a preset large language model (such as GPT, BERT) to obtain a target network threat inference result;

[0090] S4. Fine-tune the target network threat inference result using the target network fine-tuning technology to obtain the target network threat inference optimization result, and then use the adaptive adaptation technology (such as online learning, incremental learning) to autonomously adapt the target network threat inference optimization result to obtain the target network threat adaptation result;

[0091] S5. Use vulnerability detection and analysis algorithms (such as signature-based detection and behavior analysis) to perform vulnerability correlation analysis on the target network threat adaptation results to obtain the target network threat vulnerability detection results, and then formulate a target network threat detection and analysis report based on the target network threat vulnerability detection results to implement the corresponding target network threat analysis management strategy. The report should include vulnerability details, affected systems, recommended security reinforcement measures, etc.

[0092] Solution generation module 7, used to generate solutions to network problems based on the analysis results of analysis module 6, and provide repair suggestions and network security improvement strategies;

[0093] Furthermore, the operation logic of the solution generation module 7 is as follows:

[0094] When the protection system finds potential threats and vulnerabilities, the solution generation module 7 automatically marks and records detailed data, and generates specific security reinforcement and repair solutions based on the identified potential threats and vulnerabilities.

[0095] Defense Module 8 is used to transform the security defense strategy from passive to active to guard against potential threats by actively simulating network attacks and continuous monitoring; it can automatically respond to attacks and take necessary measures to protect the network.

[0096] Adaptation module 9 is used to dynamically adjust the test scenarios and analysis strategies of the prediction model according to changes in the network environment and emerging threat patterns, which can ensure that the system can adapt to changing threats and maintain a high level of vigilance and responsiveness.

[0097] Embodiment 2:

[0098] See also Figure 2 , an active simulated intrusion assessment and full-link visual protection method, the method is applied to the system described in Example 1, the method comprising:

[0099] Step 1: Test the internal structure and logic of the protection system based on the white box testing method, and simulate various network attacks according to predefined attack scenarios and strategies;

[0100] Step 2: Compare the attack structures of various network attacks and display the entire chain, and continuously monitor and analyze network activities;

[0101] Step 3: Analyze and collect network activity data and network attack patterns to identify potential threats and weaknesses in the protection system;

[0102] Step 4: Generate problem solutions based on potential threats and weaknesses, and proactively simulate network attacks to change security defense strategies to prevent potential threats;

[0103] Step 5: Repeat steps 1 to 5, and dynamically adjust the test scenarios, analysis strategies, and security defense strategies based on changes in the network activity environment or emerging potential threats.

[0104] Embodiment 3:

[0105] See also Figure 3 , an active simulated intrusion assessment and full-link visual protection device, the device comprising a processor 10 and a memory 11;

[0106] The memory 11 is used to store the computer program code 110 and transmit the computer program code 110 to the processor 10;

[0107] The processor 10 is used to execute the active simulated intrusion assessment and full-link visual protection method described in Example 2 according to the instructions in the computer program code 110.

[0108] Embodiment 4:

[0109] A computer storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the active simulated intrusion assessment and full-link visual protection method described in Example 2 is implemented.

[0110] Generally speaking, the computer instructions for implementing the method of the present invention may be carried in any combination of one or more computer-readable storage media. Non-transitory computer-readable storage media may include any computer-readable media, except for the signal itself that is temporarily propagating.

[0111] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EKROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, device, or device.

[0112] Computer program code for performing the operation of the present invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, SMalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages, in particular, Python suitable for neural network computing and platform frameworks based on TensorFlow, PyTorch, etc. can be used. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer or to an external computer (for example, using an Internet service provider to connect via the Internet) through any type of network, including a local area network (LAN) or a wide area network (WAN).

[0113] The above-mentioned devices and non-temporary computer-readable storage media can be found in the detailed description of the active simulation intrusion assessment and full-link visual protection system and their beneficial effects, which will not be repeated here.

[0114] Although the embodiments of the present invention have been shown and described above, it should be understood that the above embodiments are exemplary and should not be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. An active simulation intrusion assessment and full-link visual protection system, characterized in that: The system comprises: The test module (1) is used to analyze the internal structure and logic of the protection system and build a prediction model; A simulation module (2), used for simulating various network attacks according to predefined attack scenarios and strategies; Central control module (3), used to connect various modules and coordinate and manage the operation of various modules; An attack display module (4), used for comparing and displaying network attacks; A monitoring module (5), used for continuously monitoring network activities; An analysis module (6) is used to collect and analyze network activity data to identify potential threats and weaknesses in the protection system; the network activity data includes network configuration files, log files, and code libraries; A solution generation module (7), used to generate a solution to the network problem based on the analysis result of the analysis module (6), and to provide repair suggestions and network security improvement strategies; A defense module (8) for proactively simulating network attacks and transforming security defense strategies to guard against potential threats; An adaptation module (9), used for dynamically adjusting the test scenarios and analysis strategies of the prediction model according to changes in network activities; The operating logic of the test module (1) is as follows: First, the support vector machine algorithm is used to analyze and extract features that are helpful in identifying security vulnerabilities from the network configuration files, log files, and code bases of the protection system. Then, based on the features, a prediction model for identifying potential security vulnerabilities and weaknesses is established, and the prediction model is continuously learned and updated to adapt to changes in the network environment and emerging threats. The features include insecure function calls, unexpected port openings, or incorrect permission settings. The operation logic of the central control module (3) is as follows: The central control module (3) monitors the overall status of the system in real time, uses a neural network-based optimization algorithm to coordinate and manage the various modules in the protection system, and intelligently allocates system resources and priorities by evaluating the performance and response time of each module, while dynamically adjusting algorithm parameters to handle changes in the network environment and emerging threats; The operation logic of the attack display module (4) is as follows: First, based on the ATT&CK framework, the ongoing attack behavior structure is compared with the attack behavior structure in the ATT&CK framework to determine the attack type and strategy. Then, the attack source, attack path, and weak points of the attack behavior are displayed in a visual form. The operating logic of the analysis module (6) is as follows: S1. Obtain target network related data, and integrate and process it using a data integration algorithm to obtain target network data, and then use a target network noise reduction algorithm to perform noise reduction on the target network data to obtain target network noise reduction data; the target network related data includes log files, communication data, and API data; S2. Use feature extraction technology to perform feature extraction processing on the target network noise reduction data to obtain target network data features, and then use semantic conversion algorithm to perform data semantic processing on the target network data features to obtain target network semantic data; S3, preprocessing the target network semantic data to obtain a target network semantic specific data set, and then performing target network threat analysis on the target network semantic specific data set according to a preset large language model to obtain a target network threat inference result; S4. Fine-tune the target network threat reasoning result using the target network fine-tuning technology to obtain the target network threat reasoning optimization result, and then use the adaptive adaptation technology to autonomously adapt the target network threat reasoning optimization result to obtain the target network threat adaptation result; S5. Perform vulnerability correlation analysis on the target network threat adaptation result using a vulnerability detection analysis algorithm to obtain a target network threat vulnerability detection result, and then formulate a target network threat detection analysis report based on the target network threat vulnerability detection result to execute a corresponding target network threat analysis management strategy; The step of acquiring the target network data in step S1 includes: S11. Collect and process the behavior data of the log files through the behavior collection technology to obtain the user behavior data of the target network; collect and process the communication data through the data collection tool to obtain the communication data of the target network; decrypt and analyze the API data using the API key of the multi-service provider through the multi-service provider API interface to obtain the target network API decryption data; S12, using a data integration algorithm to integrate the target network user behavior data, the target network communication data, and the target network API decryption data to obtain the target network data; The operation logic of the solution generation module (7) is as follows: The solution generation module (7) automatically marks and records detailed data when the protection system finds potential threats and vulnerabilities, and generates specific security reinforcement and repair solutions based on the identified potential threats and vulnerabilities.

2. An active simulated intrusion assessment and full-link visual protection method, characterized in that: The method is applied to the system according to claim 1, and the method comprises: Step 1: Test the internal structure and logic of the protection system based on the white box testing method, and simulate various network attacks according to predefined attack scenarios and strategies; Step 2: Compare the attack structures of various network attacks and display the entire chain, and continuously monitor and analyze network activities; Step 3: Analyze and collect network activity data and network attack patterns to identify potential threats and weaknesses in the protection system; Step 4: Generate problem solutions based on potential threats and weaknesses, and proactively simulate network attacks to change security defense strategies to prevent potential threats; Step 5: Repeat steps 1 to 5, and dynamically adjust the test scenarios, analysis strategies, and security defense strategies based on changes in the network activity environment or emerging potential threats.

3. An active simulated intrusion assessment and full-link visual protection device, characterized by: The device comprises a processor (10) and a memory (11); The memory (11) is used to store computer program code (110) and transmit the computer program code (110) to the processor (10); The processor (10) is used to execute the active simulated intrusion assessment and full-link visual protection method described in claim 2 according to the instructions in the computer program code (110).

4. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the active simulated intrusion assessment and full-link visual protection method described in claim 2 is implemented.

Images