A method and device for verifying the function of a WEB security protection product based on virtual services

Abstract

The invention discloses a method and device for verifying the function of a web security protection product based on a virtual service, and relates to the technical field of network security, and comprises the following steps: S1: deployment phase: installing a virtual service and an attack end on both sides of a web security protection product, and then configuring the address and port of the virtual service on the web security protection product end; S2: verification phase: launching a verification simulation attack, and providing a conclusion on the function of the web security protection product according to the attack result; the method and device for verifying the function of a web security protection product based on a virtual service, since the attack traffic actually reaches the virtual service, will not cause a load on the web of a production environment, will not affect the performance of the web service of the production environment, and since the attacked end is a virtual service, when the web security protection product does not intercept the attack traffic, will not cause anomalies in the web service of the production environment or damage to the server where the web service of the production environment is located.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and device for verifying the function of a WEB security protection product based on a virtual service. Background Art

[0002] Web security products match some specific malicious http content through some rules. Once matched, they will alarm or intercept to achieve the purpose of protection. Usually, we need a method or device to verify the interception or alarm function of a Web security product. The Web security product can be WAF, a next-generation firewall with reverse proxy function, SASE product, etc.

[0003] There are two main methods for verifying the functions of Web security protection products:

[0004] Technology 1: Verification is performed in the actual production environment. That is, during the verification process, the data flow of the traffic is from the attack end to the production environment Web security protection product to the production environment web service. Figure 1 Shown

[0005] This approach has the following problems:

[0006] 1. The attack traffic actually reaches the web service in the production environment, which will cause a load on the web in the production environment and may affect the performance of the web service in the production environment to a certain extent;

[0007] 2. The attack traffic actually reaches the web service in the production environment. If the web security protection product does not intercept the attack traffic, if there is a vulnerability in the web service itself, it may cause the web service to be abnormal or the server where the web service is located to be damaged;

[0008] 3. Since the attacker cannot know the normal return content of the web service before the attack, when receiving the return attack data packet, it is also impossible to determine whether the return content is the content intercepted and modified by the Web security protection product, which can easily lead to deviations in judging whether the Web security protection product has intercepted, that is, inaccuracy;

[0009] 4. When the target vulnerability attacked by the attack traffic does not exist in the web service of the production environment, the response packet of the production environment is very different from the web service with the actual vulnerability, resulting in the data packet returned to the web security protection product being untrue, which may affect the verification result;

[0010] Technology 2: Verification is performed in a non-production environment, that is, during the verification process, the data flow of the traffic is from the attack end to the Web security protection product to the target machine web service. Figure 2As shown. The target web service refers to a web service with real vulnerabilities. This method still has the defects in Problem 2 described in Technology 1, but it also introduces new problems. Deploying a real target with vulnerabilities in a production environment introduces new unstable factors into the production environment, which may be exploited by attackers, causing insecurity in the entire network environment.

[0011] In order to provide a verification solution that does not affect the production environment load, is safe, reliable, and has accurate results, a method and device for verifying the function of a WEB security protection product based on virtual services are proposed. Summary of the invention

[0012] In view of the deficiencies in the prior art, the present invention provides a method and device for verifying the function of a WEB security protection product based on a virtual service, which solves the problems raised in the above-mentioned background technology.

[0013] To achieve the above objectives, the present invention is implemented through the following technical solutions: A method for verifying the function of a WEB security protection product based on a virtual service, comprising the following steps:

[0014] S1: Deployment phase: Install the virtual service and the attack end on both sides of the Web security protection product, and then configure the address and port of the virtual service on the Web security protection product;

[0015] S2: Verification phase: Initiate a verification simulation attack and draw conclusions about the functions of the Web security protection product based on the attack results. This phase includes the following sub-step features:

[0016] S21: The attack end sends an attack configuration to the virtual service; the attack configuration may include an attack packet, a response packet sequence, or other content; the attack packet, the response packet sequence may be in pcap format, may be an http content description, or may be a binary format after base64, etc.;

[0017] S22: After receiving the attack configuration, the virtual service starts the corresponding service on the specific port;

[0018] S23: The control end sends the attack configuration to the attack end;

[0019] S24: The attacker launches an attack on the virtual service;

[0020] S25: The virtual service waits for the data packet to be received on the listening port, and determines whether there is a certain difference between the content in the attack configuration sent by the control end to the virtual service in step 3;

[0021] S26: The virtual service determines whether to continue the attack. If yes, it proceeds to sub-step 7. If no, it ends the attack and returns the result to the control end. The determination of whether to continue the attack refers to determining whether there is a new response packet after the attack response packet in the configuration description of the attack configuration sent by the control end to the virtual service in step S21, or whether there is a new attack data packet after the attack data packet;

[0022] S27: The virtual service returns a response data packet according to the description in step S1. The response data packet will be forwarded by the Web security protection product and sent to the attacking end. When forwarding, the Web security protection product may modify the data packet content before sending it to the attacking end, or may return a constructed data packet to the virtual service. The content of the constructed data packet is not limited to actively disconnecting the network connection, etc.

[0023] S28: The virtual service times out on the connection where the attack was initiated in step S24, and waits for the response data packet to be received. At the same time, it is determined whether there is a certain difference between the content in the attack configuration sent by the control end to the attack end in step S23. The difference refers to the http payload content, the http header content, etc., or any combination of the above content. If the waiting for reception times out or there is a certain difference, the attack ends and the result is returned to the control end. The reception times out. The timeout period can be set according to the actual production environment.

[0024] S29: Determine whether to continue the attack. If yes, return to sub-step 4. If no, end the attack and return the result to the control end.

[0025] S210: The control end combines the results returned by the attacking end and the attacked end with the defense information of the Web security protection product to draw a conclusion on the effectiveness of the product function.

[0026] Preferably, the S1: deployment phase: installing the virtual service and the attack end on both sides of the Web security protection product, and then deploying the virtual service on the Web security protection product side in the step of configuring the address and port of the virtual service on the Web security protection product side means placing the virtual service program or device in the protected area of ​​the Web security protection product, and deploying the attack end on the Web security protection product side means deploying the attack end program or device on the side of the protection traffic entrance of the Web security protection product, and the deployment location can be an intranet that can access the virtual service, or it can be a cloud.

[0027] Preferably, in the step S21: the attack end sends the attack configuration to the virtual service, the attack configuration includes an attack packet and a response packet sequence, and the attack packet and the response packet sequence are in one of the formats of pcap, http content description, and base64 binary.

[0028] Preferably, in S22: after the virtual service receives the attack configuration, the step of opening the corresponding service on a specific port may be one of http and https, and the configuration of the port is one of the attack configuration and the configuration at the time of deployment; there are several ports.

[0029] Preferably, the attack in the step S24: in which the attack end launches an attack on the virtual service is a simulated attack, and the content of the attack data packet is generated based on the attack end configuration sent by the control end in step S23. The attack configuration content includes the attack port, the attack data packet processed with base64, and the source port. The content of the data packet is generated based on the attack end configuration sent by the control end in step S23. The attack will be forwarded by the Web security protection product and finally sent to the virtual service. When forwarding, the Web security protection product can modify the content of the data packet and then send it to the virtual service, or construct a data packet to return to the attack end. The content of the constructed data packet returned to the attack end includes actively disconnecting the network connection, etc. The attack launched can be a single connection or multiple connections. If there are multiple connections, the attacks can be carried out in sequence in the order of the connections, or they can be executed in parallel.

[0030] Preferably, the S25: virtual service waits for the data packet to be received on the listening port, and at the same time determines whether there is a certain difference with the content in the attack configuration sent by the control end to the virtual service in step three. The step of waiting for the data packet to be received refers to receiving an attack data packet that is consistent with the description content of the attack configuration sent by the attack end to the virtual service in step S1, that is, whether there is a certain difference in the content of the attack packet. The description content consistency can refer to http payload content, http partial header content, etc., or it can be any combination of S1 to S2 and S21 to S210. If the reception times out or there is a certain difference, the attack ends, the virtual service is closed, and the result is returned to the control end. When the reception times out, the timeout period can be set according to the actual production environment.

[0031] Preferably, the S29: determines whether to continue the attack, if so, continues to return to sub-step four, if not, ends the attack, and returns the result to the control end. The step of determining whether to continue the attack refers to determining the configuration in step S23 in which the control end sends the attack configuration to the attack end, and in the configuration description, whether there is a new attack data packet after this attack response packet.

[0032] Preferably, in the step of S210: the control end combining the result returned by the attacking end and the attacked end and the defense information of the Web security protection product to draw a conclusion on the effectiveness of the product function, the defense information of the Web security protection product is optional and is used to assist in judgment and enrich the conclusion content. The result returned by the attacking end and the attacked end refers to the content related to the success or failure of the attack, and the difference between the actual data packet and the predefined one; if one side fails in the attack, it means that the Web security protection product has intercepted the attack. If there is the defense information of the Web security protection product, the conclusion must be interception. The defense information of the Web security protection product can be screened according to the attack time interval, the attack target service, etc., or it can be any combination of the above.

[0033] A function verification device for a WEB security protection product based on a virtual service, comprising a control end, an attack end, a virtual service and a WEB security protection product;

[0034] The control end: The control end communicates with the virtual service through communication mode 1, and is used for functions such as sending attack information instructions and receiving attack result information; the control end communicates with the attack end through communication mode 2, and is used for functions such as sending attack information instructions and receiving attack result information. The control end receives or pulls the alarm or interception information of the Web security protection product through the connection port 7;

[0035] The virtual service: The virtual service communicates with the control end through communication mode 1, and has functions such as obtaining attack information instructions and returning attack results; the virtual service receives data packets forwarded by the Web security protection product through communication mode 4; the virtual service returns attack response data packets to the Web security protection product through communication mode 5.

[0036] The Web security protection product: The Web security protection product receives a data packet from the attacking end through communication mode 3; forwards the data packet obtained from the attacking end through communication mode 3 to the virtual service through communication mode 4; receives a response packet from the virtual service through communication mode 5; forwards the data packet obtained from the virtual service through communication mode 5 to the attacking end through communication mode 6. The Web security protection product can modify the content of the data packet when forwarding the data packet;

[0037] The attack end: The attack end communicates with the control end through communication mode 2, and has functions such as obtaining attack information instructions and returning attack results. The attack end sends attack data packets to the Web security protection product through communication mode 3, and its target is the virtual service. It receives response data packets forwarded by the Web security protection product from the virtual service through communication mode 6.

[0038] The present invention provides a method and device for verifying the function of a WEB security protection product based on a virtual service, which has the following beneficial effects:

[0039] 1. The method and device for verifying the function of a WEB security protection product based on a virtual service will not cause a load on the web of the production environment, nor will it affect the performance of the web service in the production environment, because the attack traffic actually reaches the virtual service. Since the attacked end is a virtual service, when the Web security protection product does not intercept the attack traffic, it will not cause abnormalities in the web service in the production environment or damage the server where the web service in the production environment is located.

[0040] 2. In the method and device for verifying the function of a WEB security protection product based on a virtual service, the virtual services at the attacking end and the attacked end already know all the data packets in the entire attack process before the attack, so it can accurately determine whether the Web security protection product has intercepted it. Because the response data packet of the virtual service is the predefined attacked response traffic, the response packet is consistent with the actual vulnerable web service and will not affect the verification result. Virtual services are deployed in the production environment, and the virtual services do not contain any Web vulnerabilities, and will not introduce new unsafe factors to the network environment, so they will not be exploited by attackers. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 Provide functional verification diagrams for Web security protection products in actual production environments using existing technologies;

[0042] Figure 2 Provide functional verification diagrams for Web security protection products in non-production environments using existing technologies;

[0043] Figure 3 Validation flow chart for the present invention;

[0044] Figure 4 This is a diagram of the verification steps of the present invention. DETAILED DESCRIPTION

[0045] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0046] Embodiment 1

[0047] See also Figures 1 to 4 ,The present invention provides a technical solution: a WEB security protection product function verification device based on virtual service, including a control end, an attack end, a virtual service and a WEB security protection product;

[0048] Control end: The control end communicates with the virtual service through communication mode 1, and is used to send attack information instructions, receive attack result information, and other functions; the control end communicates with the attack end through communication mode 2, and is used to send attack information instructions, receive attack result information, and other functions. The control end receives or pulls the alarm or interception information of the Web security protection product through connection port 7;

[0049] Virtual service: The virtual service communicates with the control end through communication mode 1, and has the functions of obtaining attack information instructions and returning attack results; the virtual service receives data packets forwarded by the Web security protection product through communication mode 4; the virtual service returns attack response data packets to the Web security protection product through communication mode 5.

[0050] Web security protection products: Web security protection products receive data packets from the attacker through communication mode 3; forward data packets obtained from the attacker through communication mode 3 to the virtual service through communication mode 4; receive response packets from the virtual service through communication mode 5; forward data packets obtained from the virtual service through communication mode 5 to the attacker through communication mode 6. Web security protection products can modify the content of data packets when forwarding them.

[0051] Attacker: The attacker communicates with the controller through communication mode 2, and has functions such as obtaining attack information instructions and returning attack results. The attacker sends attack data packets to the Web security protection product through communication mode 3, and its target is the virtual service. The attacker receives response data packets forwarded from the virtual service by the Web security protection product through communication mode 6.

[0052] A method for verifying the function of a web security protection product based on a virtual service comprises the following steps:

[0053] S1: Deployment phase: Install the virtual service and the attack end on both sides of the Web security protection product, and then configure the address and port of the virtual service on the Web security protection product. Deploying the virtual service on one side of the Web security protection product means placing the virtual service program or device in the protected area of ​​the Web security protection product; deploying the attack end on one side of the Web security protection product means deploying the attack end program or device on the side of the protected traffic entrance of the Web security protection product. The deployment location can be an intranet that can access the virtual service, or a cloud, etc. Configuring the address and port of the virtual service on the Web security protection product is mainly to forward the data packets accessing the virtual service to the address and port where the virtual service is located. The port can be any port.

[0054] S2: Verification phase: Initiate a verification simulation attack and draw conclusions about the functions of the Web security protection product based on the attack results. The following sub-step features are included:

[0055] S21: The attacking end sends the attack configuration to the virtual service;

[0056] The attack configuration may include attack packets, response packet sequences, or other content. The attack packets and response packet sequences may be in pcap format, http content description, or base64 binary format.

[0057] S22: After receiving the attack configuration, the virtual service starts the corresponding service on the specific port;

[0058] The service can be http, https, etc. The port can come from the attack configuration or the configuration during deployment, etc. The port can be one or more;

[0059] S23: The control end sends the attack configuration to the attack end;

[0060] S24: The attacker launches an attack on the virtual service;

[0061] The attack is a simulated attack, that is, the content of the attack data packet is generated based on the attack end configuration sent by the control end in step S23, wherein the attack configuration content may include the attack port, the attack data packet processed by base64, the source port, etc., but is not limited thereto. The method for generating the content of the data packet based on the attack end configuration sent by the control end in step S23 is not limited, and the purpose is to generate a data packet with attack features or attack context. The attack will be forwarded by the Web security protection product and finally sent to the virtual service.

[0062] When forwarding, the Web security protection product can modify the data packet content before sending it to the virtual service. At the same time, it can also construct a data packet and return it to the attacker. The content of the constructed data packet returned to the attacker is not limited to actively disconnecting the network connection. The attack can be a single connection or multiple connections. If there are multiple connections, the attack can be carried out in sequence according to the connection order or in parallel.

[0063] S25: The virtual service waits for the data packet to be received on the listening port, and determines whether there is a certain difference between the content in the attack configuration sent by the control end to the virtual service in step 3;

[0064] Among them, waiting for the data packet to be received refers to receiving the attack data packet that matches the content described in step S1. The description content that matches can refer to the http payload content, the http part header content, etc., or any combination of the above content. If the reception timeouts or there is a certain difference, the attack ends, the virtual service is closed, and the result is returned to the control end. The reception timeout, the timeout period can be set according to the actual production environment;

[0065] S26: The virtual service determines whether to continue the attack. If yes, it proceeds to S27. If no, it ends the attack and returns the result to the control end.

[0066] Wherein, judging whether to continue the attack means judging whether there is a new attack data packet after the attack response packet in the configuration description in which the control end sends the attack configuration to the configuration in the virtual service in step S2;

[0067] S27: The virtual service returns a response data packet according to the content described in S1. The response data packet will be forwarded by the Web security protection product and sent to the attacking end.

[0068] When forwarding, the Web security protection product can modify the data packet content before sending it to the attacking end, or construct a data packet and return it to the virtual service. The content of the constructed data packet returned to the virtual service is not limited to actively disconnecting the network connection, etc.;

[0069] S28: The virtual service times out waiting for the response data packet to be received on the connection launched by S24, and determines whether there is a certain difference between the content in the attack configuration sent by the control end to the attack end at S23;

[0070] The certain difference may refer to the HTTP payload content, the HTTP header content, etc., or any combination of the above contents. If the waiting for receiving times out or there is a certain difference, the attack ends and the result is returned to the control end. The receiving timeout can be set according to the actual production environment.

[0071] S29: Determine whether to continue the attack. If yes, return to S24. If no, end the attack and return the result to the control end.

[0072] The determining whether to continue the attack refers to determining S23 whether the control end sends the attack configuration to the attack end, and whether there is a new attack data packet after the attack response packet in the configuration description.

[0073] S210: The control end combines the results returned by the attacking end and the attacked end with the defense information of the Web security protection product to draw a conclusion on the effectiveness of the product function;

[0074] Among them, the defense information of the Web security protection product is optional and is used to assist in judgment and enrich the conclusion content. The results returned by the attacking end and the attacked end refer to the success or failure of the attack, the difference between the actual data packet and the predefined one, etc., but are not limited to the above content;

[0075] Among them, if one side of the attack fails, it means that the Web security protection product has intercepted the attack. If the defense information of the Web security protection product, the conclusion must be interception. The defense information of the Web security protection product can be filtered according to the attack time interval, attack target service, etc., or it can be any combination of the above.

[0076] Embodiment 2

[0077] The differences between this embodiment and the first embodiment are as follows:

[0078] 1. Split the functions of the control end. For example, the function of querying the alarm and interception information of Web security protection products can be used as a separate component to query or receive the alarm and interception information of Web security protection products;

[0079] 2. A virtual service can be one or more;

[0080] 3. The service protocol provided by the virtual service can be http1.1, http2, http3, https, websocket, etc. The service port provided by the virtual service can be specified arbitrarily without restriction;

[0081] 4. There can be one or more proxy implementations between the attack end and the Web security protection product; there can also be one or more proxy implementations between the Web security protection product and the virtual service;

[0082] 5. The communication protocols used in the communication methods 1, 2, 3, 4, 5 and 6 between the control end, virtual service and attack end are not limited, and the content format is not limited. As long as similar functions are completed, alternative solutions can be implemented. The communication protocol can be implemented by RESTfull API / WEBSocket / grpc, etc.;

[0083] 6. The operating systems used by the control end, virtual service, and attack end are not limited, and can be Linux, Windows, Mac, etc.;

[0084] 7. The control end can directly obtain the results of the virtual service and the results of the attack end to draw a conclusion on the verification results, that is, it can draw a conclusion on the verification results without the assistance of Web security protection products to alarm and intercept information;

[0085] 8. Figure 3 The connection port 7 in the example can be an API provided by a Web security product, such as RESTful API, GRPC, etc., or a message push component, such as Kafka, Syslog, SNMP, etc.;

[0086] 9. The carriers of all component control ends, virtual services, and attack ends can be CPUs of any architecture, such as X86, mips, powerpc, arm, etc.;

[0087] 10. Web security protection products can be WAF, next-generation firewalls with reverse proxy functions, SASE products, etc.

[0088] 11. All component control ends, virtual services, and attack ends can be implemented in any programming language;

[0089] 12. The communication direction of the control end, virtual service, attack end, and Web security protection products is not restricted, that is, Figure 3 In the diagram, the directions of arrows 1, 2, and 7 can be reversed and combined at will, for example, a virtual service can actively query the control instructions of the control end;

[0090] 13. The communication steps between the control end and the virtual service, and between the control end and the attack end, can be carried out in a multiple communication manner to ensure the reliability of the communication and the results. As long as the communication purpose is the same as that in the first embodiment, it is an alternative solution.

[0091] 14. The controlled end sends attack information instructions to the virtual service and the attacking end, including but not limited to the data packets sent by the attacking end, the data packets responded by the attacked end, the domain name or address of the virtual service, etc.;

[0092] 15. After receiving the attack information instruction, the virtual service and the attack end can modify the content of the attack information instruction according to the actual environment. The modification refers to the modification of the data packet header and data packet payload, etc. The modification content can also be performed when the controlled end sends the attack information.

[0093] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for verifying the function of a WEB security protection product based on a virtual service, characterized in that: The following steps are involved: S1: Deployment phase: Install the virtual service and the attack end on both sides of the Web security protection product, and then configure the address and port of the virtual service on the Web security protection product; S2: Verification phase: Initiate a verification simulation attack and draw conclusions about the functions of the Web security protection product based on the attack results; S21: The attack end sends an attack configuration to the virtual service; the attack configuration includes an attack packet, a response packet sequence and other contents, and the attack packet and response packet sequence are in the form of pcap, http content description and base64 binary; S22: After receiving the attack configuration, the virtual service starts the corresponding service on the specific port; S23: The control end sends the attack configuration to the attack end; S24: The attacker launches an attack on the virtual service; S25: The virtual service waits for the data packet to be received on the listening port, and determines whether there is a certain difference between the content in the attack configuration sent by the control end to the virtual service in step 3; S26: The virtual service determines whether to continue the attack. If yes, it proceeds to sub-step 7. If no, it ends the attack and returns the result to the control end. S27: The virtual service returns a response data packet according to the description in step S1. The response data packet will be forwarded by the Web security protection product and sent to the attacking end. S28: The virtual service times out on the connection initiating the attack in step S24, and waits for the response data packet to be received, while determining whether there is a certain difference with the content in the attack configuration sent by the control end to the attack end in step S23; S29: Determine whether to continue the attack. If yes, return to sub-step 4. If no, end the attack and return the result to the control end. S210: The control end combines the results returned by the attacking end and the attacked end with the defense information of the Web security protection product to draw a conclusion on the effectiveness of the product function.

2. According to claim 1, a method for verifying the function of a WEB security protection product based on a virtual service is characterized in that: The S1: deployment phase: installing the virtual service and the attack end on both sides of the Web security protection product, and then in the step of configuring the address and port of the virtual service on the Web security protection product side, deploying the virtual service on the Web security protection product side means placing the virtual service program or device in the protected area of ​​the Web security protection product, and deploying the attack end on the Web security protection product side means deploying the attack end program or device on the side of the protection traffic entrance of the Web security protection product.

3. According to a method for verifying the function of a WEB security protection product based on virtual services as described in claim 1, it is characterized in that: S22: After the virtual service receives the attack configuration, the step of opening the corresponding service on a specific port is one of http and https, and the configuration of the port is one of the attack configuration and the configuration during deployment; there are multiple ports.

4. According to a method for verifying the function of a WEB security protection product based on a virtual service according to claim 1, it is characterized in that: The step S29: determines whether to continue the attack. If so, it continues to return to sub-step four. If not, it ends the attack. The step of returning the result to the control end determines whether to continue the attack. It refers to determining the configuration in step S23 in which the control end sends the attack configuration to the attack end. In the configuration description, whether there is a new attack data packet after this attack response packet.

5. According to a method for verifying the function of a WEB security protection product based on virtual services as described in claim 1, it is characterized in that: In the step S210, in which the control end combines the result returned by the attacking end and the attacked end and the defense information of the Web security protection product to draw a conclusion on the effectiveness of the product function, the defense information of the Web security protection product is optional and is used to assist in judgment and enrich the conclusion content. The result returned by the attacking end and the attacked end refers to the content related to the success or failure of the attack and the difference between the actual data packet and the predefined one.

6. A function verification device for a WEB security protection product based on a virtual service, characterized in that: Including control end, attack end, virtual service and WEB security protection products; The control end: The control end communicates with the virtual service through communication mode 1, and is used to send attack information instructions and receive attack result information related functions; the control end communicates with the attack end through communication mode 2, and is used to send attack information instructions and receive attack result information related functions. The control end receives or pulls the alarm or interception information of the Web security protection product through the connection port 7; The virtual service: The virtual service communicates with the control end through communication mode 1, and has the functions of obtaining attack information instructions and returning attack results; the virtual service receives the data packet forwarded by the Web security protection product through communication mode 4; the virtual service returns the attack response data packet to the Web security protection product through communication mode 5; The Web security protection product: The Web security protection product receives a data packet from the attacking end through communication mode 3; forwards the data packet obtained from the attacking end through communication mode 3 to the virtual service through communication mode 4; receives a response packet from the virtual service through communication mode 5; forwards the data packet obtained from the virtual service through communication mode 5 to the attacking end through communication mode 6. The Web security protection product can modify the content of the data packet when forwarding the data packet; The attack end: The attack end communicates with the control end through communication mode 2, and has the functions of obtaining attack information instructions and returning attack results. The attack end sends attack data packets to the Web security protection product through communication mode 3, and its target is the virtual service. The Web security protection product forwards the response data packet from the virtual service through communication mode 6.

Images