A host security evaluation method and system

Abstract

The present application provides a host security evaluation method and system, the evaluation method is applied to a host security evaluation system including an evaluation end and a host end: the evaluation end generates a security evaluation task for the host end based on the evaluation parameters corresponding to the host end obtained by the attack agent module through device scanning and data collection analysis on the host end, and sends an attack instruction to the host end; the target agent module in the host end responds to and executes the attack instruction, generates attack result data corresponding to the attack instruction, and sends it to the evaluated end; the evaluation end generates the security evaluation result of the host end under the security evaluation task by cumulative calculation and weighted summation based on the attack result data, using a preset use case score calculation formula and evaluation score weight. Through the above method, the host's protection capability is comprehensively and directly evaluated, and the effectiveness and reliability of the host protection, as well as the security of the host, are improved.

Description

Technical Field

[0001] The present application relates to the field of host system security technology, and in particular to a host security evaluation method and system. Background Art

[0002] With the development of information technology, the security threats to hosts are also constantly evolving, and the attackers' methods are becoming increasingly complex and covert. Although the hosts have deployed security protection measures such as antivirus software, terminal detection and response (EDR), host intrusion detection system (HIDS), and data loss prevention (DLP), there are still problems such as increasing vulnerabilities, which makes the attack surface continue to expand and the attack methods become complex and changeable. These attacks often combine multiple network information technologies and are difficult to be identified by a single defense measure.

[0003] At present, the verification and evaluation of the host's defense capabilities mainly involves the verification and evaluation of known attack patterns and security incidents that have occurred, which relies on historical data and known security threats to evaluate the security of the host. In addition, with the frequent emergence of new attack technologies and attack vulnerabilities, the historical security data relied on cannot cover all possible attack threats, and attackers may continue to learn and adapt to defense measures, which greatly reduces the effectiveness and reliability of host protection, thereby reducing the security of the host. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a host security assessment method and system, in which an attack agent module and a target agent module that can realize generalized attack simulation are respectively set in the assessment end and the host end in the host security assessment system, and the assessment end obtains the assessment parameters of the host end and the security assessment tasks generated by the assessment scenario, actively initiates a simulated attack to the host end, and generates a security assessment result of the host end based on the attack result data generated after the host end makes security protection, combined with a preset security assessment mechanism, to comprehensively and directly evaluate the real-time protection capability of the host, greatly improves the effectiveness and reliability of the host protection, and thereby enhances the security of the host.

[0005] The embodiment of the present application provides a host security evaluation method, which is applied to a host security evaluation system; the host security evaluation system includes an evaluation end and a host end, and the evaluation method includes:

[0006] The evaluation end performs device scanning and data collection and analysis on the host end through an attack proxy module arranged in the evaluation end, obtains evaluation parameters corresponding to the host end, and generates a security evaluation task for performing security evaluation on the host end through simulated attacks according to the evaluation parameters and the evaluation strategy corresponding to the host end indicated by the user; wherein the evaluation parameters include business program vulnerabilities and evaluation scenarios corresponding to the host end;

[0007] The assessment end calls the attack proxy module to send an attack instruction corresponding to the security assessment task to the host end;

[0008] The host terminal calls a target proxy module arranged in the host terminal to respond to and execute the received attack instruction;

[0009] The host end calls a security protection module set in the host end, performs security protection on the attack instruction, generates attack result data corresponding to the attack instruction, and sends the attack result data to the evaluation end; wherein the attack result data includes score results of each attack case in multiple attack cases corresponding to the attack instruction under multiple evaluation dimensions;

[0010] The attack result data is received by the evaluation end, and based on the score results of each attack use case included in the attack result data under multiple evaluation dimensions, a preset use case score calculation formula and evaluation score weight are used to generate a security assessment result of the host end under the security assessment task by accumulating and weighted summing the score results.

[0011] Furthermore, the evaluation end performs device scanning and data collection and analysis on the host end through an attack proxy module disposed in the evaluation end to obtain evaluation parameters corresponding to the host end, including:

[0012] The evaluation end performs device scanning and security data collection on the host end through an attack proxy module arranged in the evaluation end, and obtains operating system data and component version data corresponding to the host end;

[0013] Matching the operating system data and component version data with a vulnerability library set in the attack proxy module to determine the business program vulnerability corresponding to the host end included in the evaluation parameters;

[0014] According to the security data included in the business program vulnerability, the evaluation scenario corresponding to the host end included in the evaluation parameters is determined by analyzing the business scenario corresponding to the security data.

[0015] Further, the host side calls the target proxy module set in the host side to respond to and execute the received attack instruction, including:

[0016] The host terminal calls a target proxy module arranged in the host terminal, responds to the received attack instruction, and simulates downloading the file virus indicated by the attack instruction;

[0017] Controlling the target proxy module to access the malicious site corresponding to the file virus to connect to the control server corresponding to the file virus;

[0018] The target proxy module is controlled to execute the attack behavior indicated by the file virus through the control server under the malicious site.

[0019] Further, the attack result data is received by the evaluation end, and according to the score results of each attack case in multiple evaluation dimensions included in the attack result data, a preset case score calculation formula and evaluation score weight are used to generate the security evaluation result of the host end under the security evaluation task by accumulating and weighted summing the score results, including:

[0020] For the multiple attack use cases in the attack instruction, the evaluation end receives the attack result data, and determines the score result of each attack use case according to the score results of each attack use case under multiple evaluation dimensions included in the attack result data, through a preset use case score calculation formula;

[0021] Accumulating the score results of each attack case to determine the score result of the attack instruction;

[0022] According to the score result of the attack instruction, combined with the preset evaluation score weight corresponding to the attack instruction, a security evaluation result of the host terminal under the security evaluation task is generated by weighted summation.

[0023] The embodiment of the present application further provides a host security evaluation system, the host security evaluation system comprising an evaluation end and a host end; wherein the evaluation end comprises:

[0024] The attack proxy module is used to perform device scanning and data collection and analysis on the host end, obtain the evaluation parameters corresponding to the host end, and generate a security assessment task for performing security assessment on the host end through simulated attack according to the evaluation parameters and the evaluation strategy corresponding to the host end indicated by the user; and issue an attack instruction corresponding to the security assessment task to the host end; wherein the evaluation parameters include the business program vulnerabilities and evaluation scenarios corresponding to the host end;

[0025] A security assessment module, configured to receive attack result data generated by the host executing the attack instruction, and generate a security assessment result of the host under the security assessment task by accumulating and weighted summing the score results of each attack case under multiple assessment dimensions included in the attack result data, using a preset case score calculation formula and assessment score weights;

[0026] The host side includes:

[0027] The target agent module is used to respond to and execute the attack instructions corresponding to the security assessment tasks issued by the assessment end;

[0028] A security protection module is used to perform security protection on the attack instruction, generate attack result data corresponding to the attack instruction, and send the attack result data to the evaluation end; wherein the attack result data includes the score results of each attack case in multiple attack use cases corresponding to the attack instruction under multiple evaluation dimensions.

[0029] Furthermore, when the attack proxy module is used to perform device scanning and data collection and analysis on the host end to obtain the evaluation parameters corresponding to the host end, the attack proxy module is used to:

[0030] Performing device scanning and security data collection on the host end to obtain operating system data and component version data corresponding to the host end;

[0031] Matching the operating system data and component version data with a vulnerability library set in the attack proxy module to determine the business program vulnerability corresponding to the host end included in the evaluation parameters;

[0032] According to the security data included in the business program vulnerability, the evaluation scenario corresponding to the host end included in the evaluation parameters is determined by analyzing the business scenario corresponding to the security data.

[0033] Furthermore, when the target proxy module is used to respond to and execute the received attack instruction, the target proxy module is used to:

[0034] Responding to the received attack instruction and simulating downloading the file virus indicated by the attack instruction;

[0035] Accessing a malicious site corresponding to the file virus to connect to a control server corresponding to the file virus;

[0036] At the malicious site, the attack behavior indicated by the file virus is executed through the control server.

[0037] Further, the security assessment module is used to receive the attack result data generated by the host end executing the attack instruction, and according to the score results of each attack case under multiple evaluation dimensions included in the attack result data, using a preset case score calculation formula and evaluation score weight, to generate the security assessment result of the host end under the security assessment task by cumulative calculation and weighted summation, the security assessment module is used to:

[0038] For the multiple attack use cases in the attack instruction, the attack result data is received, and according to the score results of each attack use case under multiple evaluation dimensions included in the attack result data, the score result of each attack use case is determined by a preset use case score calculation formula;

[0039] Accumulating the score results of each attack case to determine the score result of the attack instruction;

[0040] According to the score result of the attack instruction, combined with the preset evaluation score weight corresponding to the attack instruction, a security evaluation result of the host terminal under the security evaluation task is generated by weighted summation.

[0041] The host security evaluation method and system provided in the embodiment of the present application are applied to the host security evaluation system; the host security evaluation system includes an evaluation terminal and a host terminal, and the evaluation method includes: the evaluation terminal performs device scanning and data collection and analysis on the host terminal through an attack proxy module set in the evaluation terminal, obtains the evaluation parameters corresponding to the host terminal, and generates a security evaluation task for performing security evaluation on the host terminal through simulated attack according to the evaluation parameters and the evaluation strategy corresponding to the host terminal indicated by the user; wherein the evaluation parameters include the business program vulnerabilities and evaluation scenarios corresponding to the host terminal; the evaluation terminal calls the attack proxy module to issue the attack instruction corresponding to the security evaluation task to the host terminal; the host terminal calls the attack proxy module set in The target proxy module in the host end responds to and executes the received attack instruction; the host end calls the security protection module set in the host end, performs security protection on the attack instruction, generates attack result data corresponding to the attack instruction, and sends the attack result data to the evaluation end; wherein the attack result data includes the score results of each attack case in multiple attack use cases corresponding to the attack instruction under multiple evaluation dimensions; the evaluation end receives the attack result data, and based on the score results of each attack case in multiple evaluation dimensions included in the attack result data, uses a preset use case score calculation formula and evaluation score weights, and generates a security assessment result of the host end under the security assessment task by accumulating and weighted summing the score results.

[0042] Compared with the prior art method of verifying and evaluating known attack patterns and security incidents that have occurred, which relies on historical data and known security threats to evaluate the security of the host, in the host security evaluation system, an attack agent module and a target agent module that can realize generalized attack simulation are respectively set in the evaluation end and the host end. The evaluation end obtains the evaluation parameters of the host end and the security evaluation tasks generated by the evaluation scenario, actively launches a simulated attack to the host end, and generates a security evaluation result of the host end based on the attack result data generated after the host end makes security protection, combined with a preset security evaluation mechanism, to comprehensively and directly evaluate the real-time protection capability of the host, greatly improves the effectiveness and reliability of the host protection, and thus enhances the security of the host.

[0043] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A flowchart of a host security evaluation method provided in an embodiment of the present application;

[0046] Figure 2 One of the structural schematic diagrams of a host security evaluation system provided in an embodiment of the present application;

[0047] Figure 3 A second structural diagram of a host security evaluation system provided in an embodiment of the present application;

[0048] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0050] Research has found that, at present, the verification and evaluation of the host's defense capabilities mainly involves the verification and evaluation of known attack patterns and security incidents that have occurred, which relies on historical data and known security threats to evaluate the security of the host. In addition, with the frequent emergence of new attack technologies and attack vulnerabilities, the historical security data relied on cannot cover all possible attack threats, and attackers may continue to learn and adapt to defense measures, which greatly reduces the effectiveness and reliability of host protection, thereby reducing the security of the host.

[0051] Based on this, an embodiment of the present application provides a host security assessment method. In the assessment end and the host end in the host security assessment system, an attack proxy module and a target proxy module that can realize generalized attack simulation are respectively set. The assessment end obtains the assessment parameters of the host end and the security assessment tasks generated by the assessment scenario, actively initiates a simulated attack to the host end, and generates a security assessment result of the host end based on the attack result data generated after the host end makes security protection, combined with a preset security assessment mechanism, to comprehensively and directly evaluate the real-time protection capability of the host, greatly improves the effectiveness and reliability of the host protection, and thereby enhances the security of the host.

[0052] See also Figure 1 , Figure 1 A flowchart of a host security evaluation method provided in an embodiment of the present application. Figure 1 As shown in , the host security evaluation method provided in the embodiment of the present application is applied to a host security evaluation system; the host security evaluation system includes an evaluation end and a host end, including:

[0053] S101, the evaluation end performs device scanning and data collection and analysis on the host end through the attack proxy module set in the evaluation end, obtains the evaluation parameters corresponding to the host end, and generates a security assessment task for performing security assessment on the host end through simulated attacks based on the evaluation parameters and the evaluation strategy corresponding to the host end indicated by the user.

[0054] It should be noted that the host security assessment system includes an assessment end and a host end; wherein, a data communication connection has been established between the assessment end and the host end; the assessment end is a security verification server end, which manages and analyzes the host security assessment process, and is used to conduct a security assessment on the host end by simulating attacks on the host end and based on the data generated by the security protection made by the host end; the host end may include multiple hosts, and for the assessed host among the multiple hosts, the operating system, middleware, application programs, services and data included in the host end are assessed through simulated attacks by the assessment end.

[0055] Here, the attack proxy module set in the evaluation end includes but is not limited to an information collection engine and a vulnerability attack engine. The attack proxy module relies on a generalized attack simulation engine to send a simulated attack to the host end.

[0056] In this step, during the specific implementation, first, the evaluation end obtains the evaluation parameters corresponding to the host end through the information collection engine in the attack proxy module set in the evaluation end; then, it determines the evaluation strategy corresponding to the host end indicated by the user according to the host type of the host end; finally, based on the evaluation parameters and in combination with the evaluation strategy, a security assessment task is generated for performing a security assessment on the host end through a simulated attack.

[0057] The evaluation parameters include business program vulnerabilities corresponding to the host side and evaluation scenarios.

[0058] In one possible implementation of the present application, the user can determine the evaluation strategy corresponding to the host side according to the host type corresponding to the host side and the user's evaluation requirements; and determine the specific parameters included in the evaluation parameters according to the evaluation strategy.

[0059] Among them, business program vulnerabilities include common business vulnerabilities and self-developed program vulnerabilities; common business vulnerabilities are common vulnerabilities in the host's business programs; self-developed program vulnerabilities are vulnerabilities corresponding to non-common components (self-developed programs) in the business programs.

[0060] In one possible implementation of the present application, common business vulnerabilities include but are not limited to operating system vulnerabilities, middleware vulnerabilities, application framework vulnerabilities, library and dependency vulnerabilities, and client software vulnerabilities; self-developed program vulnerabilities include but are not limited to file vulnerabilities, SQL vulnerabilities, XSS vulnerabilities, command vulnerabilities, code vulnerabilities, and session vulnerabilities.

[0061] Exemplarily, the assessment end obtains the operating system data and component version data corresponding to the host end through the information collection engine in the attack proxy module. The user determines the assessment strategy as a high-intensity DDOS attack strategy based on the host type of the host end being version 3.15, and generates a security assessment task to conduct a high-intensity DDOS attack against the vulnerabilities of the 3.15 version host.

[0062] In one embodiment of the present application, in a specific implementation, the step of obtaining the evaluation parameters corresponding to the host end by the evaluation end through the attack proxy module set in the evaluation end in step S101 may include:

[0063] S1011. The evaluation end performs device scanning and security data collection on the host end through an attack proxy module arranged in the evaluation end, and obtains operating system data and component version data corresponding to the host end.

[0064] In this step, the information collection engine included in the attack proxy module performs device scans on the host side for the host device and the host port, and collects security data including the host domain and the host password to obtain the operating system data and component version data corresponding to the host side.

[0065] S1012: Match the operating system data and component version data with a vulnerability library set in the attack proxy module to determine the business program vulnerability corresponding to the host end included in the evaluation parameters.

[0066] In one possible implementation of the present application, business program vulnerabilities include common business vulnerabilities and self-developed program vulnerabilities. In addition, business program vulnerabilities also include security data; among them, common business vulnerabilities include but are not limited to operating system vulnerabilities, middleware vulnerabilities, application framework vulnerabilities, library and dependency vulnerabilities, and client software vulnerabilities; self-developed program vulnerabilities include but are not limited to file vulnerabilities, SQL vulnerabilities, XSS vulnerabilities, command vulnerabilities, code vulnerabilities, and session vulnerabilities; security data includes but is not limited to passwords, certificates, domain names, subdomain names, and DNS corresponding to the host side.

[0067] In this step, the acquired operating system data and component version data are matched with the vulnerability library set in the attack proxy module to determine the common business vulnerabilities and self-developed program vulnerabilities included in the evaluation parameters; then, the common business vulnerabilities and self-developed program vulnerabilities are comprehensively refined to determine the passwords, certificates, domain names, subdomain names and DNS corresponding to the host side included in the security data; finally, the determined security data, common business vulnerabilities and self-developed program vulnerabilities are determined as the business program vulnerabilities corresponding to the host side.

[0068] S1013. According to the security data included in the business program vulnerability, by analyzing the business scenario corresponding to the security data, determine the evaluation scenario corresponding to the host end included in the evaluation parameters.

[0069] In this step, based on the password, certificate, domain name, subdomain name and DNS corresponding to the host side in the security data included in the business program vulnerability, the business scenario corresponding to the security data is analyzed to determine the evaluation scenario corresponding to the host side included in the evaluation parameters.

[0070] Exemplarily, the evaluation scenario corresponding to the host side may include a network environment, a usage environment, and a business program setting combination, etc.

[0071] S102: The assessment end calls the attack proxy module to send an attack instruction corresponding to the security assessment task to the host end.

[0072] Here, a generated security assessment task will correspond to at least one attack instruction; wherein each attack instruction indicates a simulated attack type; each attack instruction will correspond to multiple attack use cases, and each attack use case will correspond to multiple assessment dimensions.

[0073] In this step, during the specific implementation, first, according to the attack behavior indicated by the security assessment task, the vulnerability attack engine in the attack proxy module is called; then, according to the preset attack script module set in the assessment end, the attack instruction corresponding to the security assessment task is determined; finally, the attack instruction is issued to the host end through the vulnerability attack engine.

[0074] Here, the attack script management module includes a variety of predefined attack scripts; wherein the attack scripts simulate and define a variety of network attack methods; for example, SQL injection and cross-site scripting attack XSS and other attack methods.

[0075] In one possible implementation of the present application, the vulnerability attack engine includes a general vulnerability attack engine and a self-developed program attack engine; wherein the general vulnerability attack engine targets general business vulnerabilities included in business program vulnerabilities.

[0076] Specifically, general vulnerability attack engines include but are not limited to operating system vulnerability engines, middleware vulnerability engines, application framework vulnerability engines, library and dependency vulnerability engines, and client software vulnerability engines; self-developed program attack engines target self-developed program vulnerabilities including business program vulnerabilities. Specifically, self-developed program attack engines include but are not limited to file upload attack engines, SQL injection engines, XSS cross-site engines, command injection engines, code injection engines, and session hijacking engines.

[0077] Here, the self-developed program attack engine can discover hidden vulnerabilities in the custom code of the host-side business service program that are different from public vulnerabilities during its development process through adaptive attack simulation methods such as command injection and SQL injection.

[0078] For example, for a WEB service program with a self-developed program vulnerability, the self-developed program attack engine simulates an attack on the WEB service by inserting SQL commands, system commands, and attack scripts into the user input location or file upload location of the WEB interface.

[0079] S103: The host terminal calls a target proxy module disposed in the host terminal to respond to and execute the received attack instruction.

[0080] Here, the target proxy module arranged in the host side is used to receive and execute each specific attack instruction in the attack instruction. Meanwhile, the target proxy module is used to monitor the operation status of the host side and generate a security log.

[0081] In this step, during the specific implementation, first, the host side calls the target proxy module set in the host side to respond to the received attack instruction, and controls the target proxy module to simulate the download of the file virus indicated by the attack instruction; then, the target proxy module accesses the malicious site corresponding to the file virus to connect to the control server corresponding to the file virus; finally, the target proxy module executes the attack behavior indicated by the file virus through the control server under the malicious site.

[0082] Exemplarily, first, the target proxy module simulates a user downloading a file through the WEB, downloading a Trojan virus contained in the file; then, it simulates the virus host accessing the IOC domain name to connect to the control server; finally, it executes the malicious behavior of simulating the virus file to modify the registry or startup items.

[0083] In one implementation of the present application, during specific implementation, step S103 may include:

[0084] S1031, the host side calls the target proxy module set in the host side, responds to the received attack instruction, and simulates downloading the file virus indicated by the attack instruction.

[0085] In this step, when the host side calls the target proxy module set in the host side to respond to the attack instruction corresponding to the security assessment task issued by the assessment side, the host side controls the target proxy module to simulate downloading the file virus indicated by the attack instruction.

[0086] Exemplarily, the target proxy module simulates a user downloading a file through the WEB, and downloads a Trojan virus contained in the file.

[0087] S1032: Control the target proxy module to access the malicious site corresponding to the file virus to connect to the control server corresponding to the file virus.

[0088] In this step, according to the malicious site corresponding to the file virus, the target proxy module at the host end accesses the malicious site; after accessing the malicious site, it connects to the control server corresponding to the file virus.

[0089] Exemplarily, the target proxy module simulates a host that downloads a virus file to access the IOC domain name to connect to the control end server of the business program.

[0090] S1033: Control the target proxy module to execute the attack behavior indicated by the file virus through the control server at the malicious site.

[0091] In this step, according to the attack behavior corresponding to the file virus, the target proxy module executes the attack behavior indicated by the file virus through the control server at the visited malicious site.

[0092] Exemplarily, when the attack behavior indicated by the file virus includes a session hijacking attack, the target proxy module uses an ARP address to deceive the controller, and three-way communication disguises to hijack the TCP handshake communication between the client and the server. After the three-way handshake communication, the attacker is simulated to monitor and steal the direct communication data between the client and the server.

[0093] S104: The host end calls a security protection module disposed in the host end to perform security protection on the attack instruction, generate attack result data corresponding to the attack instruction, and send the attack result data to the evaluation end.

[0094] The attack result data includes score results of each attack case in multiple attack cases corresponding to the attack instruction under multiple evaluation dimensions.

[0095] In one possible implementation of the present application, the attack result data includes an attack log generated when the target proxy module executes the attack instruction, and a security log generated when the security protection module in the host side performs security protection for the attack instruction.

[0096] In this step, during the specific implementation, first, the host side calls the security protection module set in the host side to perform security protection for the attack instructions; then, the target proxy module generates an attack log including the attack result data, and at the same time, the security protection module generates a security log including the attack result data; finally, the generated attack log and security log are sent to the evaluation side.

[0097] In this way, the target agent module ensures the timeliness and accuracy of the host security assessment process by real-time integration of threat intelligence of simulated attacks on the host side, thereby providing instant verification and evaluation of the system security performance on the host side, achieving the effect of keeping security testing synchronized with current network security threats and making the evaluation results more reliable and effective.

[0098] S105. The evaluation end receives attack result data corresponding to the attack instruction, and generates a security assessment result of the host end under the security assessment task by accumulating and weighted summing the score results of each attack use case under multiple assessment dimensions included in the attack result data and using a preset use case score calculation formula and assessment score weights.

[0099] In this step, during the specific implementation, first, the evaluation end receives the attack log and security log included in the attack result data corresponding to the attack instruction; then, the attack log and security log are analyzed to determine the score results of multiple attack use cases in the attack instruction under multiple evaluation dimensions; finally, based on the accumulated score results of the attack instruction, combined with the preset evaluation score weights corresponding to the attack instruction, the security assessment result of the host end under the security assessment task is generated by weighted summation.

[0100] Here, the security assessment result is a score value; specifically, the security assessment result provides an objective security performance measurement, which more directly and comprehensively reveals the performance of the host system when facing attacks, thereby helping the host identify and strengthen weak links in security defense measures.

[0101] In one possible implementation of the present application, when each attack use case is evaluated under four evaluation dimensions, the evaluation dimensions include attack success rate, defense detection rate, response time, and degree of damage.

[0102] In one implementation of the present application, during specific implementation, step S105 may include:

[0103] S1051. For multiple attack use cases in the attack instruction, the evaluation end receives the attack result data, and determines the score result of each attack use case according to the score results of each attack use case under multiple evaluation dimensions included in the attack result data, through a preset use case score calculation formula.

[0104] In this step, for each of the multiple attack use cases in each specific attack instruction, the score results of each attack use case in the attack result data under multiple evaluation dimensions are determined; then, based on the score results of each attack use case under multiple evaluation dimensions, the score result of each attack use case is determined by a preset use case score calculation formula.

[0105] In one possible implementation of the present application, when each attack use case is evaluated under four evaluation dimensions, the evaluation dimensions include attack success rate, defense detection rate, response time and degree of damage; among them, the attack success rate is the ratio between the number of times the attacker successfully executes the attack and the number of attempts; the detection rate is the ratio between the number of attacks that the system can detect and the total number of attacks; the response time is the average time from the system detecting the attack to responding; the degree of damage is the degree of damage caused by the attack.

[0106] Specifically, the preset use case score calculation formula is as follows.

[0107] .

[0108] in, For the The score of each attack case; , , , They are The score results of the attack use cases in four evaluation dimensions: attack success rate, detection rate, response time and damage degree; For the The full score of the four evaluation dimensions in the attack use cases.

[0109] Here, the full marks corresponding to the four evaluation dimensions are preset; for example, the full mark for attack success rate may be 1; the full mark for detection rate is 1; when the response time is less than 5 minutes, it is the full mark (100 points), when the response time is greater than or equal to 5 minutes and less than 30 minutes, the score is 50 points, and when the response time is greater than 30 minutes or there is no response, the score is 0 points; the full mark for damage degree is 1 (indicating no damage) and the score is 0 (indicating complete damage).

[0110] S1052: Accumulate the score results of each attack use case to determine the score result of the attack instruction.

[0111] In this step, the score result of each attack case is accumulated through a preset attack case score accumulation formula to determine the score result of each specific attack instruction.

[0112] Specifically, the preset attack case score accumulation formula is as follows.

[0113] .

[0114] in, The score result for each specific attack instruction; For the where N is the score of an attack case and N is the number of attack cases.

[0115] S1053: Generate a security assessment result of the host terminal under the security assessment task by weighted summation according to the score result of the attack instruction and the preset assessment score weight corresponding to the attack instruction.

[0116] In this step, during the specific implementation, first, determine the evaluation score weight corresponding to each specific attack instruction; then, based on the score result of each specific attack instruction, determine the weighted score of the attack instruction through a preset weighted calculation formula; finally, based on the weighted score of the attack instruction, generate the security assessment result of the host side under the security assessment task through a preset weighted summation formula.

[0117] Specifically, the preset weighted calculation formula is as follows.

[0118] .

[0119] in, A weighted score for each specific attack instruction; The score result for each specific attack instruction; It is the evaluation score weight corresponding to the preset attack instruction.

[0120] Here, the evaluation score weights of the attack instructions are determined in advance based on the importance and potential risks of the attack instructions; wherein the sum of the evaluation score weights of all attack instructions should be the full score values ​​corresponding to the pre-set multiple evaluation dimensions.

[0121] Furthermore, the preset weighted summation formula is as follows.

[0122] .

[0123] in, It is the security assessment result of the host under the security assessment task; A weighted score for each specific attack instruction; type It is the specific number in the attack instruction.

[0124] In this way, based on multiple attack use cases under each specific attack instruction corresponding to the simulated attack, the effectiveness of the host-side security protection is comprehensively evaluated from four evaluation dimensions: attack success rate, defense detection rate, response time, and degree of damage, directly and comprehensively revealing the performance of the host system when facing attacks.

[0125] The host security evaluation method provided in the embodiment of the present application is applied to a host security evaluation system, wherein the host security evaluation system includes an evaluation terminal and a host terminal, and the evaluation method includes: the evaluation terminal performs device scanning and data collection and analysis on the host terminal through an attack proxy module set in the evaluation terminal, obtains evaluation parameters corresponding to the host terminal, and generates a security evaluation task for performing security evaluation on the host terminal through simulated attacks based on the evaluation parameters and the evaluation strategy corresponding to the host terminal indicated by the user; wherein the evaluation parameters include business program vulnerabilities and evaluation scenarios corresponding to the host terminal; the evaluation terminal calls the attack proxy module to issue an attack instruction corresponding to the security evaluation task to the host terminal; the host terminal calls the attack proxy module set in the host terminal The target proxy module in the host terminal responds to and executes the received attack instruction; the host terminal calls the security protection module set in the host terminal, performs security protection on the attack instruction, generates attack result data corresponding to the attack instruction, and sends the attack result data to the evaluation terminal; wherein the attack result data includes the score results of each attack case in multiple attack use cases corresponding to the attack instruction under multiple evaluation dimensions; the evaluation terminal receives the attack result data, and according to the score results of each attack case in multiple evaluation dimensions included in the attack result data, uses the preset use case score calculation formula and the evaluation score weight, and generates the security assessment result of the host terminal under the security assessment task by accumulating and weighted summing the score results. In the evaluation end and host end of the host security evaluation system, an attack agent module and a target agent module that can realize generalized attack simulation are respectively set. The evaluation end obtains the evaluation parameters of the host end and the security assessment tasks generated by the evaluation scenario, actively launches a simulated attack to the host end, and generates a security assessment result of the host end based on the attack result data generated after the host end makes security protection, combined with a preset security assessment mechanism, to comprehensively and directly evaluate the real-time protection capability of the host, greatly improves the effectiveness and reliability of the host protection, and thus enhances the security of the host.

[0126] See also Figure 2 , Figure 3 , Figure 2 One of the structural schematic diagrams of a host security evaluation system provided in an embodiment of the present application; Figure 3 This is a second structural diagram of a host security evaluation system provided in an embodiment of the present application. Figure 2 As shown in , the host security assessment system 200 includes an assessment end 210 and a host end 220 .

[0127] Further, such as Figure 3 As shown in , the evaluation end 210 includes:

[0128] The attack proxy module 211 is used to perform device scanning and data collection and analysis on the host end, obtain the evaluation parameters corresponding to the host end, and generate a security assessment task for performing security assessment on the host end through simulated attack according to the evaluation parameters and the evaluation strategy corresponding to the host end indicated by the user; and issue an attack instruction corresponding to the security assessment task to the host end; wherein the evaluation parameters include the business program vulnerabilities and evaluation scenarios corresponding to the host end;

[0129] The security assessment module 212 is used to receive the attack result data generated by the host end executing the attack instruction, and generate the security assessment result of the host end under the security assessment task by accumulating and weighted summing the score results of each attack case under multiple assessment dimensions included in the attack result data, using a preset case score calculation formula and assessment score weight;

[0130] Further, such as Figure 3 As shown in , the host end 220 includes:

[0131] The target agent module 221 is used to respond to and execute the attack instruction corresponding to the security assessment task issued by the assessment end;

[0132] The security protection module 222 is used to perform security protection on the attack instruction, generate attack result data corresponding to the attack instruction, and send the attack result data to the evaluation end; wherein the attack result data includes the score results of each attack case in multiple attack use cases corresponding to the attack instruction under multiple evaluation dimensions.

[0133] Furthermore, when the attack proxy module 211 is used to perform device scanning and data collection and analysis on the host end to obtain the evaluation parameters corresponding to the host end, the attack proxy module 211 is used to:

[0134] Performing device scanning and security data collection on the host end to obtain operating system data and component version data corresponding to the host end;

[0135] Matching the operating system data and component version data with a vulnerability library set in the attack proxy module to determine the business program vulnerability corresponding to the host end included in the evaluation parameters;

[0136] According to the security data included in the business program vulnerability, the evaluation scenario corresponding to the host end included in the evaluation parameters is determined by analyzing the business scenario corresponding to the security data.

[0137] Furthermore, when the target proxy module 221 is used to respond to and execute the received attack instruction, the target proxy module 221 is used to:

[0138] Responding to the received attack instruction and simulating downloading the file virus indicated by the attack instruction;

[0139] Accessing a malicious site corresponding to the file virus to connect to a control server corresponding to the file virus;

[0140] At the malicious site, the attack behavior indicated by the file virus is executed through the control server.

[0141] Further, the security assessment module 212 is used to receive the attack result data generated by the host end executing the attack instruction, and according to the score results of each attack case under multiple evaluation dimensions included in the attack result data, using the preset case score calculation formula and evaluation score weight, to generate the security assessment result of the host end under the security assessment task by cumulative calculation and weighted summation, the security assessment module 212 is used to:

[0142] For the multiple attack use cases in the attack instruction, the attack result data is received, and according to the score results of each attack use case under multiple evaluation dimensions included in the attack result data, the score result of each attack use case is determined by a preset use case score calculation formula;

[0143] Accumulating the score results of each attack case to determine the score result of the attack instruction;

[0144] According to the score result of the attack instruction, combined with the preset evaluation score weight corresponding to the attack instruction, a security evaluation result of the host terminal under the security evaluation task is generated by weighted summation.

[0145] The host security evaluation system provided by the embodiment of the present application has an attack proxy module and a target proxy module that can realize generalized attack simulation in the evaluation end and the host end of the host security evaluation system, respectively. The evaluation end obtains the evaluation parameters of the host end and the security evaluation tasks generated by the evaluation scenario, actively launches a simulated attack to the host end, and generates a security evaluation result of the host end based on the attack result data generated after the host end makes security protection, combined with a preset security evaluation mechanism, to comprehensively and directly evaluate the real-time protection capability of the host, greatly improve the effectiveness and reliability of the host protection, and thus enhance the security of the host.

[0146] See also Figure 4 , Figure 4This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4 As shown in , the electronic device 400 includes a processor 410 , a memory 420 and a bus 430 .

[0147] The memory 420 stores machine-readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 via the bus 430. When the machine-readable instructions are executed by the processor 410, the above-mentioned Figure 1 The steps of the host security assessment method in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0148] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0149] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0150] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0151] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0152] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0153] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for evaluating host security, characterized in that: An evaluation system for host security is applied; the host security evaluation system comprises an evaluation end and a host end, and the evaluation method comprises: The evaluation end performs device scanning and data collection and analysis on the host end through an attack proxy module arranged in the evaluation end, obtains evaluation parameters corresponding to the host end, and generates a security evaluation task for performing security evaluation on the host end through simulated attacks according to the evaluation parameters and the evaluation strategy corresponding to the host end indicated by the user; wherein the evaluation parameters include business program vulnerabilities and evaluation scenarios corresponding to the host end; The assessment end calls the attack proxy module to send an attack instruction corresponding to the security assessment task to the host end; The host terminal calls a target proxy module arranged in the host terminal to respond to and execute the received attack instruction; the target proxy module is used to receive and execute each specific attack instruction in the attack instruction, and is also used to monitor the running status of the host terminal and generate a security log; The host terminal calls the target proxy module set in the host terminal to respond to and execute the received attack instruction, including: The host terminal calls a target proxy module arranged in the host terminal, responds to the received attack instruction, and simulates downloading the file virus indicated by the attack instruction; Controlling the target proxy module to access the malicious site corresponding to the file virus to connect to the control server corresponding to the file virus; Controlling the target proxy module to execute the attack behavior indicated by the file virus through the control server at the malicious site; The host end calls a security protection module arranged in the host end, performs security protection on the attack instruction, generates attack result data corresponding to the attack instruction, and sends the attack result data to the evaluation end; wherein the attack result data includes score results of each attack case in multiple attack cases corresponding to the attack instruction under multiple evaluation dimensions; the evaluation dimensions include attack success rate, defense detection rate, response time and damage degree; The attack result data is received by the evaluation end, and according to the score results of each attack case included in the attack result data under multiple evaluation dimensions, a preset case score calculation formula and evaluation score weight are used to generate the security evaluation result of the host end under the security evaluation task by accumulating and weighted summing the score results; the attack result data includes the attack log generated when the target proxy module executes the attack instruction, and the security log generated when the security protection module performs security protection for the attack instruction; The step of receiving the attack result data by the evaluation end, and generating the security evaluation result of the host end under the security evaluation task by accumulating and weighted summing the score results of each attack case included in the attack result data under multiple evaluation dimensions using a preset case score calculation formula and evaluation score weights includes: For the multiple attack use cases in the attack instruction, the evaluation end receives the attack result data, and determines the score result of each attack use case according to the score results of each attack use case under multiple evaluation dimensions included in the attack result data, through a preset use case score calculation formula; Accumulating the score results of each attack case to determine the score result of the attack instruction; According to the score result of the attack instruction, combined with the preset evaluation score weight corresponding to the attack instruction, a security evaluation result of the host terminal under the security evaluation task is generated by weighted summation.

2. The method according to claim 1, characterized in that The evaluation end performs device scanning and data collection and analysis on the host end through an attack proxy module arranged in the evaluation end to obtain evaluation parameters corresponding to the host end, including: The evaluation end performs device scanning and security data collection on the host end through an attack proxy module arranged in the evaluation end, and obtains operating system data and component version data corresponding to the host end; Matching the operating system data and component version data with a vulnerability library set in the attack proxy module to determine the business program vulnerability corresponding to the host end included in the evaluation parameters; According to the security data included in the business program vulnerability, the evaluation scenario corresponding to the host end included in the evaluation parameters is determined by analyzing the business scenario corresponding to the security data.

3. A host security evaluation system, characterized in that: The host security evaluation system includes an evaluation end and a host end; wherein the evaluation end includes: The attack proxy module is used to perform device scanning and data collection and analysis on the host end, obtain the evaluation parameters corresponding to the host end, and generate a security assessment task for performing security assessment on the host end through simulated attack according to the evaluation parameters and the evaluation strategy corresponding to the host end indicated by the user; and issue an attack instruction corresponding to the security assessment task to the host end; wherein the evaluation parameters include the business program vulnerabilities and evaluation scenarios corresponding to the host end; A security assessment module, used to receive attack result data generated by the host end executing the attack instruction, and generate a security assessment result of the host end under the security assessment task by accumulating and weighted summing the score results of each attack case included in the attack result data under multiple assessment dimensions using a preset case score calculation formula and assessment score weight; the attack result data includes an attack log generated when the target proxy module executes the attack instruction, and a security log generated when the security protection module performs security protection for the attack instruction; The security assessment module is used to receive the attack result data generated by the host end executing the attack instruction, and according to the score results of each attack case under multiple evaluation dimensions included in the attack result data, using a preset case score calculation formula and evaluation score weight, to generate the security assessment result of the host end under the security assessment task by cumulative calculation and weighted summation, the security assessment module is used to: For the multiple attack use cases in the attack instruction, the attack result data is received, and according to the score results of each attack use case under multiple evaluation dimensions included in the attack result data, the score result of each attack use case is determined by a preset use case score calculation formula; the evaluation dimensions include attack success rate, defense detection rate, response time and damage degree; Accumulating the score results of each attack case to determine the score result of the attack instruction; According to the score result of the attack instruction, combined with the preset evaluation score weight corresponding to the attack instruction, a security evaluation result of the host terminal under the security evaluation task is generated by weighted summation; The host side includes: The target proxy module is used to respond to and execute the attack instructions corresponding to the security assessment task issued by the assessment end; the target proxy module is used to receive and execute each specific attack instruction in the attack instructions, and is also used to monitor the running status of the host end and generate a security log; When the target proxy module is used to respond to and execute the received attack instruction, the target proxy module is used to: Responding to the received attack instruction and simulating downloading the file virus indicated by the attack instruction; Accessing a malicious site corresponding to the file virus to connect to a control server corresponding to the file virus; Under the malicious site, executing the attack behavior indicated by the file virus through the control server; A security protection module is used to perform security protection on the attack instruction, generate attack result data corresponding to the attack instruction, and send the attack result data to the evaluation end; wherein the attack result data includes the score results of each attack case in multiple attack use cases corresponding to the attack instruction under multiple evaluation dimensions.

4. The evaluation system according to claim 3, characterized in that: When the attack proxy module is used to perform device scanning and data collection and analysis on the host end to obtain the evaluation parameters corresponding to the host end, the attack proxy module is used to: Performing device scanning and security data collection on the host end to obtain operating system data and component version data corresponding to the host end; Matching the operating system data and component version data with a vulnerability library set in the attack proxy module to determine the business program vulnerability corresponding to the host end included in the evaluation parameters; According to the security data included in the business program vulnerability, the evaluation scenario corresponding to the host end included in the evaluation parameters is determined by analyzing the business scenario corresponding to the security data.

5. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to execute the steps of the host security assessment method as described in any one of claims 1 to 2.

Images