Attack payload optimization method, attack payload optimization device and storage medium
By obtaining vulnerability information in simulated attack and defense and optimizing attack ports, frequency and encryption algorithms for attack payloads, the problem of inefficiency in simulated attack and defense is solved, and adaptive optimization and efficiency improvement of attack payloads are achieved.
Patent Information
- Application Number
- CN202411196434.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-29
- Publication Date
- 2024-12-17
- Estimated Expiration
- 2044-08-29
AI Technical Summary
During the simulated attack and defense process, after each simulation attack, the security protection function is upgraded, causing the testers to re-research and write the attack payload, resulting in inefficiency.
By receiving detection instructions from the network system to be penetrated, vulnerability information is obtained and security protection measures are determined. According to these measures, the attack port, activity frequency, encryption algorithm and obfuscation mode of the attack payload are optimized, and the attack payload is automatically adjusted to adapt to changes in security protection measures. Avoid manual modifications.
It improves the efficiency of simulated attack and defense, realizes adaptive optimization of attack load, avoids manual modification, and enhances the effectiveness and safety of attack load.
Smart Images
Figure CN118713934B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to an attack load optimization method, an attack load optimization device and a storage medium. Background Art
[0002] When conducting penetration testing and security assessments on computer networks, attacks are usually carried out on the target network based on attack payloads. During the attack process, it is necessary to have a deep understanding of the architecture and vulnerabilities of the target network in order to construct an effective attack payload.
[0003] During the process of simulated attack and defense, each time the system is attacked by a simulated attack, its corresponding security protection function will be upgraded accordingly. For the simulated attacker, after the attacked system is upgraded, the tester needs to re-study and evaluate the security of the attacked system, and then rewrite the attack payload, which will lead to low efficiency of simulated attack and defense.
[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention
[0005] The main purpose of the present invention is to provide an attack load optimization method, an attack load optimization device and a storage medium to solve the problem of low efficiency of attack and defense simulation in the prior art.
[0006] To achieve the above object, the present invention provides an attack payload optimization method, the method comprising the following steps:
[0007] When receiving a detection instruction of a network system to be infiltrated, obtaining vulnerability information of the network system to be infiltrated, and determining security protection measures corresponding to the vulnerability information;
[0008] Determine the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack payload according to the security protection measures;
[0009] Based on the attack port, the activity frequency, the encryption algorithm and the obfuscation mode, the attack payload is optimized, and an attack action is executed according to the optimized attack payload.
[0010] Optionally, before the step of determining the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack payload according to the security protection measure, the step further includes:
[0011] Obtaining network configuration information of the network system to be penetrated;
[0012] The step of determining the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack load according to the security protection measures includes:
[0013] Determine the security gaps corresponding to the security protection measures and the network configuration information, as well as the detection frequency, detection method and detection type of the security gaps;
[0014] The security gap is used as the attack port, and the activity frequency is determined according to the detection frequency, the encryption algorithm is determined according to the detection type, and the obfuscation mode is determined according to the detection method.
[0015] Optionally, the step of determining the security gap corresponding to the security protection measure and the network configuration information, and the detection frequency, detection method and detection type of the security gap includes:
[0016] Inputting the network configuration information and the security protection measures into a vulnerability detection module to obtain the security gap;
[0017] When the security gap is not empty, the security gap is analyzed and processed by a security analysis tool to obtain the detection frequency, the detection method and the detection type.
[0018] Optionally, before the step of determining the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack payload according to the security protection measure, the step further includes:
[0019] Obtain pre-stored security protection training sets;
[0020] The step of determining the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack load according to the security protection measures includes:
[0021] Matching the safety protection measures with the safety protection training set;
[0022] When the matching result of the matching process is not empty, determining the attack port, the activity frequency, the encryption algorithm, and the obfuscation mode included in the matching result;
[0023] When the matching result is empty, the security protection measure is output to the security protection interface, and the attack port, the activity frequency, the encryption algorithm and the obfuscation mode received by the security protection interface are obtained.
[0024] Optionally, when receiving the detection instruction of the network system to be infiltrated, the step of obtaining vulnerability information of the network system to be infiltrated and determining the security protection measures corresponding to the vulnerability information includes:
[0025] When receiving the detection instruction of the network system to be penetrated, continuously monitoring and analyzing the adaptive security framework of the network system to be penetrated to obtain the vulnerability information;
[0026] The defense measures corresponding to the vulnerability information are used as the security protection measures.
[0027] Optionally, the step of optimizing the attack payload based on the attack port, the activity frequency, the encryption algorithm, and the obfuscation mode, and executing the attack action according to the optimized attack payload includes:
[0028] Modify the attack target corresponding to the attack payload to the attack port, and modify the attack penetration frequency of the attack payload to the activity frequency;
[0029] Obfuscating the code corresponding to the attack payload according to the obfuscation mode, and encrypting the obfuscated code based on the encryption algorithm to complete the optimization processing of the attack payload;
[0030] The attack action is executed according to the attack payload after optimization processing.
[0031] Optionally, after the step of optimizing the attack payload based on the attack port, the activity frequency, the encryption algorithm, and the obfuscation mode, and executing the attack action according to the optimized attack payload, the method further includes:
[0032] Obtaining an attack data packet after the attack payload executes the attack action, and when the attack data packet contains information that the attack is intercepted, jumping to the step of obtaining vulnerability information of the network system to be penetrated and determining security protection measures corresponding to the vulnerability information; or
[0033] When an update instruction of the network system to be infiltrated is detected, target vulnerability information of the updated network system to be infiltrated is determined, and based on the target vulnerability information, the step of determining the security protection measures corresponding to the vulnerability information is jumped to be executed.
[0034] Optionally, when receiving the detection instruction of the network system to be infiltrated, before the step of obtaining vulnerability information of the network system to be infiltrated and determining the security protection measures corresponding to the vulnerability information, the step further includes:
[0035] Determine the network system to be penetrated corresponding to the received security assessment instruction, and obtain server information of the network system to be penetrated based on a preset detection tool;
[0036] Using the server information as an input parameter of a vulnerability detection module to obtain security vulnerability information of the network to be penetrated;
[0037] Obtaining an exploit code associated with the security vulnerability information, or obtaining the exploit code received by the vulnerability processing interface;
[0038] Based on the exploit code and the security vulnerability information, the attack payload corresponding to the network system to be penetrated is generated, and an attack detection action is performed based on the attack payload.
[0039] In addition, to achieve the above-mentioned purpose, the present invention also provides an attack payload optimization device, which includes a memory, a processor, and an attack payload optimization program stored in the memory and executable on the processor, and the attack payload optimization program, when executed by the processor, implements the steps of the attack payload optimization method described above.
[0040] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which an optimization program for an attack payload is stored, and when the optimization program for the attack payload is executed by a processor, the steps of the attack payload optimization method as described above are implemented.
[0041] The embodiment of the present invention provides an attack payload optimization method, an attack payload optimization device and a storage medium. When receiving a detection instruction of a network system to be infiltrated, the vulnerability information of the network system to be infiltrated is obtained, and the security protection measures corresponding to the vulnerability information are determined. Then, according to the security protection measures, the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack payload are determined. Finally, based on the attack port, the activity frequency, the encryption algorithm and the obfuscation mode, the attack payload is optimized, and the attack action is executed according to the optimized attack payload. It can be seen that in the process of simulating attack and defense, when the network system to be infiltrated is upgraded for security and re-executed for security scanning detection, the vulnerability information of the network system to be infiltrated can be re-parsed, and the attack payload can be adaptively optimized, thereby avoiding manual modification of the attack payload and improving the efficiency of simulated attack and defense. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present invention, and together with the specification are used to explain the principles of the present invention. In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the description of the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor.
[0043] Figure 1 It is a flowchart of a first embodiment of the attack payload optimization method of the present invention;
[0044] Figure 2 is a flow chart of a second embodiment of the attack payload optimization method of the present invention;
[0045] Figure 3 It is a flow chart of the third embodiment of the attack payload optimization method of the present invention;
[0046] Figure 4 It is a schematic diagram of the terminal hardware structure of each embodiment of the attack payload optimization method of the present invention.
[0047] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION
[0048] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.
[0049] During the process of simulated attack and defense, each time the system is attacked by a simulated attack, its corresponding security protection function will be upgraded accordingly. For the simulated attacker, after the attacked system is upgraded, the tester needs to re-study and evaluate the security of the attacked system, and then rewrite the attack payload, which will lead to low efficiency of simulated attack and defense.
[0050] To solve the above defects, an embodiment of the present invention proposes an attack payload optimization method, and its main solution includes the following steps:
[0051] When receiving a detection instruction of a network system to be infiltrated, obtaining vulnerability information of the network system to be infiltrated, and determining security protection measures corresponding to the vulnerability information;
[0052] Determine the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack payload according to the security protection measures;
[0053] Based on the attack port, the activity frequency, the encryption algorithm and the obfuscation mode, the attack payload is optimized, and an attack action is executed according to the optimized attack payload.
[0054] By using an optimization method for attack payloads, the present invention can re-parse vulnerability information of a network system to be infiltrated and adaptively optimize the attack payload when the network system to be infiltrated undergoes a security upgrade and re-executes a security scan detection, thereby avoiding manual modification of the attack payload and improving the efficiency of simulated attack and defense.
[0055] In order to better understand the above technical solution, exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
[0056] First embodiment
[0057] Please refer to Figure 1 The steps of the attack load optimization method of the present invention include:
[0058] Step S10, when receiving a detection instruction of a network system to be penetrated, obtaining vulnerability information of the network system to be penetrated, and determining security protection measures corresponding to the vulnerability information;
[0059] In this embodiment, after the security protection function of the network system to be infiltrated is upgraded, all files and codes will be re-processed for security detection. At this time, in order to avoid the attack payload being detected, the attack payload needs to be optimized accordingly, such as changing the corresponding encryption algorithm to re-encrypt the code of the attack payload, and at the same time, the corresponding obfuscation mode can be changed to obfuscate the code, so that the security detection behavior cannot analyze the behavior trend or execution process of the attack payload. At the same time, when the original attack port is blocked, the attack payload is allowed to re-select a new attack path, etc. Based on this, the detection instruction is a new security protection detection instruction issued by the network system to be infiltrated, and the vulnerability information is the vulnerability that exists in the network system to be infiltrated before and after the security protection function is upgraded. At the same time, since the security protection function of the system to be infiltrated has been upgraded, the vulnerability information has corresponding security protection measures for protection processing to avoid being attacked. At this time, it is necessary to determine the security protection measures corresponding to the vulnerability information, so as to automatically optimize the attack payload based on the security detection interval, detection method, etc. of the security protection measures, so as to improve the efficiency of simulated attack and defense.
[0060] As an optional implementation, upon receiving the detection instruction of the network system to be infiltrated, the adaptive security architecture (ASA) of the network system to be infiltrated can be continuously monitored and analyzed to obtain the vulnerability information. For example, by analyzing the collected data in real time, changes and adjustments in security protection can be quickly identified. When the security policy changes, new vulnerabilities, i.e., the vulnerability information, can be quickly discovered so as to determine security protection measures based on the vulnerability information. After obtaining the vulnerability information, it is necessary to obtain the defense measures corresponding to the vulnerability information and use the defense measures as security protection measures for the vulnerabilities. By obtaining the security protection measures of the vulnerability information, the optimization system of the attack payload can analyze and process the security protection measures, and then select the encryption algorithm and obfuscation mode to evade security protection detection, as well as find the attack port and activity frequency used to optimize the attack payload when launching a new round of attacks, and complete the automatic optimization process to improve the efficiency of simulated attack and defense.
[0061] In another optional implementation, the detection instruction of the network system to be infiltrated may also induce phishing instructions for automatic optimization of the attack payload. Therefore, when receiving the detection instruction, the detection module can analyze whether the detection instruction is a real instruction. If it is a real instruction, the steps of obtaining the vulnerability information of the network system to be infiltrated and determining the security protection measures corresponding to the vulnerability information are executed, otherwise no change is made. The analysis module determines whether the detection instruction is a real instruction, and then performs corresponding processing actions based on the instruction, so that the attack payload can be adaptively optimized according to the specific scene change information, thereby improving the effectiveness of the attack payload of the attacker during the simulated attack and defense.
[0062] Step S20, determining the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack payload according to the security protection measures;
[0063] In this embodiment, the attack port is the new port that needs to be attacked, and the attack payload can appropriately reduce the activity frequency to avoid security detection. At the same time, based on the encryption algorithm and obfuscation technology, it is ensured that the attack payload can present different characteristics each time it is transmitted, thereby evading security detection.
[0064] Therefore, as an optional implementation method, the correlation between network configuration information and security protection measures can be determined by comparing the network configuration information of the network system to be infiltrated, and then the attack port, activity frequency, encryption algorithm and obfuscation mode can be determined based on the correlation.
[0065] In another optional implementation, the trained data can be matched with security protection measures by comparing the training data to find the attack port, activity frequency, encryption algorithm and obfuscation mode that meet the attack requirements.
[0066] By analyzing, screening and comparing security protection measures, we select attack ports, activity frequencies, encryption algorithms and obfuscation modes that meet attack requirements and evade security detection needs, so that we can automatically optimize attack payloads based on this type of data, thereby improving the effectiveness of attack payloads and reducing the need for testers to manually handle attack payloads, thereby improving the efficiency of simulated attack and defense.
[0067] Step S30, optimizing the attack payload based on the attack port, the activity frequency, the encryption algorithm and the obfuscation mode, and executing the attack action according to the optimized attack payload.
[0068] In this embodiment, the process of optimizing the attack payload is an automatic process. As an optional implementation, the attack target corresponding to the attack payload can be modified to the attack port, and the attack penetration frequency of the attack payload can be modified to the activity frequency to avoid security detection. At the same time, after the code corresponding to the attack payload is obfuscated according to the obfuscation mode to generate a new variant, the obfuscated code is finally encrypted based on the encryption algorithm to further improve the security of the attack payload, so that the attack payload will not be detected by the security protection measures, thereby completing the optimization of the attack payload, and finally executing the attack action according to the optimized attack payload. The attack payload is automatically optimized through security protection measures to ensure that the attack payload avoids security detection while improving the effectiveness of the attack, thereby improving the efficiency of simulated attack and defense.
[0069] In an optional implementation after the attack action is instructed by the optimized attack load, an attack data packet after the attack load executes the attack action can be obtained. When the attack data packet contains information that the attack is intercepted, it means that the current attack load after automatic optimization is still unable to avoid security detection and execute the attack. At this time, step S10 can be re-executed to perform troubleshooting tests in the detection process to improve the effectiveness of the attack. When the update instruction of the network system to be infiltrated is detected, it means that the current attack is effective, and the network system to be infiltrated makes further updates to the security measures during the simulation process. At this time, it is necessary to determine the target vulnerability information of the updated network system to be infiltrated, and jump to the step of determining the security protection measures corresponding to the vulnerability information based on the target vulnerability information, so as to achieve adaptive automatic optimization of the attack load according to the constantly changing security protection scenario during the simulation attack and defense process, improve the effectiveness of the simulated attack and defense, and improve the efficiency of the simulated attack and defense.
[0070] In the technical solution disclosed in this embodiment, when receiving the detection instruction of the network system to be penetrated, the adaptive security framework of the network system is continuously monitored and analyzed to obtain the corresponding vulnerability information, and then the defense measures of the vulnerability information are used as security protection measures, and then the attack port, activity frequency, encryption algorithm and obfuscation mode, etc. used to avoid security detection are determined according to the security protection measures, and the attack load is automatically optimized based on the attack port, activity frequency, encryption algorithm and obfuscation mode, avoiding the need to manually optimize the attack load, thereby improving the efficiency of simulated attack and defense. At the same time, when the attack fails, a new vulnerability is automatically selected for attack, or when the network system to be penetrated updates new protection measures based on the attack load, the vulnerability information is re-selected and the attack load is automatically optimized again, thereby improving the efficiency of simulated attack and defense.
[0071] Second embodiment
[0072] Please refer to Figure 2 Based on the first embodiment, before step S20, it is also necessary to obtain the network configuration information of the network system to be penetrated, and the network configuration information includes the device or system type, open ports, services, development frameworks, components, domain name information, scripting languages, sensitive files and directories, middleware information, and network topology. Based on the network configuration information, step S220 specifically includes:
[0073] Step S21, determining the security gap corresponding to the security protection measure and the network configuration information, as well as the detection frequency, detection method and detection type of the security gap;
[0074] In this embodiment, the security protection measures correspond to the protection logic of each network configuration information. At this time, the more vulnerable ports in the security protection measures and network configuration information can be found. For example, among ports A, B and C, the security detection frequency of port C is lower than that of ports A and B. At this time, port C can be used as a security gap, and then penetration attacks can be gradually carried out. Among them, each security gap corresponds to the detection frequency, detection method and detection type. After the security gap is selected, it is necessary to continue to analyze the detection frequency, detection method and detection type corresponding to the security gap, so as to determine the activity frequency, encryption algorithm and obfuscation mode required to optimize the attack payload based on these data.
[0075] As an optional implementation, the network configuration information and the security protection measures can be input into the vulnerability detection module to obtain the security gap, and then when the information of the security gap is not empty, the security gap is analyzed and processed by the security analysis tool to obtain the detection frequency, the detection method and the detection type. It is understandable that when the security gap is empty, it means that the current vulnerability detection module cannot detect the vulnerability that can be used for penetration attack, and at this time, it is necessary to notify the tester to perform the corresponding upgrade process.
[0076] Step S22, using the security breach as the attack port, and determining the activity frequency according to the detection frequency, determining the encryption algorithm according to the detection type, and determining the obfuscation mode according to the detection method.
[0077] In this embodiment, the security breach is an attack port. As an optional implementation method, the activity frequency that can bypass security detection can be directly selected according to the detection frequency, and the encryption algorithm can be determined according to the detection type. For example, in the security detection, encryption algorithm A can be decrypted and analyzed, and encryption algorithm B can be selected for processing. The obfuscation mode is determined according to the detection method. For example, when the detection method cannot detect the obfuscated code, the obfuscation mode can be determined as code obfuscation technology. The corresponding encryption algorithm, obfuscation mode, and activity frequency are determined by the security detection method corresponding to the security breach, so that the attack payload can be automatically optimized based on the encryption algorithm, obfuscation mode, and activity frequency.
[0078] In another optional implementation, before step S20, a pre-stored security protection training set may be obtained, in which various trained data results are stored, and the security protection measures are used as matching conditions for searching, from which the corresponding attack ports, activity frequencies, encryption algorithms, and obfuscation modes, etc. may be obtained. Specifically, the security protection measures are matched with the security protection training set, and then when the matching result of the matching process is not empty, the attack port, the activity frequency, the encryption algorithm, and the obfuscation mode contained in the matching result are determined. When the matching result is empty, the security protection measures are output to the security protection interface, and the attack port, the activity frequency, the encryption algorithm, and the obfuscation mode received by the security protection interface and input by the tester are obtained.
[0079] In the technical solution disclosed in this embodiment, network configuration information and security protection measures are input into the vulnerability detection module to obtain vulnerability gaps, and the vulnerability gaps are processed according to the security analysis tool to obtain the detection frequency for determining the activity frequency, the detection type for determining the encryption algorithm, and the detection method for determining the obfuscation mode, etc., so as to automatically optimize the attack payload according to this information, thereby improving the efficiency of simulated attack and defense.
[0080] Third embodiment
[0081] Please refer to Figure 3 Based on the first embodiment, when simulating attack and defense, it is necessary to automatically generate attack load according to actual scene information to improve the efficiency of simulated attack and defense. Based on this, before step S10, it also includes:
[0082] Step S40, determining the network system to be penetrated corresponding to the received security assessment instruction, and obtaining server information of the network system to be penetrated based on a preset detection tool;
[0083] In this embodiment, the security assessment instruction refers to the attack instruction set by the tester for the network system to be penetrated that needs to be simulated for attack and defense. In the process of simulating attack and defense, the tester will update the network system to be penetrated based on the corresponding vulnerabilities (for example, replace the original web server that is vulnerable to attack). At this time, the old attack payload cannot continue to attack and a new attack payload needs to be generated. Based on this, the network system to be penetrated needs to be evaluated and processed, and a new attack payload is automatically generated according to the evaluation results. Among them, the preset detection tools include web crawler scripts and port scanning tools, based on which the server information such as the operating system type, open ports, and running services corresponding to the target network for penetration testing and security assessment is obtained.
[0084] Step S50, using the server information as an input parameter of a vulnerability detection module to obtain security vulnerability information of the network to be penetrated;
[0085] In this embodiment, the vulnerability detection module is a functional module pre-trained and generated by the system. The module is used to detect vulnerability information existing in the current server information, and then automatically detect the vulnerability information existing in the network to be infiltrated, so as to automatically generate an attack payload based on the vulnerability information, thereby improving the efficiency of attack payload generation.
[0086] Step S60, obtaining the exploit code associated with the security vulnerability information, or obtaining the exploit code received by the vulnerability processing interface;
[0087] In this embodiment, the use code refers to a code written in a computer programming language that can realize a certain function or solve a certain problem. The use code can be a pre-written library, framework or module, or it can be a code written by the tester himself. By running these codes, the computer can perform specific operations, such as data processing, calculation, and control of hardware devices.
[0088] By obtaining the exploit code corresponding to the security vulnerability information, the attack payload can be automatically generated through the exploit code and the security vulnerability information, thereby improving the generation efficiency and testing efficiency of the attack payload.
[0089] Step S70: generating the attack payload corresponding to the network system to be penetrated based on the exploit code and the security vulnerability information, and performing an attack detection action based on the attack payload.
[0090] In this embodiment, the attack payload includes the exploit code corresponding to the security vulnerability information. As an optional implementation, in the process of generating the attack payload corresponding to the network system to be penetrated, a preset attack payload template can be generated based on the vulnerability version of the security vulnerability information, and then the exploit code is added to the preset attack payload template to obtain the corresponding attack payload. Among them, the vulnerability version refers to the version type currently corresponding to the security vulnerability information. When generating the preset attack payload template, it is necessary to select the code writing rules according to the vulnerability version, and then generate the preset attack payload template according to the code writing rules. In addition, a code generation module can be selected according to the vulnerability version, and the security vulnerability information can be input into the module, thereby automatically generating a preset attack payload template.
[0091] In the technical solution disclosed in this embodiment, the network system to be infiltrated is analyzed to obtain its corresponding vulnerability information, and the corresponding exploit code is determined based on the vulnerability information. Finally, the attack payload is automatically generated according to the exploit code, thereby improving the efficiency of generating attack payloads before the security protection function of the network system to be infiltrated is upgraded, thereby improving the efficiency of simulated attack and defense.
[0092] Reference Figure 4 , Figure 4 The figure is a schematic diagram of the terminal structure of the hardware operating environment involved in the embodiment of the present invention.
[0093] like Figure 4As shown, the terminal may include: a processor 1001, such as a main processor (Central Processing Unit, CPU), a communication bus 1002, a network interface 1003, and a memory 1004. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The network interface 1003 may optionally include a standard wired interface, a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1004 may be a high-speed RAM memory (Random Access Memory, RAM) or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1004 may also be a storage device independent of the aforementioned processor 1001.
[0094] Those skilled in the art will understand that Figure 4 The terminal structure shown in the figure does not constitute a limitation on the terminal, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.
[0095] like Figure 4 As shown, the memory 1004 as a computer storage medium may include an operating system, a data storage module, a network communication module, and an optimization program for attack payloads.
[0096] exist Figure 4 In the terminal shown, the network interface 1003 is mainly used to connect to the backend server and perform data communication with the backend server; the processor 1001 can call the optimization program of the attack payload stored in the memory 1004 and perform the following operations:
[0097] When receiving a detection instruction of a network system to be infiltrated, obtaining vulnerability information of the network system to be infiltrated, and determining security protection measures corresponding to the vulnerability information;
[0098] Determine the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack payload according to the security protection measures;
[0099] Based on the attack port, the activity frequency, the encryption algorithm and the obfuscation mode, the attack payload is optimized, and an attack action is executed according to the optimized attack payload.
[0100] Furthermore, the processor 1001 may call the optimization program of the attack payload stored in the memory 1004, and further perform the following operations:
[0101] Obtaining network configuration information of the network system to be penetrated;
[0102] The step of determining the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack load according to the security protection measures includes:
[0103] Determine the security gaps corresponding to the security protection measures and the network configuration information, as well as the detection frequency, detection method and detection type of the security gaps;
[0104] The security gap is used as the attack port, and the activity frequency is determined according to the detection frequency, the encryption algorithm is determined according to the detection type, and the obfuscation mode is determined according to the detection method.
[0105] Furthermore, the processor 1001 may call the optimization program of the attack payload stored in the memory 1004, and further perform the following operations:
[0106] Inputting the network configuration information and the security protection measures into a vulnerability detection module to obtain the security gap;
[0107] When the security gap is not empty, the security gap is analyzed and processed by a security analysis tool to obtain the detection frequency, the detection method and the detection type.
[0108] Furthermore, the processor 1001 may call the optimization program of the attack payload stored in the memory 1004, and further perform the following operations:
[0109] Obtain pre-stored security protection training sets;
[0110] The step of determining the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack load according to the security protection measures includes:
[0111] Matching the safety protection measures with the safety protection training set;
[0112] When the matching result of the matching process is not empty, determining the attack port, the activity frequency, the encryption algorithm, and the obfuscation mode included in the matching result;
[0113] When the matching result is empty, the security protection measure is output to the security protection interface, and the attack port, the activity frequency, the encryption algorithm and the obfuscation mode received by the security protection interface are obtained.
[0114] Furthermore, the processor 1001 may call the optimization program of the attack payload stored in the memory 1004, and further perform the following operations:
[0115] When receiving the detection instruction of the network system to be penetrated, continuously monitoring and analyzing the adaptive security framework of the network system to be penetrated to obtain the vulnerability information;
[0116] The defense measures corresponding to the vulnerability information are used as the security protection measures.
[0117] Furthermore, the processor 1001 may call the optimization program of the attack payload stored in the memory 1004, and further perform the following operations:
[0118] Modify the attack target corresponding to the attack payload to the attack port, and modify the attack penetration frequency of the attack payload to the activity frequency;
[0119] Obfuscating the code corresponding to the attack payload according to the obfuscation mode, and encrypting the obfuscated code based on the encryption algorithm to complete the optimization processing of the attack payload;
[0120] The attack action is executed according to the attack payload after optimization processing.
[0121] Furthermore, the processor 1001 may call the optimization program of the attack payload stored in the memory 1004, and further perform the following operations:
[0122] Obtaining an attack data packet after the attack payload executes the attack action, and when the attack data packet contains information that the attack is intercepted, jumping to the step of obtaining vulnerability information of the network system to be penetrated and determining security protection measures corresponding to the vulnerability information; or
[0123] When an update instruction of the network system to be infiltrated is detected, target vulnerability information of the updated network system to be infiltrated is determined, and based on the target vulnerability information, the step of determining the security protection measures corresponding to the vulnerability information is jumped to be executed.
[0124] Furthermore, the processor 1001 may call the optimization program of the attack payload stored in the memory 1004, and further perform the following operations:
[0125] Determine the network system to be penetrated corresponding to the received security assessment instruction, and obtain server information of the network system to be penetrated based on a preset detection tool;
[0126] Using the server information as an input parameter of a vulnerability detection module to obtain security vulnerability information of the network to be penetrated;
[0127] Obtaining an exploit code associated with the security vulnerability information, or obtaining the exploit code received by the vulnerability processing interface;
[0128] Based on the exploit code and the security vulnerability information, the attack payload corresponding to the network system to be penetrated is generated, and an attack detection action is performed based on the attack payload.
[0129] In addition, it can be understood by a person skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the control terminal to implement the process steps of the embodiment of the above method.
[0130] Therefore, the present invention also provides a computer-readable storage medium, which stores an optimization program for attack payloads. When the optimization program for attack payloads is executed by a processor, the various steps of the attack payload optimization method described in the above embodiment are implemented.
[0131] It should be noted that since the storage medium provided in the embodiment of the present application is the storage medium used to implement the method of the embodiment of the present application, based on the method introduced in the embodiment of the present application, the person skilled in the art can understand the specific structure and deformation of the storage medium, so it is not repeated here. All storage media used in the method of the embodiment of the present application belong to the scope of protection of this application.
[0132] It should be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0133] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0134] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0135] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0136] It should be noted that in the claims, any reference signs placed between parentheses shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claim. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.
[0137] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.
[0138] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.
[0139] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. A method for optimizing attack payload, characterized in that: The attack payload optimization method includes: When receiving a detection instruction of the network system to be infiltrated, obtaining vulnerability information of the network system to be infiltrated, and determining security protection measures corresponding to the vulnerability information, the detection instruction being a new security protection detection instruction issued by the network system to be infiltrated; Obtaining network configuration information of the network system to be penetrated, inputting the network configuration information and the security protection measures into a vulnerability detection module to obtain a security breach; When the security gap is not empty, the security gap is analyzed and processed by a security analysis tool to obtain a detection frequency, a detection method and a detection type; The security gap is used as an attack port, and an activity frequency is determined according to the detection frequency, an encryption algorithm is determined according to the detection type, and an obfuscation mode is determined according to the detection method, wherein the encryption algorithm and the obfuscation mode are used to ensure that the attack payload presents different characteristics each time it is transmitted, thereby evading security detection; Based on the attack port, the activity frequency, the encryption algorithm and the obfuscation mode, the attack payload is optimized, and an attack action is executed according to the optimized attack payload.
2. The attack payload optimization method according to claim 1, characterized in that: Before the step of determining the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack payload according to the security protection measures, the step further includes: Obtain pre-stored security protection training sets; The step of determining the attack port, activity frequency, encryption algorithm and obfuscation mode corresponding to the attack load according to the security protection measures includes: Matching the safety protection measures with the safety protection training set; When the matching result of the matching process is not empty, determining the attack port, the activity frequency, the encryption algorithm, and the obfuscation mode included in the matching result; When the matching result is empty, the security protection measure is output to the security protection interface, and the attack port, the activity frequency, the encryption algorithm and the obfuscation mode received by the security protection interface are obtained.
3. The attack payload optimization method according to claim 1, characterized in that: When receiving the detection instruction of the network system to be penetrated, the steps of obtaining the vulnerability information of the network system to be penetrated and determining the security protection measures corresponding to the vulnerability information include: When receiving the detection instruction of the network system to be penetrated, continuously monitoring and analyzing the adaptive security framework of the network system to be penetrated to obtain the vulnerability information; The defense measures corresponding to the vulnerability information are used as the security protection measures.
4. The attack payload optimization method according to claim 1, characterized in that: The step of optimizing the attack payload based on the attack port, the activity frequency, the encryption algorithm, and the obfuscation mode, and executing the attack action according to the optimized attack payload includes: Modify the attack target corresponding to the attack payload to the attack port, and modify the attack penetration frequency of the attack payload to the activity frequency; Obfuscating the code corresponding to the attack payload according to the obfuscation mode, and encrypting the obfuscated code based on the encryption algorithm to complete the optimization processing of the attack payload; The attack action is executed according to the attack payload after optimization processing.
5. The attack payload optimization method according to claim 1, characterized in that: After the step of optimizing the attack payload based on the attack port, the activity frequency, the encryption algorithm and the obfuscation mode, and executing the attack action according to the optimized attack payload, the method further includes: Obtaining an attack data packet after the attack payload executes the attack action, and when the attack data packet contains information that the attack is intercepted, jumping to the step of obtaining vulnerability information of the network system to be penetrated and determining security protection measures corresponding to the vulnerability information; or When an update instruction of the network system to be infiltrated is detected, target vulnerability information of the updated network system to be infiltrated is determined, and based on the target vulnerability information, the step of determining the security protection measures corresponding to the vulnerability information is jumped to be executed.
6. The attack payload optimization method according to claim 1, characterized in that: Before the step of obtaining vulnerability information of the network system to be infiltrated and determining security protection measures corresponding to the vulnerability information upon receiving the detection instruction of the network system to be infiltrated, the method further includes: Determine the network system to be penetrated corresponding to the received security assessment instruction, and obtain server information of the network system to be penetrated based on a preset detection tool; Using the server information as an input parameter of a vulnerability detection module to obtain security vulnerability information of the network to be penetrated; Obtaining an exploit code associated with the security vulnerability information, or obtaining the exploit code received by the vulnerability processing interface; Based on the exploit code and the security vulnerability information, the attack payload corresponding to the network system to be penetrated is generated, and an attack detection action is performed based on the attack payload.
7. An attack load optimization device, characterized in that: The attack payload optimization device includes: a memory, a processor, and an attack payload optimization program stored in the memory and executable on the processor. When the attack payload optimization program is executed by the processor, the steps of the attack payload optimization method according to any one of claims 1 to 6 are implemented.
8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an attack payload optimization program, and when the attack payload optimization program is executed by a processor, the steps of the attack payload optimization method according to any one of claims 1 to 6 are implemented.