A scenario script scheduling method and system for BAS

Abstract

The present invention discloses a scenario script scheduling method and system for BAS, including: saving an attack link structure diagram, wherein a calculation formula of a control identifier set by a control node is used, and a leaf node to be executed is determined according to the formula in combination with the execution result of the script in the node; when executing a simulated attack task, execution starts from the root node of the scenario, and a script execution command is generated for each executed node according to the configured script sequence, and the simulator executes and determines whether the script under the node is executed, and the actual control identifier value is calculated according to the execution result fed back by the simulator, and the next node to be executed is selected by comparison with the preset control identifier value. The present invention can realize complex link scheduling of scenarios, support the configuration of order and relevance between each attack node of the link, ensure the orderliness of script execution, and make the simulation of the attack process more realistic.

Description

Technical Field

[0001] The present invention relates to a scenario script scheduling method and system for BAS, belonging to the technical field of computer software and network security. Background Art

[0002] According to Gartner's definition, BAS (Breach and Attack Simulation) verifies the protection capabilities and policy vulnerabilities of security protection equipment by continuously simulating attacks on different assets. In simple terms, BAS technology mainly provides enterprises and institutions with continuous security defense system assessment capabilities, verifies the effectiveness of security protection equipment or protection strategies, and provides risk mitigation suggestions and solutions to patch protection vulnerabilities.

[0003] BAS system is usually deployed in the following ways: Figure 1 As shown in the figure, the administrator creates a verification task (hereinafter referred to as the task) for executing simulated attacks in the BAS system management center. The task is a combination of multiple simulators and multiple scripts, where the simulator is responsible for executing the simulated attack behavior in the script. The management center will then send the script selected in the task to the corresponding simulator for execution. After the simulator obtains the script data to be executed, it starts to execute the simulated attack action, and then transmits the results of the simulated attack back to the management center in units of scripts. After receiving the script execution results, the management center parses and saves the database, and finally displays them visually or generates an evaluation report in the management center. Based on the visual display or evaluation report of the results, it can help administrators to promptly discover security policy problems or protection vulnerabilities in the evaluation area.

[0004] At present, there are many defects in the scenarios of BAS products in the industry, which makes it impossible to achieve true simulation: 1. The attack nodes in the scenario attack link are disordered, but the attacks launched by hackers are usually ordered and the purposes of each stage are different. The current BAS products in the industry do not truly simulate the orderliness of each stage of the hacker attack; 2. The current BAS products in the industry simulate that the hacker attack actions are disordered, but when hackers implement each attack stage, the attacks are also orderly, rather than aimless attacks; 3. The attack link of the current BAS product scenario in the industry is usually a straight line composed of multiple nodes. This type of attack link is determined, but usually a real hacker attack is not a single determined attack link, that is, in order to obtain the results of the attack at this stage, one attack method is used to try again after failing to achieve results, and there is a problem of unrealistic simulation of the hacker attack process; 4. In the attack link of the current BAS product scenario in the industry, the nodes are independent and unrelated, that is, the node to be executed by the next node is not obtained based on the execution result of the previous node. Simulated hackers usually use the results of the previous stage of the attack to implement the next stage of the attack, and there is a problem of unrealistic simulation of the hacker attack process. Summary of the invention

[0005] Purpose of the invention: In view of the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a scenario script scheduling method and system for BAS, which realizes complex link scheduling of the scenario through attack link structure diagram configuration and script scheduling, supports the sequence and correlation configuration between each attack node of the link, ensures the orderliness of script execution, and makes the simulation of the attack process more realistic.

[0006] Technical solution: To achieve the above-mentioned invention object, the present invention adopts the following technical solution:

[0007] A scenario script scheduling method for BAS, characterized by comprising the following steps:

[0008] The simulated attack link structure diagram formulated by the user is saved, and the structure diagram includes attack nodes and control nodes; the control node is provided with a formula for calculating the control identifier, and the leaf node to be executed is determined according to the formula combined with the execution result of the script in the node;

[0009] When executing the simulated attack task, start from the root node of the scene and save the current node in the scene node trajectory table in order;

[0010] For the current node, generate the first script execution command list according to the script sequence in the node and save it to the script execution command table of the database, and add the command number of the first script execution command list to the second script execution command list, and cache the second script execution command list; when the simulator requests to execute the script, query the unexecuted commands under the simulator from the script execution command table of the database to obtain the third script execution command list, and calculate the fourth script execution command list to be executed by the simulator according to the serial number order of the script in the scene and the execution status of the previous script and return it to the simulator; remove the executed script command number from the second script execution command list according to the execution result fed back by the simulator;

[0011] Determine whether the current node script has been executed based on whether the second script execution command list is empty;

[0012] After the current node script is executed, the current node is determined according to the scene node trajectory table. If the current node is a control node, the actual control identifier value is calculated according to the set control identifier formula and the script execution result identifier list of the current node, and the leaf node with the preset control identifier value and the actual control identifier value equal to the node to be executed next is found; if the current node has only one leaf node, then the leaf node is the node to be executed next; save the leaf node to the scene node trajectory table, and repeat the script execution process of the node; if the current node has no leaf node, the simulated attack task execution is completed.

[0013] Preferably, the attack link structure diagram is saved in a scenario structure table of a database, and the attributes of the scenario structure table include scenario number, node number, parent node number, node name, node-associated script list, preset control identification value, and control identification value calculation formula.

[0014] Preferably, each script execution command in the script execution command list includes a number, a task number, a script number, an attacker simulator number, an attacked simulator number, script parameters, a command status code and a serial number of the script in the scene.

[0015] Preferably, the step of calculating the fourth script execution command list to be executed by the simulator according to the sequence number order of the scripts in the scene and the execution status of the previous script and returning it to the simulator comprises:

[0016] Traverse each script execution command in the third script execution command list;

[0017] If the sequence number of the current script execution command is 1, it is directly added to the fourth script execution command list; otherwise, the execution status of all script execution commands with the previous sequence number of the current script execution command under the current task is queried in the script execution command table. If all are completed, the current script execution command is added to the fourth script execution command list. If there are unfinished ones, the current script execution command is skipped;

[0018] If the fourth script execution command list is not an empty list, then the status of each script execution command in the fourth script execution command list in the script execution command table of the database is updated to be in execution;

[0019] The fourth script execution command list is returned to the simulator as response data.

[0020] Preferably, the second script execution command list is cached in a key-value format, where the key is the task number and the value is the second script execution command list.

[0021] Preferably, after the simulator returns the script execution result, the task number, script execution command number and execution result identifier in the result data are parsed, the script execution command number corresponding to this result is removed from the second script execution command list, the execution result identifier is saved in the database result table, and the script execution command status in the script execution command table is updated to completed.

[0022] Preferably, the simulator obtains the script execution command by initiating a request through periodic polling, or the management center actively pushes the fourth script execution command list to the simulator through the message queue middleware.

[0023] Preferably, the logical formula for calculating the control identifier includes: if all script execution commands in the node successfully attack, it is recorded as yes, otherwise it is recorded as no; or, if there is a script execution command in the node with a successful result, it is recorded as yes, otherwise it is recorded as no.

[0024] Based on the same inventive concept, the present invention provides a scene script scheduling system for BAS, comprising:

[0025] A graph structure storage module is used to store a simulated attack link structure diagram formulated by a user, wherein the structure diagram includes attack nodes and control nodes; the control node is provided with a formula for calculating a control identifier, and the leaf node to be executed is determined according to the formula combined with the execution result of the script in the node;

[0026] And a scheduling module, which is used to start execution from the root node of the scene when executing a simulated attack task, and save the current node in the scene node trajectory table in sequence; for the current node, generate a first script execution command list according to the script sequence in the node and save it to the script execution command table of the database, and at the same time add the command number of the first script execution command list to the second script execution command list, and cache the second script execution command list; when the simulator requests to execute a script, query the unexecuted commands under the simulator from the script execution command table in the database to obtain the third script execution command list, and calculate the fourth script execution command list to be executed by the simulator according to the serial number order of the script in the scene and the execution status of the previous script and return it to the simulator; according to the execution results fed back by the simulator If the script is executed successfully, the executed script command number is removed from the second script execution command list; whether the current node script is executed successfully is determined based on whether the second script execution command list is empty; after the current node script is executed successfully, the current node is determined based on the scene node trajectory table; if the current node is a control node, the actual control identification value is calculated based on the set control identification formula and the script execution result identification list of the current node, and the leaf node with the preset control identification value and the actual control identification value equal to is found as the node to be executed next; if the current node has only one leaf node, the leaf node is the node to be executed next; the leaf node is saved in the scene node trajectory table, and the script execution process of the node is repeated; if the current node has no leaf node, the execution of the simulated attack task is completed.

[0027] Based on the same inventive concept, the present invention provides a computer program product, including a computer program / instruction, which implements the steps of a scene script scheduling method for BAS when executed by a processor.

[0028] Beneficial effects: Compared with the prior art, the present invention has the following advantages: 1. The present invention can realize the sequentiality of each stage of the simulated hacker attack by configuring and executing each node in the attack link structure diagram in sequence, thereby achieving the purpose of simulating each stage of the hacker attack from pre-attack detection to network penetration, and solving the problem of the industry's simulation authenticity of hacker attacks. 2. The present invention can realize the orderly execution of the script in the scene node through the sequence number and scheduling control algorithm of the script in the scene node, thereby achieving the purpose of the attack carried out by the simulated hacker in each attack stage to achieve the attack results of the stage is also orderly. 3. The present invention can achieve the realistic simulation of the attack results of the stage by using another attack means to continue to try to obtain the realistic simulation of the attack results of the stage when simulating the hacker attack through the configuration and logical operation of the control node, and then find out the weak points of the protection ability of the security equipment and its strategy. 4. The present invention automatically determines the next node to be executed according to the execution result of the previous node, which can realize the correlation of each stage of the simulated hacker attack and achieve the purpose of realistically simulating the whole process of the hacker attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a schematic diagram of BAS system deployment.

[0030] Figure 2 The figure is a schematic diagram of the overall process of an embodiment of the present invention.

[0031] Figure 3 2 is a structural diagram of an attack link used as an example in an embodiment of the present invention.

[0032] Figure 4 This is the main flow chart of scenario script scheduling according to an embodiment of the present invention.

[0033] Figure 5 This is a flowchart of the simulator obtaining the execution script in an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments.

[0035] like Figure 2As shown, a scenario script scheduling method for BAS disclosed in an embodiment of the present invention first saves a simulated attack link structure diagram formulated by a user, and then when executing a simulated attack task, starts execution from the root node of the scenario, and sequentially saves the current node in the scenario node trajectory table. For the current node, the calculation of the simulator execution command and the judgment of whether the node execution is completed are realized through the constructed four script execution command lists; after the current node script is executed, the current node is determined according to the scenario node trajectory table, and the node to be executed next is determined according to the calculation of the node type and the control identifier. Specifically, if the current node is a control node, the actual control identifier value is calculated according to the set control identifier formula and the script execution result identifier list of the current node, and the leaf node with the preset control identifier value and the actual control identifier value equal is found as the node to be executed next; if the current node has only one leaf node, the leaf node is the node to be executed next; the leaf node is saved in the scenario node trajectory table, and the script execution process of the node is repeated; if the current node has no leaf node, the execution of the simulated attack task ends.

[0036] Specifically, in this embodiment, a tree structure is used to design an attack link structure diagram, which includes attack nodes and control nodes. The control node is provided with a formula for calculating the control identifier, and the leaf node to be executed can be determined based on the formula combined with the execution result of the script in the node.

[0037] In this embodiment, the method for calculating the execution command for the current node and judging whether the execution is completed is as follows: a first script execution command list is generated according to the script sequence in the node and saved in the script execution command table of the database, and the command number of the first script execution command list is added to the second script execution command list, and the second script execution command list is cached; when the simulator requests to execute the script, the unexecuted commands under the simulator are queried from the script execution command table of the database to obtain the third script execution command list, and the fourth script execution command list to be executed by the simulator is calculated according to the serial number order of the script in the scene and the execution status of the previous script and returned to the simulator; the executed script command number is removed from the second script execution command list according to the execution result fed back by the simulator; and whether the execution of the script of the current node is completed is judged according to whether the second script execution command list is empty.

[0038] Based on the method of this embodiment, the attack nodes of the link are ordered, and the next node to be executed can be automatically determined according to the execution result of the previous node, so as to realize the correlation between the nodes. At the same time, the script execution in each node can be orderly, which can effectively realize the realistic simulation of hacker attacks.

[0039] In this embodiment, the user can formulate the attack link to be simulated according to the needs, and can import the attack link structure diagram of the simulation that has been executed, or draw the attack link structure diagram in the BAS system management center. The attack link structure diagram supports user-defined link nodes and the script set contained in each link node, and then submit the attack link structure diagram to the BAS system and save it to a relational database (such as MySQL).

[0040] like Figure 3 Taking the attack link structure diagram as an example, the simulated attack link consists of two elements: attack nodes and control nodes. The attack node corresponds to an attack stage of the simulated hacker attack. Each attack node can contain multiple scripts, each of which simulates a behavior set of the hacker attack. The control node is an enhanced attack node. The enhancement point is a formula that can set the corresponding control flag (Flag) at the node. Based on the formula and combined with the result set identified by the execution result of the script in the current node, the leaf node to be executed is calculated.

[0041] The attack link structure diagram is saved in a relational database, where the structure design of the scenario structure table that saves the link structure diagram data is shown in Table 1.

[0042]

[0043] Figure 3 After the attack link structure diagram shown is saved in the scenario structure table, the data is shown in Table 2.

[0044]

[0045] After the attack link structure diagram of the scenario is built or selected, the user can select multiple simulators (usually including at least one attacker simulator and one attacked simulator) to execute the scenario to create a simulated attack task. After the simulated attack task is created, manually click to trigger the task to start execution. The BAS system will Figure 4 The process shown starts executing the task.

[0046] Specifically, this embodiment uses Figure 3 The attack link structure diagram shown in the figure details the steps of the scheduling algorithm executed by the scenario script.

[0047] Step 1, first find the root node of the scene (that is, pid is null), and save the scene node id to the scene node trajectory table in the database to record the scene node trajectory of the current task execution. According to the script order in the node, combined with the simulators participating in the task, generate all the script execution command lists of the current node, that is, the first script execution command list, recorded as List1, and save it in the database script execution command table. At the same time, save the script execution command id of List1 in the cache (such as Redis), recorded as the second script execution command list List2, where the key is the task id and the value is List2.

[0048] Taking the information collection node in the above attack link structure diagram as an example, if the simulator executing this scenario has only one attacker simulator and one attacked simulator, the generated list List1 is shown in Table 3.

[0049]

[0050] Parameter explanation: Script execution command id: uniquely identifies the script execution command, self-incrementing and non-repeating; task id: uniquely identifies a task to be executed once; script id: uniquely identifies a simulated vulnerability attack; attacker simulator id: the simulator id that executes the script, that is, the simulated attack initiator; attacked simulator id: the simulator id that accepts the attack request when executing the script, that is, the target of the simulated attack; script type: identifies the type of attack simulated by the script, and the simulator selects the corresponding executor to execute the script according to the type; script parameters: parameter data required for the execution of the script; command status code: status identifier during the execution of the script, where 0: not executed, 1: executing, 2: execution completed; the serial number of the script in the scene: used to sort the scripts in the scene, combined with the scheduling control algorithm to ensure that the scripts can be executed in the order of the nodes.

[0051] According to the sample data of List1 above, the data of List2 stored in the cache can be obtained as shown in Table 4.

[0052]

[0053] Step 2: The simulator periodically polls the BAS system management center (e.g., once every 5 seconds) to obtain the script command to be executed by the simulator. At this time, the management center will calculate the script command to be executed by the simulator according to the scheduling control algorithm, so that the simulator can execute in sequence according to the script sequence number in the current node being executed. Figure 5 It is a flowchart that calculates the script that the simulator needs to execute based on the scheduling control algorithm. The specific steps are as follows:

[0054] Step 1) After receiving the simulator request, the management center queries the script execution command table for a list of all commands whose status is not executed (i.e., the status is 0) under the simulator, and obtains the third script execution command list, recorded as List3. List3 is sorted in ascending order according to the script execution command id.

[0055] Step 2) Determine whether List3 is an empty list. If List3 is an empty list, jump to step 10), otherwise jump to step 3).

[0056] Step 3) If List3 is not an empty list, traverse each script in List3 in turn to execute the command.

[0057] Step 4) Determine whether the current script execution command sequence number (denoted as n) is 1. If n is 1, jump to step 5), otherwise jump to step 6).

[0058] Step 5) If the serial number n of the current script execution command is 1, that is, the script is the first script in the scene, it is directly added to the command list to be executed by the simulator this time, that is, the fourth script execution command list (denoted as List4).

[0059] Step 6) If the current script execution command sequence number n is not 1, query the execution status of all script execution commands with sequence number n-1 under the task in the script execution command table, and determine whether the status of all script execution commands with sequence number n-1 are all completed (that is, the status code is 2). If the status codes of all script execution commands with sequence number n-1 are 2, jump to step 7), otherwise jump to step 8).

[0060] Step 7) If the status of all execution commands with serial number n-1 is completed, add the current script execution command to list List4, and then start traversing the next script execution command in list List3 (supporting one simulator to participate in the parallel execution of multiple scenario tasks at the same time).

[0061] Step 8) If the execution status of the command with serial number n-1 is not completed (that is, the status code is 0 or 1), it means that the script execution command with serial number n-1 has not been fully executed. Skip the script execution command with the current serial number n and traverse the next script execution command in List3.

[0062] Step 9) After the traversal of List3 is completed, the script execution command list List4 that the simulator requests to execute this time is obtained.

[0063] Step 10) If List3 is an empty list, it means that the simulator has no script execution command to be executed in this request, and List4 is also an empty list.

[0064] Step 11) determines whether list List4 is an empty list. If list List4 is an empty list, jump to step 13), otherwise jump to step 12).

[0065] Step 12) If List4 is not an empty list, update the status of each script execution command in List4 in the database command table to be in execution (ie, the status code is 1), and then return List4 as response data to the simulator.

[0066] Step 13) If List4 is an empty list, the simulator returns an empty list directly, indicating that the simulator has no script to execute.

[0067] Step 3, after the simulator obtains the list List4, it first determines whether the list List4 is empty. If it is empty, no processing is performed. Otherwise, each script execution command is executed in sequence according to the order in the list List4, and then the script execution result is returned to the management center.

[0068] Step 4: After the management center receives the script execution result sent back by the simulator, it parses the task id, script execution command id, and execution result identifier (i.e. 0: not intercepted, 1: blocked) in the result data, and uses the task id as the key to query the value from the cache Redis, i.e. the list List2 of all script execution commands for the node where the task is being executed, and then removes the script execution command id corresponding to this result from the list List2, saves the execution result identifier to the database result table, and updates the script execution command status to completed (i.e. the status code is 2) in the script execution command table. In this way, when the results corresponding to the execution commands of all scripts in the scene node executed this time are all sent back to the management center, the list List2 corresponding to the task id saved in the cache Redis is an empty list.

[0069] Taking the attacker simulator with simulator id M41pVqr5x26ngPOKEi0vZ obtaining the script execution command with script execution command id 1 as an example, the script execution result generated by the execution is saved in the script execution result table. The table structure is shown in Table 5.

[0070]

[0071] Parameter explanation: Result id: uniquely identifies the result of a script execution, self-incrementing and non-repeating; Script execution command id: uniquely identifies the script execution command for this time, used to remove the script execution command from the list List2; Task id: uniquely identifies a task executed once; Script id: uniquely identifies a simulated vulnerability attack; Attacker simulator id: The id of the simulator that executes the script, that is, the initiator of the simulated attack; Attacked simulator id: The id of the simulator that receives the attack request when executing the script, that is, the target of the simulated attack; Script execution result: The execution result of the script, where 0: not intercepted, 1: blocked, used to calculate the actual control variable Flag value.

[0072] Step 5, determine whether List2 is empty. If List2 is empty, jump to Step 6; otherwise, jump to Step 9.

[0073] Step 6, if the list List2 is empty, it means that all the script execution commands of the scene node being executed by the current task have been executed. According to the saved scene node execution trajectory of the task, the id of the scene node currently being executed can be obtained. The scene node id is used as the parent node pid parameter. In the scene structure table, find out whether there is a leaf node with the scene node id as the parent node. If there is a leaf node, jump to step 7, otherwise jump to step 10.

[0074] Step 7: If the leaf node exists, determine whether the current node is a control node. If it is a control node (i.e., the node has a control Flag formula), jump to step 8; otherwise, the node only has one leaf node, which is the scene node to be executed, and then jump to step 1 to generate the script execution command for the node and repeat the process.

[0075] Step 8, if the current node is a control node, the actual control variable Flag value can be calculated according to the control Flag formula set on the current node and the script execution result identification list of the current node, and the node with the preset Flag value and the actual Flag value equal to the leaf node is taken out. This node is the node to be executed in the next step, and the node id is saved in the scene node execution trajectory table. Then jump to step 1 to generate the script execution command for the node and repeat the process.

[0076] Step 9, if List2 is not an empty list, it means that the script execution command in the scene node has not been executed, and the response data returned to the simulator is an empty list.

[0077] Step 10: If there is no leaf node, it means that all nodes in the scene have been executed, and the simulator response returned is an empty list, and the task execution is completed.

[0078] In this embodiment, in step 2, when the simulator obtains the script execution command from the management center, it uses the simulator to initiate a request through periodic polling. In some embodiments, a message queue middleware (such as RabbitMQ, RocketMQ, Kafka, ActiveMQ, etc.) can also be used to achieve the purpose of the simulator obtaining the script execution command, and the management center actively pushes List4 to the simulator through the message queue middleware.

[0079] In this embodiment, Figure 3 The control Flag formula in Table 1 is two leaf nodes. When constructing the control node of the link structure diagram, the scheme shown in the figure only draws two leaf nodes for simple expression. The control Flag formula can use simple all or one logical operations. It can be understood that in some embodiments, multiple leaf nodes can be supported by setting a reasonable control Flag formula and a preset Flag value of the corresponding node, that is, the actual control variable Flag calculated according to the control Flag formula and the script execution command only matches the unique corresponding preset Flag value. For the case of multi-leaf (three or more) nodes with complex logic, the user's configuration can be verified to determine whether the Flag formula and the preset value are reasonable. For example, setting a reasonable control Flag formula must meet the following conditions: using the script execution result set as the input parameter, there is no intersection between all the results calculated by the control Flag formula, and the union of all the results is the full set, that is, according to the formula, one and only one leaf node can be obtained.

[0080] For example, there are three leaf nodes under the root node. A simple mathematical formula can be constructed as a control Flag formula. The formula is based on modulus operation (remainder operation) to ensure that there are only three possible results, f(x) = x mod 3; where x is an input parameter, such as the number of blocked script execution results in the root node, and f(x) is the result calculated according to the formula, that is, the actual control variable Flag value. The preset Flag values ​​of the three leaf nodes must be 0, 1, and 2. In actual use, the control Flag formula of multiple leaf nodes is set according to business needs.

[0081] Based on the same inventive concept, an embodiment of the present invention discloses a scenario script scheduling system for BAS, comprising: a graph structure storage module, for saving a simulated attack link structure diagram formulated by a user, wherein the structure diagram includes attack nodes and control nodes; and a scheduling module, for starting execution from the root node of the scenario when executing a simulated attack task, and sequentially saving the current node to the scenario node trajectory table; for the current node, generating a first scenario execution command list according to the sequence of the scripts in the node and saving it to the script execution command table of the database, and adding the command number of the first script execution command list to the second script execution command list, and caching the second script execution command list; when the simulator requests to execute the script, querying the script execution command table in the database for commands that have not been executed under the simulator to obtain a third script execution command list, and scheduling the script according to the sequence number sequence of the scripts in the scenario and the sequence of the previous script. This execution situation calculates the fourth script execution command list to be executed by the simulator and returns it to the simulator; removes the executed script command number from the second script execution command list based on the execution result fed back by the simulator; determines whether the current node script has been executed based on whether the second script execution command list is empty; after the current node script is executed, determines the current node according to the scene node trajectory table, if the current node is a control node, calculates the actual control identification value according to the set control identification formula and the script execution result identification list of the current node, and finds the leaf node with the preset control identification value and the actual control identification value equal to the node to be executed next; if the current node has only one leaf node, then the leaf node is the node to be executed next; saves the leaf node to the scene node trajectory table, and repeats the script execution process of the node; if the current node has no leaf node, the simulated attack task execution is completed.

[0082] Based on the same inventive concept, an embodiment of the present invention discloses a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of a scene script scheduling method for BAS.

Claims

1. A scenario script scheduling method for BAS, characterized in that: The steps include: The simulated attack link structure diagram formulated by the user is saved, and the structure diagram includes attack nodes and control nodes; the control node is provided with a formula for calculating the control identifier, and the leaf node to be executed is determined according to the formula combined with the execution result of the script in the node; When executing the simulated attack task, start from the root node of the scene and save the current node in the scene node trajectory table in order; For the current node, generate a first script execution command list according to the script sequence in the node and save it to the script execution command table of the database, and at the same time add the command number of the first script execution command list to the second script execution command list, and cache the second script execution command list; When the simulator requests to execute a script, the script execution command table in the database is queried for commands that have not been executed by the simulator to obtain a third script execution command list, and the fourth script execution command list to be executed by the simulator is calculated based on the sequence number order of the script in the scene and the execution status of the previous script and returned to the simulator; Remove the executed script command number from the second script execution command list according to the execution result fed back by the simulator; Determine whether the current node script has been executed based on whether the second script execution command list is empty; After the current node script is executed, the current node is determined according to the scene node trajectory table. If the current node is a control node, the actual control identifier value is calculated according to the set control identifier formula and the script execution result identifier list of the current node, and the leaf node with the preset control identifier value and the actual control identifier value equal is found as the node to be executed next; If the current node has only one leaf node, then the leaf node is the node to be executed next; save the leaf node to the scene node trajectory table, and repeat the script execution process of the node; If the current node has no leaf node, the simulated attack task execution ends.

2. A scenario script scheduling method for BAS according to claim 1, characterized in that: The attack link structure diagram is saved in the scenario structure table of the database, and the attributes of the scenario structure table include scenario number, node number, parent node number, node name, node-associated script list, preset control identification value and control identification value calculation formula.

3. A scenario script scheduling method for BAS according to claim 1, characterized in that: Each script execution command in the script execution command list includes a number, a task number, a script number, an attacker simulator number, an attacked simulator number, script parameters, a command status code, and a serial number of the script in the scenario.

4. A scenario script scheduling method for BAS according to claim 1, characterized in that: The method of calculating the fourth script execution command list to be executed by the simulator according to the sequence number order of the scripts in the scene and the execution status of the previous script and returning it to the simulator includes: Traverse each script execution command in the third script execution command list; If the sequence number of the current script execution command is 1, it is directly added to the fourth script execution command list; otherwise, the execution status of all script execution commands with the previous sequence number of the current script execution command under the current task is queried in the script execution command table. If all are completed, the current script execution command is added to the fourth script execution command list. If there are unfinished ones, the current script execution command is skipped; If the fourth script execution command list is not an empty list, then the status of each script execution command in the fourth script execution command list in the script execution command table of the database is updated to be in execution; The fourth script execution command list is returned to the simulator as response data.

5. A scenario script scheduling method for BAS according to claim 4, characterized in that: The second script execution command list is cached in a key-value format, where the key is the task number and the value is the second script execution command list.

6. A scenario script scheduling method for BAS according to claim 1, characterized in that: After the simulator returns the script execution result, the task number, script execution command number and execution result identifier in the result data are parsed, the script execution command number corresponding to this result is removed from the second script execution command list, the execution result identifier is saved in the database result table, and the script execution command status in the script execution command table is updated to completed.

7. A scenario script scheduling method for BAS according to claim 1, characterized in that: The simulator obtains the script execution command by initiating a request through periodic polling, or the management center actively pushes the fourth script execution command list to the simulator through the message queue middleware.

8. A scenario script scheduling method for BAS according to claim 1, characterized in that: The logical formula for calculating the control flag includes: if all script execution commands in the node are successfully executed, it is recorded as yes, otherwise it is recorded as no; or, if there is a script execution command in the node with a successful result, it is recorded as yes, otherwise it is recorded as no.

9. A scenario script scheduling system for BAS, characterized in that: include: A graph structure storage module, used to store a simulated attack link structure graph prepared by a user, wherein the structure graph includes attack nodes and control nodes; The control node is provided with a formula for calculating the control identifier, and the leaf node to be executed is determined according to the formula combined with the execution result of the script in the node; and a scheduling module, which is used to start execution from the root node of the scene when executing a simulated attack task, and save the current node in the scene node trajectory table in sequence; for the current node, generate a first script execution command list according to the script sequence in the node and save it to the script execution command table of the database, and at the same time add the command number of the first script execution command list to the second script execution command list, and cache the second script execution command list; When the simulator requests to execute a script, the script execution command table in the database is queried for commands that have not been executed by the simulator to obtain a third script execution command list, and the fourth script execution command list to be executed by the simulator is calculated based on the sequence number order of the script in the scene and the execution status of the previous script and returned to the simulator; Remove the executed script command number from the second script execution command list according to the execution result fed back by the simulator; Determine whether the current node script has been executed based on whether the second script execution command list is empty; After the current node script is executed, the current node is determined according to the scene node trajectory table. If the current node is a control node, the actual control identifier value is calculated according to the set control identifier formula and the script execution result identifier list of the current node, and the leaf node with the preset control identifier value and the actual control identifier value equal is found as the node to be executed next; If the current node has only one leaf node, then the leaf node is the node to be executed next; save the leaf node to the scene node trajectory table, and repeat the script execution process of the node; If the current node has no leaf node, the simulated attack task execution ends.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of a scene script scheduling method for BAS according to any one of claims 1-8 are implemented.

Images