A feedback-based attack simulation script sending optimization method and system

Abstract

The present invention discloses a method and system for optimizing the sending of attack simulation scripts based on feedback. The present invention features the scripts according to the vulnerability information, firstly selects a preset number or proportion of scripts from all the scripts according to the criterion of the greatest difference in script features for sending; then collects the script requests that have not been successfully blocked, and statistically obtains the script feature set H; among the original scripts that have not been sent, selects the scripts that completely match the specific features in the set H, and if the selected script does not exist, then degrades each feature in the set H and then matches to obtain the script to be sent. The present invention does not rely on target detection, and can dynamically adjust the scripts to be sent in the next round according to the feedback of the results of the previous round. On the basis of ensuring the coverage rate of script sending, it avoids the hardware consumption caused by sending the full amount of scripts and improves the verification efficiency.

Description

Technical Field

[0001] The present invention relates to a feedback-based attack simulation script sending optimization method and system, belonging to the technical field of computer software and network security. Background Art

[0002] The attack simulation system (BAS) can automatically and continuously verify the target network and promptly discover potential security risks in the network, which has attracted more and more attention. The attack simulation system consists of two parts: the server and the client. The server is deployed at the exit of the target network that needs to be verified, and the client is deployed in each subnet of the target network. The server will continue to send attack simulation scripts (i.e. verification data) to all clients, and judge whether the security strategy in this link is correct based on the feedback from the client.

[0003] In the actual deployment process, the target network that needs to be verified is often scanned and detected first to obtain specific information about the network. For example, the fingerprint information of key security equipment (firewalls, etc.) is sent in a targeted manner to simulate attack scenarios that match the device fingerprint. This method will bring the following problems: 1. The sent scenario depends on the detection results of the target network. For security reasons, equipment manufacturers generally block detection messages, resulting in detection failures; 2. In the event of detection failure, only the full verification scenario can be sent. Sending the full scenario will occupy more hardware resources (such as network bandwidth, system load, etc.), and require longer verification time and low verification efficiency. Summary of the invention

[0004] Purpose of the invention: In view of the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a feedback-based attack simulation script sending optimization method and system, so as to avoid the hardware consumption and time-consuming problems caused by the sending of the full script due to detection failure, and improve the verification efficiency.

[0005] Technical solution: To achieve the above-mentioned invention object, the present invention adopts the following technical solution:

[0006] A feedback-based attack simulation script sending optimization method, comprising:

[0007] Step 1, selecting a preset number or proportion of scripts from all scripts according to the criterion of the greatest difference in script features for sending; the script features are features marked according to vulnerability information;

[0008] Step 2: collect the script requests that failed to be blocked, and obtain the script feature set H by statistics;

[0009] Step 3: If the number of elements in set H is not zero and remains stable, stop sending the script and end the test process; otherwise, proceed to step 4;

[0010] Step 4: If all scripts have been sent, the test process ends; otherwise: among the original scripts that have not been sent, select a script that completely matches the specific features in the set H. If the selected script exists, send the selected script and go to step 2; otherwise, go to step 5;

[0011] Step 5, degenerate each feature in set H to obtain set H';

[0012] Step 6, select a script that completely matches the specific features in the set H' from the original scripts that have not been sent. If the selected script exists, send the selected script and proceed to step 2; otherwise, proceed to step 7;

[0013] Step 7, select a preset number or proportion of scripts from all original scripts that have not been sent according to the criterion of the greatest difference in script features to send, and go to step 2.

[0014] Preferably, the script feature differences are determined based on the number of different features between the scripts.

[0015] Preferably, the script feature is represented by a vector whose element values ​​are 0 or 1, the dimension of the vector is the preset number of vulnerability types, an element value of 1 indicates that the script involves vulnerabilities of the corresponding dimension, and an element value of 0 indicates that the script does not involve vulnerabilities of the corresponding dimension.

[0016] As a preference, for scripts C i and C j , feature difference value Diff i,j The calculation method is:

[0017] ;

[0018] in n is the characteristic dimension of the script, C ix and C jx Representation Dimension x The characteristic value of , ^ represents the XOR operation.

[0019] Preferably, in step 1 or step 7, a preset number or proportion of scripts are selected based on the criterion of maximum script feature difference, including: calculating the sum of the feature difference values ​​between each script and other scripts based on the feature difference value between every two scripts, as a numerical value for evaluating the feature difference of the script; sorting the scripts from large to small according to the numerical value, and selecting the scripts of the preset number or proportion in the front.

[0020] Preferably, in step 5, the operation of degrading the feature is to gradually remove the marking of the specific vulnerability in the feature to increase the probability of matching the original script that has not been sent with the degraded feature.

[0021] Preferably, in step 5, degenerating each feature in the set H to obtain the set H' comprises:

[0022] For a feature H in a set H i , the number of feature elements that are not 0 is recorded as a; where a feature element that is not 0 indicates a vulnerability corresponding to the position of the element involved in the script;

[0023] Sequentially assign b non-zero feature elements to 0 to obtain the degenerated new features. For b=1, each time H i A non-zero feature element in becomes 0, and a new feature is obtained; b takes values ​​from 1 to a-1, H i The new feature set obtained is denoted as H i ';

[0024] For all H in the set H i After degeneration, the new feature set obtained is recorded as H'.

[0025] A computer system includes a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor. When the computer program / instruction is executed by the processor, the steps of the feedback-based attack simulation script sending optimization method are implemented.

[0026] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the feedback-based attack simulation script sending optimization method are implemented.

[0027] A computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of a feedback-based attack simulation script sending optimization method.

[0028] Beneficial effect: Compared with the prior art, the present invention has the following advantages: the present invention sets vulnerability-related label information for the script, performs feature marking on the script, gradually matches the target according to the unblocked feature feedback, and dynamically adjusts the content of the script to be sent in the next round; thereby achieving the purpose of not needing to detect the target network in advance and the sending of the script not relying on the detection result of the target object, avoiding the influence of network detection failure on the decision to send the script; at the same time, by gradually degrading the feedback features, on the basis of ensuring the coverage of the script sending, the hardware consumption caused by the sending of the full script is avoided and the verification efficiency is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 The figure is a flow chart of a method according to an embodiment of the present invention.

[0030] Figure 2 This is a flow chart of feature set degradation in an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments.

[0032] like Figure 1 As shown, an attack simulation script sending optimization method based on feedback disclosed in an embodiment of the present invention mainly includes:

[0033] Step 1, selecting a preset number or proportion of scripts from all scripts according to the criterion of the greatest difference in script features for sending;

[0034] Step 2: collect the script requests that failed to be blocked, and obtain the script feature set H by statistics;

[0035] Step 3: If the number of elements in set H is not zero and remains stable, stop sending the script and end the test process; otherwise, proceed to step 4;

[0036] Step 4: If all scripts have been sent, the test process ends; otherwise: among the original scripts that have not been sent, select a script that completely matches the specific features in the set H. If the selected script exists, send the selected script and go to step 2; otherwise, go to step 5;

[0037] Step 5, degenerate each feature in set H to obtain set H';

[0038] Step 6, select a script that completely matches the specific features in the set H' from the original scripts that have not been sent. If the selected script exists, send the selected script and proceed to step 2; otherwise, proceed to step 7;

[0039] Step 7, select a preset number or proportion of scripts from all original scripts that have not been sent according to the criterion of the greatest difference in script features to send, and go to step 2.

[0040] In step 1, the script features are features marked according to vulnerability information. Specifically, all scripts are marked according to vulnerability information. For a specific script, the vulnerability information involved includes operating system and version, application software and version, service port, etc. Suppose the number of vulnerability types of each operating system, each application software, etc. involved in each script in the system is n, and the i-th script C i The encoded n features are recorded as C i =[Fi1 , F i2 ,..., F in ]. C i Each feature element in the feature vector does not necessarily have a value. For example, for a certain operating system vulnerability scenario, its application software feature may not exist. In this case, the application software related features are assigned a value of 0.

[0041] In this embodiment, the difference in script features is determined based on the number of different features between the scripts. C i and C j For example, the feature difference value Diff i,j express C i and C j The number of different features in is calculated as follows:

[0042] ;

[0043] in C ix and C jx Representation Dimension x The characteristic value of , ^ represents the XOR operation.

[0044] According to the feature difference values ​​between every two scripts, the sum of the feature difference values ​​between each script and other scripts is calculated as the value for evaluating the feature difference of the script. C i Differences in the original script Diff i It can be calculated by the following formula:

[0045] ;

[0046] Where T is the total number of original scripts currently in the system.

[0047] In step 1, K scripts with the largest differences are selected for sending. To speed up the convergence, K can be set as a percentage of the total number of scripts, such as K=T*2%; or it can be set as a certain number, such as K=10.

[0048] In step 2, the client collects the script requests that failed to be blocked and analyzes their features. The resulting feature set is recorded as H = {H 1 ,H 2 ,…,H x}, where x represents the number of scripts that failed to be blocked. Hi=[Hi1 , H i2 ,..., H in ], assuming H i Corresponds to C in the original script m , then H ik =C mk In step 3, if the number of elements in H is not 0 and is the same as H in the previous F rounds, it can be determined that the current script features match the target device, and the script sending is stopped and the test process ends. In practice, in order to reduce errors, F is generally not less than 2.

[0049] In step 4, it was not possible to find a match for a certain H in H. i When the feature completely matches the script, the operation of degrading the feature in step 5 is to gradually remove the mark of the specific vulnerability in the feature to increase the probability of matching the original script that has not been sent with the degraded feature. Figure 2 As shown, in this embodiment, the process of performing degenerate matching in the original script according to the feature set H is as follows:

[0050] For feature H i For b=1, the number of features that are not 0 is recorded as a. Sequentially assign b of the features that are not 0 to 0 to obtain the degraded new features. For b=1, each time H i A non-zero feature becomes 0, and a new feature is obtained; b takes values ​​from 1 to a-1, H i The new feature set obtained is denoted as H i '; For all H in H i After degeneration, the new feature set obtained is recorded as H'.

[0051] The degradation processing in this embodiment can improve the script matching efficiency. If a script that completely matches a feature in H' is still not found in step 6, Q scripts with the greatest differences are selected and sent in step 7 with reference to step 1, and the value of Q is the same as that of K.

[0052] An embodiment of the present invention also discloses a computer system, including a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor, wherein the computer program / instruction, when executed by the processor, implements the steps of the feedback-based attack simulation script sending optimization method.

[0053] An embodiment of the present invention also discloses a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the feedback-based attack simulation script sending optimization method are implemented.

[0054] An embodiment of the present invention also discloses a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the feedback-based attack simulation script sending optimization method.

Claims

1. A feedback-based attack simulation script sending optimization method, characterized in that: include: Step 1, selecting a preset number or proportion of scripts from all scripts according to the criterion of the greatest difference in script features for transmission; the script features are features marked according to vulnerability information; Step 2, collect the script requests that failed to be blocked, and obtain the script feature set H by statistics; Step 3: If the number of elements in set H is not zero and remains stable, stop sending the script and end the test process; Otherwise, go to step 4; Step 4: If all scripts have been sent, the test process ends; Otherwise: select a script that completely matches the specific features in set H from the original scripts that have not been sent. If the selected script exists, send the selected script and go to step 2; otherwise, go to step 5; Step 5, degenerate each feature in set H to obtain set H'; the operation of degenerating features is to gradually remove the mark of specific vulnerabilities in the features to increase the probability of matching the original script that has not been sent with the degraded features; including: For a feature H in a set H i , the number of feature elements that are not 0 is recorded as a; where a feature element that is not 0 indicates a vulnerability corresponding to the position of the element involved in the script; Sequentially assign the values ​​of b non-zero feature elements to 0 to obtain the degenerated new features. For b=1, each time H i A non-zero feature element in becomes 0, and a new feature is obtained; b takes values ​​from 1 to a-1, H i The new feature set obtained is denoted as H i '; For all H in the set H i After degeneration, the new feature set obtained is recorded as H'; Step 6, select a script that completely matches the specific features in the set H' from the original scripts that have not been sent. If the selected script exists, send the selected script and proceed to step 2; otherwise, proceed to step 7; Step 7, selecting a preset number or proportion of scripts from all original scripts that have not been sent according to the criterion of the greatest difference in script features to send, and then proceeding to step 2; In step 1 or step 7, a preset number or proportion of scripts are selected according to the criterion of maximum script feature difference, including: calculating the sum of the feature difference values ​​between each script and the other scripts according to the feature difference value between every two scripts, as a numerical value for evaluating the feature difference of the script; sorting the scripts from large to small according to the numerical value, and selecting the scripts of the preset number or proportion in front.

2. According to the feedback-based attack simulation script sending optimization method of claim 1, it is characterized in that: The script feature diversity is determined based on the number of different features between the scripts.

3. The attack simulation script sending optimization method based on feedback according to claim 1 is characterized in that: The script feature is represented by a vector whose element values ​​are 0 or 1, and the dimension of the vector is the number of preset vulnerability types. An element value of 1 indicates that the script involves vulnerabilities of the corresponding dimension, and an element value of 0 indicates that the script does not involve vulnerabilities of the corresponding dimension.

4. The attack simulation script sending optimization method based on feedback according to claim 3 is characterized in that: For the script C i and C j , feature difference value Diff i,j The calculation method is: ; in n is the characteristic dimension of the script, C ix and C jx Representation Dimension x The characteristic value of , ^ represents the exclusive OR operation.

5. A computer system comprising a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor, characterized in that: When the computer program / instructions are executed by a processor, the steps of a feedback-based attack simulation script sending optimization method according to any one of claims 1-4 are implemented.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of a feedback-based attack simulation script sending optimization method according to any one of claims 1-4 are implemented.

7. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of a feedback-based attack simulation script sending optimization method according to any one of claims 1-4 are implemented.

Images