Test method and device, storage medium and electronic equipment

Abstract

The invention discloses a test method and device, a storage medium and electronic equipment, a server can take texts which are published by users of data sources on the data sources and record security problems existing in a network service system as reference texts, so that the security problems existing in the network service system can be tested on the basis of the reference texts. In the embodiment of the invention, the attack request for attacking vulnerabilities existing in the network security protection layer indicated in the reference text is generated, and the data protected by the network security protection layer is attacked through the generated attack request, so that the validity of the network security protection layer can be tested.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a testing method, device, storage medium and electronic device. Background Art

[0002] With the rapid development of Internet technology, the network service systems used by enterprises to provide network services to users have become an important platform for information exchange and resource sharing. However, network security issues have become increasingly prominent. Various network attacks, data leaks, malware and other forms of network security threats are emerging in an endless stream, which has had a great impact on the network security of network service systems of various business platforms.

[0003] Normally, enterprises can protect their network service systems through measures such as firewalls, host intrusion detection systems, and data loss prevention measures. However, as network attack methods become increasingly complex and covert, there are many reasons why the protection measures adopted by enterprises fail. As a result, when manually checking the effectiveness of the protection measures adopted, it is often impossible to discover anomalies in the protection measures in a timely manner, which may cause losses to the business platform.

[0004] Therefore, how to test the effectiveness of the protection measures used to protect the network service system is an urgent problem to be solved. Summary of the invention

[0005] This specification provides a testing method, device, storage medium and electronic device to partially solve the above problems existing in the prior art.

[0006] This manual adopts the following technical solutions:

[0007] This manual provides a test method, including:

[0008] receiving a test request for a target system;

[0009] According to the test request, determining data that needs to be protected in the target system as target data, and determining a network security protection layer for protecting the target data;

[0010] According to the predetermined keywords of each reference text, a reference text matching the target data is determined from the pre-acquired reference texts as the target reference text. For any reference text, the reference text records vulnerability information that causes the security problem recorded in the reference text.

[0011] Determine, according to the target reference text, the vulnerability type of the vulnerability existing in the network security protection layer when the target data is attacked, determine, according to the vulnerability type, a target attack strategy from various preset attack strategies, and generate an attack request for attacking the target data according to the target attack strategy;

[0012] The attack request is sent to the target system protected by the network security protection layer, and a response result of the target system to the attack request is obtained, so as to perform a test according to the response result.

[0013] Optionally, according to the test request, determining data to be protected in the target system as target data, and determining a network security protection layer for protecting the target data specifically includes:

[0014] According to the test request, determining data to be protected in the target system from a preset database as target data; and

[0015] The log data of each network security protection layer is obtained, and based on the log data, a network security protection layer for protecting the target data is determined.

[0016] Optionally, obtaining each reference text specifically includes:

[0017] determining at least one data source for generating a reference text;

[0018] Each reference text is obtained from the at least one data source.

[0019] Optionally, sending the attack request to the target system protected by the network security protection layer, and obtaining a response result of the target system to the attack request, so as to perform a test according to the response result, specifically includes:

[0020] Determining, according to the target reference text, a predicted response result of the target system to the attack request;

[0021] Sending the attack request to the target system protected by the network security protection layer, and obtaining a response result of the target system to the attack request;

[0022] The response result is matched with the predicted response result to obtain a matching result, so as to test the network security protection layer according to the matching result.

[0023] Optionally, the method further comprises:

[0024] If it cannot be determined whether the network security protection layer has a vulnerability according to the matching result, then determining a first candidate attack strategy from other attack strategies except the target attack strategy;

[0025] According to the first candidate attack strategy, an attack request for attacking the target data is regenerated, and the target system is tested based on the regenerated attack request.

[0026] Optionally, the method further comprises:

[0027] If it cannot be determined whether the network security protection layer has a vulnerability according to the matching result, determining an associated text associated with the target reference text;

[0028] A second candidate attack strategy is determined according to the associated text, and an attack request for attacking the target data is regenerated according to the second candidate attack strategy, and the target system is tested based on the regenerated attack request.

[0029] Optionally, the method further comprises:

[0030] If it is determined that the network security protection layer has a vulnerability according to the matching result, then obtaining various record data of the target system, wherein the various record data include: log data of the target system, administrator operation records of the target system, alarm rule configuration data of the target system, and configuration data of the network security protection layer;

[0031] For each type of recorded data, a detection strategy matching the recorded data is determined from the preset detection strategies as the detection strategy corresponding to the recorded data, and anomaly detection is performed on the recorded data using the detection strategy corresponding to the recorded data to obtain a detection result of whether the recorded data has an anomaly.

[0032] This specification provides a testing device, including:

[0033] A receiving module, used for receiving a test request for a target system;

[0034] A first determination module is used to determine, according to the test request, data that needs to be protected in the target system as target data, and to determine a network security protection layer for protecting the target data;

[0035] A second determination module is used to determine, according to the predetermined keywords of each reference text, a reference text matching the target data from the pre-acquired reference texts as the target reference text, and for any reference text, the reference text records vulnerability information that causes the security problem recorded in the reference text;

[0036] A generating module, used to determine, based on the target reference text, the vulnerability type of the vulnerability existing in the network security protection layer when the target data is attacked, determine a target attack strategy from preset attack strategies based on the vulnerability type, and generate an attack request for attacking the target data based on the target attack strategy;

[0037] The test module is used to send the attack request to the target system protected by the network security protection layer, and obtain the response result of the target system to the attack request, so as to perform a test according to the response result.

[0038] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects:

[0039] In the test method provided in the present specification, a test request for a target system is received, and according to the test request, data that needs to be protected in the target system is determined as target data, and a network security protection layer for protecting the target data is determined, and according to the predetermined keywords of each reference text, a reference text matching the target data is determined from the pre-acquired reference texts as the target reference text, and for any reference text, the reference text records vulnerability information that causes the security problem recorded in the reference text, and according to the target reference text, the vulnerability type of the vulnerability existing in the network security protection layer when the target data is attacked is determined, and according to the vulnerability type, a target attack strategy is determined from the preset attack strategies, and according to the target attack strategy, an attack request for attacking the target data is generated, the attack request is sent to the target system protected by the network security protection layer, and the response result of the target system to the attack request is obtained, so as to perform the test according to the response result.

[0040] It can be seen from the above method that the server can use the text that records the security issues existing in the network service system and is publicly available on each data source by the users of each data source as a reference text, so that based on the reference text, it can generate an attack request for attacking the vulnerabilities existing in the network security protection layer pointed out in the reference text, and attack the data protected by the network security protection layer through the generated attack request, thereby testing the effectiveness of the network security protection layer. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The illustrative embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification. In the drawings:

[0042] Figure 1 A flow chart of a test method provided in this specification;

[0043] Figure 2 A schematic diagram of the process of generating an attack request provided in this specification;

[0044] Figure 3 A schematic diagram of the anomaly detection process provided in this specification;

[0045] Figure 4 A schematic diagram of a test device provided for this specification;

[0046] Figure 5 A method corresponding to the Figure 1 Schematic diagram of electronic equipment. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0048] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0049] At present, in the field of network security, various enterprises have invested a lot of resources to implement various security protection measures to protect the network service systems that provide network services to users. For example, Web Application Firewall (WAF), Firewall (FW), Host-based Intrusion Detection System (HIDS), Data Loss Prevention (DLP), Intrusion Detection System (IDS) and honeypots are implemented to protect network service systems.

[0050] However, since the above-mentioned protection measures may become abnormal due to attacks during operation, enterprises usually collect event logs generated by various protection measures and hand them over to security managers for manual investigation. However, after checking the event logs generated by various protection measures, if the security managers do not see any alarms, it is difficult to determine whether there is no attack resulting in no alarms for the protection measures, or there is an attack but it has not been discovered by the protection measures, resulting in no alarms. As a result, it is difficult to determine the effectiveness of the protection measures in a timely manner, which may cause losses to the enterprises. Therefore, it is particularly important to test the effectiveness of the protection measures adopted by the network service system of the business platform.

[0051] Figure 1 A flow chart of a test method provided in this specification includes the following steps:

[0052] S101: receiving a test request for a target system.

[0053] S102: According to the test request, determine the data that needs to be protected in the target system as target data, and determine a network security protection layer for protecting the target data.

[0054] In this specification, the business platform may receive a test request sent by a user for a target system, and then, in response to the received test request, may test various network security protection layers deployed in the target system for protecting the target system.

[0055] Specifically, after receiving a test request for the target system sent by the user, the business platform can determine the data that needs to be protected in the target system from a preset database based on the received test request, as the target data, and obtain the log data of each network security protection layer, and determine the network security protection layer used to protect the target data based on the obtained log data of each network security protection layer.

[0056] Among them, the above-mentioned target system can be a network service system specified by the user. The network service system here refers to a system that provides specified business services or applications to users in a network environment, and provides data exchange, resource sharing, communication and management functions for the devices used by users that are deployed with clients provided by the business platform. The above-mentioned network service system can be composed of a series of software components running in a network environment (such as: Linux, Windows and other operating systems, Web server software, mail server software and other server software, message queues, cache systems and other middleware) and hardware components (such as: servers, routers, switches, terminal devices, etc.).

[0057] There may be multiple network security protection layers mentioned above. For each network security protection layer, the protection measures adopted by the network security protection layer are different from those adopted by other network security protection layers. The protection measures here may be products used to protect network service systems from various security threats, such as: Web application firewalls, firewalls, host-based intrusion detection systems, data loss protection, intrusion detection systems and honeypots, etc.

[0058] The above-mentioned preset database can be used to store and manage all configuration data of the network service system, for example: Configuration Management Database (CMDB).

[0059] The above-mentioned configuration data may refer to detailed information on physical resources and virtual resources that the enterprise needs to use in the process of providing business services, such as: the IP address, domain name, service port of the network service, the status of the network service, the security of the network service, the server model, the identification data of the manufacturer of the server, the hardware configuration data of the server, the location data of the server, the configuration data of the disk array of the storage device, the configuration data of the router of the network device, the configuration data of the switch of the network device, the configuration data of the firewall of the network device, the wireless access point information of the network device, etc.

[0060] The data that needs to be protected in the target system mentioned above may refer to at least one of the configuration data mentioned above.

[0061] It should be noted that the log data of the above-mentioned network security protection layer and the configuration data of the target system only record the data of a single party. Therefore, it is necessary to combine the log data of the network security protection layer to determine the network security protection layer for protecting the target data. For ease of understanding, the following takes the above-mentioned network security protection layer as an example of a firewall to explain in detail the reasons why it is necessary to combine the log data of the network security protection layer to determine the network security protection layer for protecting the target data.

[0062] Specifically, the configuration data of the target system is usually static (i.e., it does not change for a period of time after the user configures it). It reflects how the target system is configured at a certain moment, but cannot reflect the dynamic changes of the target system during operation, such as: the opening and closing of temporary services, or the allocation of dynamic IP addresses.

[0063] Therefore, when determining the network security protection layer for protecting target data, it is necessary to determine it based on the log data of the network security protection layer.

[0064] Of course, the business platform can also directly receive user test requests for a certain protection measure, so as to obtain the log data generated by the protection measure, and then determine the data protected by the protection measure in the target system as the target data based on the obtained log data of the protection measure and the various configuration parameters of the target system, and attack the target data to test the protection measure.

[0065] In this specification, the execution entity used to implement the test method may refer to a designated device such as a server set up on a business platform, or may refer to a terminal device such as a desktop computer or a laptop computer. For the sake of ease of description, the test method provided in this specification is described below using the server as the execution entity as an example.

[0066] S103: According to the pre-determined keywords of each reference text, a reference text matching the target data is determined from the pre-acquired reference texts as the target reference text. For any reference text, the reference text records vulnerability information that causes the security problem recorded in the reference text.

[0067] In this specification, the server can determine at least one data source and obtain each reference text from the determined at least one data source, and then can determine the reference text that matches the target data from the obtained reference texts based on the predetermined keywords of each reference text as the target reference text.

[0068] The above data source is used to generate reference text, and the above data source may be, for example, a security forum, Github or other websites.

[0069] The method for the server to determine the above data source may be to determine each data source according to a preset data source configuration file, where the data source configuration file may include the website address of each data source.

[0070] The method for the server to obtain each reference text from the above data sources may be to use a preset network crawler to obtain from each data source the texts uploaded by other users to each data source, so as to use the texts disclosed in each data source as each reference text.

[0071] The server determines a reference text matching the target data from the pre-acquired reference texts according to the pre-determined keywords of each reference text. There are many methods for using the target reference text.

[0072] For example, the server may determine, from the keywords of each predetermined reference text, a reference text containing keywords consistent with the target data as the reference text matching the target data.

[0073] For another example: the server can also input the target data and the predetermined keywords of each reference text into a preset matching model, so as to determine the correlation between the target data and the keywords of each reference text through the preset matching model, as the corresponding correlation of the reference text, and then determine the reference text whose corresponding correlation exceeds the preset correlation threshold from each reference text as the reference text matching the target data.

[0074] In the above content, the method for the server to determine the keywords of each reference text is to input the reference text into a preset large language model for each reference text, so as to perform semantic analysis on the reference text through the preset large language model to determine at least one keyword contained in the reference text.

[0075] The above keywords can be used to characterize the data that needs to be protected (such as data name, component to which the data belongs, etc.), vulnerability types (such as buffer overflow, code injection, cross-site scripting, authentication issues, weak passwords, open ports, web attacks, etc.), and protective measures involved in the security issues contained in the reference text.

[0076] It should be noted that, for any reference text, the reference text records at least one security issue for the network service system and records vulnerability information causing the above security issue.

[0077] For example, the reference text records that the database of the network service system has a security problem of being deceived into performing unauthorized operations. The vulnerability is that the attacker inserts a special character sequence such as "OR 1=1" in the input field used to generate the query statement, thereby circumventing the rights review mechanism of the network service system (for example, when the network service system concatenates the string input by the user into the SQL query statement, the normal SQL query statement should be SELECT*FROM users WHEREusername='admin', where admin is the administrator account. The network service system will conduct rights review on admin. However, the attacker inserts the above special character sequence, so that the SQL query statement to be executed by the network service system becomes SELECT*FROM users WHERE username='admin'OR'a'='a', that is, through the OR field, the statement WHERE username='admin' in the SQL query statement to be executed, which was originally used to review the visitor's rights, is bypassed, so that the database mistakenly executes the SQL query statement of the attacker who does not have access rights, and displays the saved data to the attacker), thereby causing the data contained in the database to be obtained by the attacker who does not have access rights, thereby causing data leakage.

[0078] S104: Determine, based on the target reference text, the vulnerability type of the vulnerability existing in the network security protection layer when the target data is attacked, determine, based on the vulnerability type, a target attack strategy from various preset attack strategies, and generate an attack request for attacking the target data based on the target attack strategy.

[0079] From the above content, it can be seen that the server can obtain reference texts of possible security issues and vulnerability information that may cause the above security issues in the network service system disclosed by other users from multiple data sources, so that the vulnerability type of the vulnerability that exists in the network security protection layer when the target data is attacked can be determined according to the target reference text in each reference text, and then the target attack strategy can be determined from the preset attack strategies, and the attack request for attacking the target data can be generated according to the target attack strategy. Figure 2 shown.

[0080] Figure 2 The following is a schematic diagram of the process of generating the attack request provided in this specification.

[0081] Combination Figure 2 It can be seen that after the server determines the vulnerability type of the vulnerability existing in the network security protection layer when the target data is attacked based on the target reference text, it can determine the attack strategy for attacking the above vulnerability type from the preset attack strategies according to the vulnerability type of the vulnerability existing in the network security protection layer when the target data is attacked, as the target attack strategy.

[0082] The above-mentioned attack strategy can be a method of attacking different vulnerabilities that is determined in advance based on various historical reference texts and saved in the database. For example: through a preset SQL statement template, an SQL query statement containing a specific character sequence is constructed and input into the target system to try to bypass the input verification mechanism of the network security protection layer that protects the target system, and directly query, modify, and perform other operations on the data in the database of the target system to attack the target data. The execution request for the SQL query statement containing the specific character sequence here is the above-mentioned attack request.

[0083] For another example, an attack script is generated according to a preset script template, and the attack script is run on a website provided by the target system for user use to conduct a phishing attack on target data. The request to run the attack script is the above-mentioned attack request.

[0084] S105: Send the attack request to the target system protected by the network security protection layer, and obtain a response result of the target system to the attack request, so as to perform a test according to the response result.

[0085] In this specification, the server can send the generated attack request to the target system protected by the network security protection layer, and obtain the response result of the target system to the attack request, so as to determine the effectiveness of the network security protection layer according to the response result.

[0086] Specifically, the server can determine the predicted response result of the target system to the attack request based on the target reference text. For example, the predicted response result of the target system's request to run a SQL query statement containing a specific character sequence is determined based on the target reference text to be a data query result or data modification result returned after executing the request to run the SQL query statement containing the specific character sequence to query, modify, or perform other operations on data in the target system's database.

[0087] Furthermore, the server can send an attack request to a target system protected by a network security protection layer, and obtain a response result of the target system to the attack request, match the response result with the predicted response result, and obtain a matching result, so as to test the network security protection layer according to the matching result.

[0088] Specifically, if the server determines that the response result is consistent with the predicted response result, the server can determine that the response result matches the predicted response result, and further determine whether there is a vulnerability in the network security protection layer that protects the data that needs to be protected in the target system.

[0089] Of course, the server can also input the response result and the predicted response result into a preset test model to determine the similarity between the response result and the predicted response result through the preset test model, and determine the confidence level of whether the network security protection layer for protecting the data that needs to be protected in the target system is effective based on the similarity between the response result and the predicted response result. When the confidence level of determining whether the network security protection layer for protecting the data that needs to be protected in the target system is effective is lower than a preset threshold, it can be determined that there is a loophole in the network security protection layer for protecting the data that needs to be protected in the target system. The higher the similarity between the response result and the predicted response result, the lower the confidence level of whether the network security protection layer for protecting the data that needs to be protected in the target system is effective.

[0090] Furthermore, if the server cannot determine whether there is a vulnerability in the network security protection layer based on the matching results, it will determine a first candidate attack strategy from other attack strategies except the target attack strategy, and then regenerate an attack request for attacking the target data based on the first candidate attack strategy, and test the target system based on the regenerated attack request.

[0091] Among them, there are two situations in which the server cannot determine whether there is a vulnerability in the network security protection layer based on the matching result. The first is when the server determines that the response result is inconsistent with the predicted response result, and the server determines based on the log data of the network security protection layer that the network security protection layer has not intercepted, then the server cannot determine whether there is a vulnerability in the network security protection layer based on the matching result. The second is when the server determines that the confidence level of whether the network security protection layer for protecting the data to be protected in the target system is effective is lower than a preset threshold, and the server determines based on the log data of the network security protection layer that the network security protection layer has not intercepted, then the server cannot determine whether there is a vulnerability in the network security protection layer based on the matching result.

[0092] In addition, if the server cannot determine whether there is a vulnerability in the network security protection layer based on the matching results, it can also determine the associated text associated with the target reference text, and then determine the second candidate attack strategy based on the associated text, and regenerate the attack request for attacking the target data based on the second candidate attack strategy, and test the target system based on the regenerated attack request.

[0093] In actual application scenarios, the reasons for the failure of the network security protection layer are not only the existence of loopholes in the network security protection layer itself, but also the administrator's misoperation or incorrect configuration of alarm rules.

[0094] Based on this, if the server determines that there is a loophole in the network security protection layer based on the matching results, the server can obtain the record data of the target system and perform anomaly detection on each record data to determine whether there is an anomaly in each record data. Figure 3 shown.

[0095] Figure 3 A schematic diagram of the anomaly detection process provided in this specification.

[0096] Combination Figure 3 It can be seen that if the server determines that there is a loophole in the network security protection layer based on the matching results, the server can obtain the various record data of the target system, and for each type of record data, determine the detection strategy that matches the record data from the preset detection strategies as the detection strategy corresponding to the record data, and perform anomaly detection on the record data through the detection strategy corresponding to the record data to obtain the detection result of whether the record data has an anomaly.

[0097] The above-mentioned record data include: log data of the target system, administrator operation records of the target system, alarm rule configuration data of the target system, configuration data of the network security protection layer, etc.

[0098] The above detection strategy can be set according to actual needs. For example, for the log data of the target system, it can be determined whether the state of the target system is abnormal (such as whether the target system is in a closed, error, warning, etc. state) based on the log data of the target system. If so, it is determined that there is an abnormality in the log data of the target system.

[0099] As another example, for the administrator's operation records of the target system, the operation time of each operation performed by the administrator can be determined based on the administrator's operation records, and based on the difference between the operation time of each operation performed by the administrator and the sending time of the attack request to the target system protected by the network security protection layer, it can be determined that there is an abnormality in the administrator's operation record (for example, if the administrator performs operations such as permission change, system update and maintenance, and configuration file editing shortly before the sending time of the attack request to the target system protected by the network security protection layer, it may be due to the operation performed by the administrator that caused the network security protection layer to fail, so it can be considered that the operation performed by the administrator is abnormal).

[0100] In addition, the server may also input each record data of the target system into a preset detection model to obtain a detection result of whether there is an abnormality in the record data through the preset detection model.

[0101] From the above content, it can be seen that the server can use the text that records the security issues existing in the network service system publicly published by the users of each data source on each data source as a reference text, so that based on the reference text, it can generate an attack request for attacking the vulnerabilities existing in the network security protection layer pointed out in the reference text, and attack the data protected by the network security protection layer through the generated attack request, thereby testing the effectiveness of the network security protection layer.

[0102] The above are one or more implementation test methods of this specification. Based on the same idea, this specification also provides corresponding test devices, such as Figure 4 shown.

[0103] Figure 4 A schematic diagram of a test device provided for this specification includes:

[0104] The receiving module 401 is used to receive a test request for a target system;

[0105] A first determination module 402 is used to determine, according to the test request, data that needs to be protected in the target system as target data, and to determine a network security protection layer for protecting the target data;

[0106] The second determination module 403 is used to determine, according to the predetermined keywords of each reference text, a reference text matching the target data from the pre-acquired reference texts as the target reference text. For any reference text, the reference text records vulnerability information that causes the security problem recorded in the reference text;

[0107] A generating module 404 is used to determine, based on the target reference text, the vulnerability type of the vulnerability existing in the network security protection layer when the target data is attacked, determine a target attack strategy from preset attack strategies based on the vulnerability type, and generate an attack request for attacking the target data based on the target attack strategy;

[0108] The test module 405 is used to send the attack request to the target system protected by the network security protection layer, and obtain the response result of the target system to the attack request, so as to perform a test according to the response result.

[0109] Optionally, the first determination module 402 is specifically used to determine, according to the test request, the data that needs to be protected in the target system from a preset database as target data; and to obtain log data of each network security protection layer, and determine, based on the log data, the network security protection layer used to protect the target data.

[0110] Optionally, the second determination module 403 is specifically configured to determine at least one data source, where the data source is used to generate reference texts; and obtain each reference text from the at least one data source.

[0111] Optionally, the first test module 405 is specifically used to determine the predicted response result of the target system to the attack request based on the target reference text; send the attack request to the target system protected by the network security protection layer, and obtain the response result of the target system to the attack request; match the response result with the predicted response result to obtain a matching result, so as to test the network security protection layer according to the matching result.

[0112] Optionally, the test module 405 is specifically used to, if it cannot be determined whether the network security protection layer has a vulnerability based on the matching result, determine a first candidate attack strategy from other attack strategies except the target attack strategy; based on the first candidate attack strategy, regenerate an attack request for attacking the target data, and test the target system based on the regenerated attack request.

[0113] Optionally, the test module 405 is specifically used to, if it cannot be determined whether the network security protection layer has a vulnerability based on the matching result, determine the associated text associated with the target reference text; determine a second candidate attack strategy based on the associated text, and regenerate an attack request for attacking the target data based on the second candidate attack strategy, and test the target system based on the regenerated attack request.

[0114] Optionally, the test module 405 is specifically used to, if it is determined that there is a vulnerability in the network security protection layer based on the matching result, obtain various record data of the target system, and the various record data include: log data of the target system, administrator operation records of the target system, alarm rule configuration data of the target system, and configuration data of the network security protection layer; for each type of record data, determine a detection strategy that matches the record data from preset detection strategies as the detection strategy corresponding to the record data, and perform anomaly detection on the record data through the detection strategy corresponding to the record data to obtain a detection result of whether there is an anomaly in the record data.

[0115] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 A test method is provided.

[0116] This manual also provides Figure 5 The one shown corresponds to Figure 1 A schematic diagram of the electronic device. Figure 5 As mentioned above, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 Of course, in addition to the software implementation, this specification does not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0117] For the improvement of a technology, it can be clearly distinguished whether it is a hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or a software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0118] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0119] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0120] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0121] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0122] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0123] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0124] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0125] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0126] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0127] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0128] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0129] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0131] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0132] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A testing method, characterized in that: include: receiving a test request for a target system; According to the test request, determining data that needs to be protected in the target system as target data, and determining a network security protection layer for protecting the target data; According to the predetermined keywords of each reference text, a reference text matching the target data is determined from the pre-acquired reference texts as the target reference text. For any reference text, the reference text records vulnerability information that causes the security problem recorded in the reference text. Determine, according to the target reference text, the vulnerability type of the vulnerability existing in the network security protection layer when the target data is attacked, determine, according to the vulnerability type, a target attack strategy from various preset attack strategies, and generate an attack request for attacking the target data according to the target attack strategy; The attack request is sent to the target system protected by the network security protection layer, and a response result of the target system to the attack request is obtained, so as to perform a test according to the response result.

2. The method according to claim 1, characterized in that According to the test request, determining data to be protected in the target system as target data, and determining a network security protection layer for protecting the target data, specifically including: According to the test request, determining data to be protected in the target system from a preset database as target data; and The log data of each network security protection layer is obtained, and based on the log data, a network security protection layer for protecting the target data is determined.

3. The method according to claim 1, characterized in that Get reference texts, including: determining at least one data source for generating a reference text; Each reference text is obtained from the at least one data source.

4. The method according to claim 1, characterized in that Sending the attack request to the target system protected by the network security protection layer, and obtaining a response result of the target system to the attack request, so as to perform a test according to the response result, specifically includes: Determining, according to the target reference text, a predicted response result of the target system to the attack request; Sending the attack request to the target system protected by the network security protection layer, and obtaining a response result of the target system to the attack request; The response result is matched with the predicted response result to obtain a matching result, so as to test the network security protection layer according to the matching result.

5. The method according to claim 4, characterized in that The method further comprises: If it cannot be determined whether the network security protection layer has a vulnerability according to the matching result, then determining a first candidate attack strategy from other attack strategies except the target attack strategy; According to the first candidate attack strategy, an attack request for attacking the target data is regenerated, and the target system is tested based on the regenerated attack request.

6. The method according to claim 4, characterized in that The method further comprises: If it cannot be determined whether the network security protection layer has a vulnerability according to the matching result, determining an associated text associated with the target reference text; A second candidate attack strategy is determined according to the associated text, and an attack request for attacking the target data is regenerated according to the second candidate attack strategy, and the target system is tested based on the regenerated attack request.

7. The method according to claim 4, characterized in that The method further comprises: If it is determined that the network security protection layer has a vulnerability according to the matching result, then obtaining various record data of the target system, wherein the various record data include: log data of the target system, administrator operation records of the target system, alarm rule configuration data of the target system, and configuration data of the network security protection layer; For each type of recorded data, a detection strategy matching the recorded data is determined from the preset detection strategies as the detection strategy corresponding to the recorded data, and anomaly detection is performed on the recorded data using the detection strategy corresponding to the recorded data to obtain a detection result of whether the recorded data has an anomaly.

8. A testing device, characterized in that: include: A receiving module, used for receiving a test request for a target system; A first determination module is used to determine, according to the test request, data that needs to be protected in the target system as target data, and to determine a network security protection layer for protecting the target data; A second determination module is used to determine, according to the predetermined keywords of each reference text, a reference text matching the target data from the pre-acquired reference texts as the target reference text, and for any reference text, the reference text records vulnerability information that causes the security problem recorded in the reference text; A generating module, used to determine, based on the target reference text, the vulnerability type of the vulnerability existing in the network security protection layer when the target data is attacked, determine a target attack strategy from preset attack strategies based on the vulnerability type, and generate an attack request for attacking the target data based on the target attack strategy; The test module is used to send the attack request to the target system protected by the network security protection layer, and obtain the response result of the target system to the attack request, so as to perform a test according to the response result.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

Images