Security test method and device, equipment and storage medium

Abstract

The invention discloses a safety test method, device and equipment and a storage medium, and the method comprises the steps: obtaining a to-be-tested connector based on a test instruction in response to the test instruction, obtaining to-be-tested leakage data according to the test instruction, constructing at least one candidate case based on the to-be-tested connector and the to-be-tested leakage data, and transmitting the at least one candidate case to a server; according to the candidate use case, carrying out security testing on a to-be-tested security device; according to the method, the to-be-tested connector and the to-be-tested leakage data are obtained based on the test instruction in response to the test instruction, and the at least one candidate case is constructed based on the to-be-tested connector and the to-be-tested leakage data, so that flexible and free arrangement of the test scheme is realized through a custom mode of the test case; and performing security testing on the to-be-tested security equipment according to the candidate use case, thereby testing the security equipment more flexibly, effectively verifying the security performance of the equipment, and greatly improving the security testing efficiency.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a security testing method, device, equipment and storage medium. Background Art

[0002] Data leakage can cause serious damage to a company's assets and reputation. Therefore, companies will deploy some data security equipment to prevent corporate data from being leaked to the outside or to issue an alarm when sensitive data is leaked to the outside. Data security equipment mainly detects whether there is a risk of data leakage by deploying equipment in multiple different areas of the company. There are many ways to leak data. At present, the security testing method is single and the test plan cannot be flexibly adjusted, resulting in the inability to effectively verify the security of anti-data leakage equipment. Summary of the invention

[0003] The main purpose of the present invention is to provide a security testing method, device, equipment and storage medium, aiming to solve the technical problem that the prior art cannot flexibly adjust the test scheme, resulting in the inability to effectively verify the security of the anti-data leakage device.

[0004] To achieve the above object, the present invention provides a safety testing method, which comprises the following steps:

[0005] In response to a test instruction, obtaining a connector to be tested based on the test instruction;

[0006] Acquire the leakage data to be tested according to the test instruction;

[0007] Construct at least one candidate use case based on the connector to be tested and the leakage data to be tested;

[0008] A security test is performed on the security device to be tested according to the candidate use cases.

[0009] Optionally, in response to a test instruction, acquiring a connector to be tested based on the test instruction includes:

[0010] In response to a test instruction, determining a connector source mode based on the test instruction;

[0011] If the connector source mode is the first connector source mode, determining the type of leakage path to be tested based on the test instruction;

[0012] Obtaining a connector target address according to the leakage path type to be tested;

[0013] A connector to be tested built into the system is acquired based on the connector target address.

[0014] Optionally, after responding to the test instruction and determining the connector source mode based on the test instruction, the method further includes:

[0015] If the connector source mode is the second connector source mode, determining the type of leakage path to be tested based on the test instruction;

[0016] Obtaining a connector template corresponding to the leakage path type to be tested;

[0017] Acquire connector configuration parameters of the connector template according to the test instruction;

[0018] A connector to be tested is constructed based on the connection template and the connector configuration parameters.

[0019] Optionally, obtaining the leakage data to be tested according to the test instruction includes:

[0020] Determine the data source mode according to the test instruction;

[0021] If the data source mode is the first data source mode, determining the type of data to be tested based on the test instruction;

[0022] Obtain a sample data template corresponding to the data type to be tested;

[0023] Generate leakage data to be tested based on the sample data template.

[0024] Optionally, after determining the data source mode according to the test instruction, the method further includes:

[0025] If the data source mode is the second data source mode, determining the type of data to be tested based on the test instruction;

[0026] Obtain a blank data template corresponding to the data type to be tested;

[0027] Acquire data configuration parameters of the blank data template based on the test instruction;

[0028] The leakage data to be tested is generated according to the blank data template and the data configuration parameters.

[0029] Optionally, acquiring data configuration parameters of the blank data template based on the test instruction includes:

[0030] Acquiring user test requirement information based on the test instruction;

[0031] Determine a data structure and data characteristic parameters according to the user test requirement information, wherein the data structure includes at least one data content element;

[0032] Performing weight configuration on the data content elements based on the data characteristic parameters;

[0033] The data configuration parameters of the blank data template are determined based on the weight configuration result and the data structure.

[0034] Optionally, performing a security test on the security device to be tested according to the candidate use case includes:

[0035] Building a use case set based on the candidate use cases;

[0036] Creating a test scenario based on the test instructions;

[0037] Filtering target test cases from the use case set based on the test scenario;

[0038] A security test is performed on the security device to be tested based on the target test case.

[0039] Optionally, the creating a test scenario based on the test instruction includes:

[0040] Acquire test requirement information based on the test instruction;

[0041] Configure an attack plan according to the test requirement information to obtain plan configuration information;

[0042] Determine the test case type and test sequence required for the test based on the solution configuration information;

[0043] Generate a use case sequence according to the use case type and the test sequence;

[0044] Create test scenarios based on the described use case sequences.

[0045] Optionally, after performing a security test on the security device to be tested according to the candidate use case, the method further includes:

[0046] Monitoring the alarm log of the safety device to be tested;

[0047] Get leak attack logs for security testing;

[0048] Matching the alarm log with the leakage attack log;

[0049] A security assessment is performed on the safety device to be tested based on the matching result.

[0050] Optionally, matching the alarm log with the leakage attack log includes:

[0051] determining a type of test approach for the security test;

[0052] determining a match type based on the test approach type;

[0053] The alarm log is matched with the leakage attack log according to the matching type.

[0054] Optionally, the matching type includes at least one of the following:

[0055] Log name matching, hash value matching, string matching, character matching, request path matching, and email subject matching.

[0056] Optionally, after performing security assessment on the security device to be tested based on the matching result, the method further includes:

[0057] The data security policy of the security device to be tested is adjusted based on the security evaluation result of the security device to be tested.

[0058] In addition, to achieve the above object, the present invention also provides a safety testing device, the safety testing device comprising:

[0059] A test connector acquisition module, configured to respond to a test instruction and acquire a connector to be tested based on the test instruction;

[0060] A test data acquisition module, used to acquire leakage data to be tested according to the test instruction;

[0061] A test case construction module, used to construct at least one candidate case based on the connector to be tested and the leakage data to be tested;

[0062] The security testing module is used to perform security testing on the security device to be tested according to the candidate use case.

[0063] Optionally, the test connector acquisition module is also used to respond to a test instruction and determine a connector source mode based on the test instruction; if the connector source mode is a first connector source mode, determine the type of leakage path to be tested based on the test instruction; obtain a connector target address according to the type of leakage path to be tested; and obtain a system built-in connector to be tested based on the connector target address.

[0064] Optionally, the test connector acquisition module is also used to determine the type of leakage path to be tested based on the test instruction if the connector source mode is the second connector source mode; obtain the connector template corresponding to the type of leakage path to be tested; obtain the connector configuration parameters of the connector template according to the test instruction; and construct the connector to be tested based on the connection template and the connector configuration parameters.

[0065] Optionally, the test data acquisition module is also used to determine the data source method according to the test instruction; if the data source method is the first data source method, determine the type of data to be tested based on the test instruction; obtain a sample data template corresponding to the type of data to be tested; and generate leakage data to be tested based on the sample data template.

[0066] Optionally, the test data acquisition module is also used to determine the type of data to be tested based on the test instruction if the data source method is the second data source method; obtain a blank data template corresponding to the type of data to be tested; obtain data configuration parameters of the blank data template based on the test instruction; and generate leakage data to be tested according to the blank data template and the data configuration parameters.

[0067] Optionally, the test data acquisition module is also used to acquire user test requirement information based on the test instruction; determine the data structure and data characteristic parameters according to the user test requirement information, the data structure including at least one data content element; weight the data content elements based on the data characteristic parameters; and determine the data configuration parameters of the blank data template based on the weight configuration result and the data structure.

[0068] In addition, to achieve the above objectives, the present application also proposes a security testing device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the security testing method described above.

[0069] In addition, to achieve the above-mentioned purpose, the present application also proposes a computer-readable storage medium, which is a computer-readable storage medium, and a computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, the steps of the security testing method described above are implemented.

[0070] The present invention obtains a connector to be tested and leakage data to be tested based on the test instruction in response to a test instruction, obtains leakage data to be tested according to the test instruction, constructs at least one candidate use case based on the connector to be tested and the leakage data to be tested, and performs a safety test on the safety device to be tested according to the candidate use case by responding to a test instruction, obtains a connector to be tested and leakage data to be tested based on the test instruction, and constructs at least one candidate use case based on the connector to be tested and the leakage data to be tested, thereby achieving flexible and free arrangement of test schemes through customization of test cases, performing a safety test on the safety device to be tested according to the candidate use case, thereby testing the safety device more flexibly, effectively verifying the safety performance of the device, and greatly improving the efficiency of safety testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0072] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0073] Figure 1 It is a structural diagram of a safety testing device for a hardware operating environment involved in an embodiment of the present invention;

[0074] Figure 2 A schematic diagram of a flow chart of a first embodiment of a safety testing method of the present invention;

[0075] Figure 3 A schematic diagram of a flow chart of a second embodiment of a safety testing method of the present invention;

[0076] Figure 4 This is a schematic diagram of the process of customizing a connector in the second embodiment of the safety testing method of the present invention;

[0077] Figure 5 A schematic diagram of a flow chart of a third embodiment of a safety testing method of the present invention;

[0078] Figure 6 A schematic diagram of a process of customizing a data template in the third embodiment of the security testing method of the present invention;

[0079] Figure 7 It is a structural block diagram of the first embodiment of the safety testing device of the present invention.

[0080] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0081] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0082] Reference Figure 1 , Figure 1 The present invention is a schematic diagram of the structure of a safety test device for a hardware operating environment according to an embodiment of the present invention.

[0083] like Figure 1As shown, the safety test equipment may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0084] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the safety test device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0085] like Figure 1 As shown, the memory 1005 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a security testing program.

[0086] exist Figure 1 In the security testing device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the security testing device of the present invention can be set in the security testing device, and the security testing device calls the security testing program stored in the memory 1005 through the processor 1001, and executes the security testing method provided by the embodiment of the present invention.

[0087] The present invention provides a safety testing method. Figure 2 , Figure 2 FIG. 4 is a flow chart of a first embodiment of a safety testing method of the present invention.

[0088] In this embodiment, the safety testing method includes the following steps:

[0089] Step S10: In response to a test instruction, obtaining a connector to be tested based on the test instruction.

[0090] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, etc. The following takes a safety test device (referred to as the test device) as an example to illustrate this embodiment and the following embodiments.

[0091] It should be noted that the test instruction may be a test instruction issued by a user to perform a security test (e.g., a data leakage prevention test) on the security device to be tested. The security device to be tested may be a pre-deployed security device used to block data leakage to the outside or to issue an alarm when sensitive data is leaked to the outside.

[0092] It should be noted that the connector to be tested may be a connector for receiving requests and forwarding processing requests, and the connector may be the final destination of the data leakage. For example, the connector to be tested may include but is not limited to: HTTP connector, HTTPS connector, FTP connector, mail connector, etc.

[0093] It is understandable that there are many ways to leak data, such as leakage through email, leakage through network disk, leakage through FTP, leakage through HTTP, etc. Therefore, this embodiment determines the leakage path to be tested based on the test instruction, thereby realizing customization of the test connector based on the leakage path to be tested.

[0094] For example, the HTTP connector leaks files through HTTP, and directly uploads files in three ways: GET, POST, and PUT. The test device performs HTTP data leakage testing by obtaining the HTTP connector.

[0095] Step S20: obtaining leakage data to be tested according to the test instruction.

[0096] It should be noted that the leakage data to be tested may be data transmitted during a security test, that is, during the security test, it is necessary to test the anti-leakage security of the leakage data to be tested transmitted by the security device to be tested.

[0097] It is understandable that this embodiment can determine the user's data transmission requirements based on the test instructions. Different users have different data transmission requirements. For example, if the user has security requirements for txt file transmission, the leakage data to be tested used in the security test can be txt file data.

[0098] In some embodiments, the testing device may determine the user's data testing requirements based on the testing instructions, determine the user's interest in different types of data based on the data testing requirements, weight each type of data based on the interest level, and obtain the leakage data to be tested based on the weight configuration results.

[0099] In a specific implementation, the source of the leakage data to be tested can be a user-defined data template or a pre-set sample data. If the source of the leakage data to be tested is a user-defined data template, a corresponding blank data template is selected based on the test instruction, data filling content is obtained based on the test instruction, and a blank data template is configured based on the data filling content to obtain the leakage data to be tested.

[0100] Step S30: construct at least one candidate use case based on the connector to be tested and the leakage data to be tested.

[0101] It should be noted that the candidate use case can be a test case built based on the connector to be tested and the leakage data to be tested. For example, the candidate use case can be sending a DOCX file via email, uploading a PPTX file via FTP, sending a TXT file via email, etc.

[0102] It can be understood that there may be one or more connectors to be tested, there may be one or more leakage data to be tested, and a use case list is constructed based on the connectors to be tested and the leakage data to be tested, and the use case list includes at least one candidate use case.

[0103] Step S40: Performing a security test on the security device to be tested according to the candidate use case.

[0104] It should be noted that the security test may be a data leakage prevention test. This embodiment obtains test requirement information based on the test instruction, and selects target test cases required for this security test from candidate test cases based on the test requirement information to perform security testing.

[0105] In some embodiments, the testing device may classify candidate use cases in order to better manage the candidate use cases. For example, the candidate use cases may be classified based on the use case source, execution environment, leakage method, data type, threat type and / or attack method, and a use case list corresponding to each use case type may be generated based on the classification results. The corresponding use case list may be selected based on the test requirements in the test instructions to perform security testing on the security device to be tested.

[0106] Furthermore, in order to accurately meet the test requirements and implement effective testing of the device, the above step S40 may include:

[0107] Step S41: construct a use case set according to the candidate use cases;

[0108] Step S42: creating a test scenario based on the test instruction;

[0109] Step S43: Filtering target test cases from the use case set based on the test scenario;

[0110] Step S44: Performing a security test on the security device to be tested based on the target test case.

[0111] It should be noted that the test device can generate one or more candidate use cases, and manage the candidate use cases by building a test case set, so that in different scenarios or tasks, the corresponding candidate use cases can be selected from the use case set for security testing.

[0112] It can be understood that, in this embodiment, a data leakage prevention test scenario can be formed by selecting different candidate use cases, a test task can be created based on the test scenario, and a security test can be performed on the security device to be tested based on the test task.

[0113] It should be understood that the test equipment can obtain scenario information based on the test instructions sent by the user, identify the connector type and data type required for the test task based on the scenario information, and allow the user to configure it freely, thereby achieving high customization of the test and flexible testing.

[0114] Furthermore, in order to accurately create a test scenario, the above step S42 may include:

[0115] Step S421: Acquire test requirement information based on the test instruction;

[0116] Step S422: configuring an attack scheme according to the test requirement information to obtain scheme configuration information;

[0117] Step S423: Determine the test case type and test sequence required for the test based on the solution configuration information;

[0118] Step S424: Generate a use case sequence according to the use case type and the test sequence;

[0119] Step S425: Create a test scenario based on the use case sequence.

[0120] It should be noted that the test requirement information may be the user's requirement information for the data leakage prevention performance test of the security device to be tested. For example, the test requirement information may include the user's requirement for the leakage path type, the user's requirement for the leakage data type, the user's requirement for the leakage file type, the user's requirement for the test sequence, etc.

[0121] It is understandable that the scheme configuration information may be configuration information of an attack scheme for performing a data leakage attack on the security device to be tested. For example, the scheme configuration information may include information such as attack type, attack sequence, and dependent environment configuration.

[0122] It should be noted that the above-mentioned use case type may be a test case type required to be used in the security testing process. The above-mentioned test sequence may be a test sequence of test cases in the security testing process. The above-mentioned use case sequence may be a test case list constructed based on the test case execution sequence.

[0123] It should be understood that the test equipment obtains the user's test requirement information based on the test instructions, determines the test case type and test case execution order required for the test based on the test requirement information, generates a test case sequence based on the test case type and the test sequence, and creates a test scenario according to the test case sequence.

[0124] Furthermore, in order to accurately evaluate the safety performance of the safety device to be tested, after the above step S40, the following steps are further included:

[0125] Step S50: monitoring the alarm log of the safety device to be tested;

[0126] Step S60: Obtain the leakage attack log of the security test;

[0127] Step S70: Matching the alarm log with the leakage attack log;

[0128] Step S80: Performing a security assessment on the safety device to be tested based on the matching result.

[0129] It can be understood that this embodiment effectively obtains the response performance of the security device under test during the security test by monitoring the alarm log of the security device under test, and matches the leakage attack log with the alarm log to determine whether the security device under test accurately detects the leaked data, thereby completing the security performance evaluation of the security device under test.

[0130] Furthermore, in order to accurately perform log matching and thus detect the safety performance of the device, the above step S70 may include:

[0131] Step S71: Determine the test approach type of the safety test;

[0132] Step S72: determining a matching type based on the test path type;

[0133] Step S73: Match the alarm log with the leakage attack log according to the matching type.

[0134] It should be noted that the test path type may be a data transmission path type, for example, the test path type may include HTTP transmission, email transmission, FTP transmission, etc.

[0135] It is understandable that the test device determines the corresponding matching type based on the test path type used in the security test process. Different test paths correspond to different matching types. For example, the matching types of HTTP transmission include log name matching and hash value matching (MD5 matching).

[0136] Furthermore, in order to improve matching efficiency and matching accuracy, the matching type includes at least one of the following:

[0137] Log name matching, hash value matching, string matching, character matching, request path matching, and email subject matching.

[0138] It is understandable that different test path types have different matching types, and the corresponding matching type is selected to improve the matching accuracy and matching efficiency, thereby accurately detecting the safety performance of the safety device to be tested.

[0139] For example, the matching types corresponding to the HTTP transmission path are log name matching and hash value matching; the matching type corresponding to the email transmission path is email subject matching; the matching type corresponding to the FTP transmission path is request path matching, etc.

[0140] In some embodiments, the test device may also determine the matching method based on the type of transmission data in the security test. For example, the matching types corresponding to data types such as ID card number and mobile phone number may include string matching and character matching.

[0141] Furthermore, in order to improve the data leakage prevention performance of the security device to be tested, after the above step S80, the following is further included:

[0142] Step S90: adjusting the data security policy of the security device to be tested based on the security assessment result of the security device to be tested.

[0143] It can be understood that the test equipment obtains the security assessment results of the security equipment to be tested, generates a security assessment role portrait of the security equipment to be tested based on the security assessment results, generates an adjustment strategy based on the security assessment role portrait, and adjusts the data security policy of the security equipment to be tested based on the adjustment strategy, thereby improving the data security performance of the security equipment to be tested.

[0144] This embodiment responds to a test instruction, obtains a connector to be tested based on the test instruction, obtains leakage data to be tested according to the test instruction, constructs at least one candidate use case based on the connector to be tested and the leakage data to be tested, and performs a security test on the safety device to be tested according to the candidate use case; since this embodiment responds to a test instruction, obtains a connector to be tested and leakage data to be tested based on the test instruction, and constructs at least one candidate use case based on the connector to be tested and the leakage data to be tested, the test scheme can be flexibly and freely arranged by customizing the test case, and the safety test is performed on the safety device to be tested according to the candidate use case, thereby testing the safety device more flexibly, effectively verifying the safety performance of the device, and greatly improving the efficiency of security testing.

[0145] refer to Figure 3 , Figure 3 FIG. 4 is a flow chart of a second embodiment of a safety testing method of the present invention.

[0146] Based on the above first embodiment, in this embodiment, step S10 further includes:

[0147] Step S11: In response to a test instruction, determine a connector source mode based on the test instruction.

[0148] It should be noted that the connector source method may be a source path of the connector to be tested, for example, the source method may include a system built-in connector source and a custom connector template source.

[0149] It can be understood that the test device responds to the test instruction, determines the connector source method selected by the user based on the test instruction, and judges whether the user selects the system's built-in source method. If so, a built-in connector is provided to the user; if not, a blank connector template is provided, and the connector information is configured for the connector template based on the test instruction to obtain the connector to be tested.

[0150] Step S12: If the connector source mode is the first connector source mode, determining the type of leakage path to be tested based on the test instruction.

[0151] It should be noted that the first connector source may be a system built-in connector source.

[0152] It is understandable that the test device can pre-generate connectors so that during security testing, the system built-in connectors can be directly provided, thereby improving the efficiency of security testing. For example, the test device can pre-generate a built-in HTTP connector, a built-in HTTPS connector, a built-in FTP connector, and a built-in mail connector.

[0153] Step S13: obtaining a connector target address according to the leakage path type to be tested.

[0154] It should be noted that the leakage path type to be tested may be a data leakage path type that needs to be tested, for example, the leakage path type to be tested may include HTTP leakage path, HTTPS leakage path, FTP leakage path, and email leakage path.

[0155] Step S14: acquiring a built-in connector to be tested in the system based on the connector target address.

[0156] It can be understood that the test device obtains the target address of the corresponding type of system built-in connector according to the type of leakage path to be tested, and obtains the connector to be tested corresponding to the type of leakage path to be tested based on the target address.

[0157] Further, refer to Figure 4 , Figure 4 The following is a flow chart of customizing the connector of this embodiment. In order to achieve high customization and flexible configuration of the connector, after the above step S11, the following may be included:

[0158] Step S111: if the connector source mode is the second connector source mode, determining the type of leakage path to be tested based on the test instruction;

[0159] Step S112: obtaining a connector template corresponding to the leakage path type to be tested;

[0160] Step S113: acquiring connector configuration parameters of the connector template according to the test instruction;

[0161] Step S114: constructing a connector to be tested based on the connection template and the connector configuration parameters.

[0162] It should be noted that the second connector source mode may be a custom connector template source. The connector configuration parameters may include a service name, a service type, a protocol type, a request method, a target address, and client parameters.

[0163] It is understandable that the test equipment can obtain a blank connector template corresponding to the leakage path type to be tested, obtain the connector configuration parameters of the connector template according to the test instruction, and construct the connector to be tested based on the connection template and the connector configuration parameters.

[0164] For example, the leakage path type to be tested is HTTP leakage path. The test device determines the source of the connector by obtaining a blank HTTP connection template, obtaining HTTP connector configuration parameters, filling and configuring parameters of the blank HTTP connection template based on the HTTP connector configuration parameters, and obtaining the HTTP connector to be tested.

[0165] It should be noted that different types of leakage paths to be tested require different connector configuration parameters and connector templates. Therefore, the test equipment needs to obtain the connector template and connector configuration parameters corresponding to the type of leakage path to be tested.

[0166] For example, the template parameters that need to be configured for the FTP leakage path include: port number, user name, password, target address, service name, etc. The template parameters that need to be configured for the HTTP leakage path and HTTPS leakage path include: service name, request method, target address, etc. The template parameters that need to be configured for the email leakage path include: email account, email password, server address, server port, sender configuration information, recipient configuration information, etc.

[0167] This embodiment responds to a test instruction and determines a connector source mode based on the test instruction. If the connector source mode is the first connector source mode, the leakage path type to be tested is determined based on the test instruction, a connector target address is obtained according to the leakage path type to be tested, and a system built-in connector to be tested is obtained based on the connector target address, thereby realizing customization of the test connector, realizing flexible configuration of the safety test, improving the test accuracy, and realizing diversified test design.

[0168] refer to Figure 5 , Figure 5 FIG. 4 is a flow chart of a third embodiment of a safety testing method of the present invention.

[0169] Based on the above embodiments, in this embodiment, in step S20, the method further includes:

[0170] Step S21: Determine the data source mode according to the test instruction.

[0171] It should be noted that the data source method may be a source path of the leakage data to be detected, for example, the source method may include a system built-in data source and a custom data template source.

[0172] It can be understood that the test device responds to the test instruction, determines the data source method selected by the user based on the test instruction, and judges whether the user selects the system's built-in source method. If so, it provides the user with built-in data; if not, it provides a blank data template, and configures the data information of the data template based on the test instruction to obtain the leakage data to be tested.

[0173] Step S22: If the data source mode is the first data source mode, determining the type of data to be tested based on the test instruction.

[0174] It should be noted that the data type to be tested can be the data type transmitted during the security test, for example, the data type to be tested can be a TXT file, a DOCX file, a DOC file, ID card data, bank card data, mobile phone number data, etc.

[0175] It can be understood that the test equipment can determine the user's degree of importance or interest in different data based on the test instructions, thereby constructing a data interest profile of the user, configuring weights for different types of data based on the data interest profile, and determining the type of data to be tested based on the weight configuration results.

[0176] Step S23: Obtain a sample data template corresponding to the data type to be tested.

[0177] It should be noted that the sample data template can be a pre-generated system built-in data template. For example, the test equipment can pre-generate data templates such as identity cards, mobile phone numbers, bank cards, etc. for users to use directly, thereby improving test efficiency.

[0178] In some embodiments, if the data template required by the user does not exist in the preset sample data template, a blank data template is provided, and template content parameters of the blank data template are configured based on the user's test data requirements, thereby achieving customization of the leakage data to be tested.

[0179] Step S24: Generate leakage data to be tested based on the sample data template.

[0180] It can be understood that the testing device determines the file type of the leakage data to be tested based on the test instruction, and generates the leakage data to be tested based on the file type and the sample data template.

[0181] It should be noted that the above file types may include but are not limited to TXT files, DOC files, DOCX files and PPTX files.

[0182] Further, refer to Figure 6 , Figure 6 This is a flow chart of customizing the data template in this embodiment. In order to improve the degree of customization of the leakage data to be tested, realize high customization of the data, and thus improve the flexibility of the test, after the above step S21, the following may be included:

[0183] Step S211: if the data source mode is the second data source mode, determining the type of data to be tested based on the test instruction;

[0184] Step S212: obtaining a blank data template corresponding to the data type to be tested;

[0185] Step S213: acquiring data configuration parameters of the blank data template based on the test instruction;

[0186] Step S214: Generate leakage data to be tested according to the blank data template and the data configuration parameters.

[0187] It should be noted that the second data source method may be a custom data template source.

[0188] It is understandable that the test equipment can obtain the corresponding blank data template based on the data type to be tested, obtain data configuration parameters based on the test instructions, fill and configure the data template name and data template content of the blank data template based on the data configuration parameters, thereby generating leakage data to be tested.

[0189] In some embodiments, the testing device may store the filled data template based on the data template name and the data template content, so that subsequent users can continue to use the data template to generate leakage data to be tested.

[0190] Furthermore, in order to accurately configure parameters of the data template, the above step S213 may include:

[0191] Step S2131: obtaining user test requirement information based on the test instruction;

[0192] Step S2132: determining a data structure and data characteristic parameters according to the user test requirement information, wherein the data structure includes at least one data content element;

[0193] Step S2133: weighting the data content elements based on the data feature parameters;

[0194] Step S2134: Determine data configuration parameters of the blank data template based on the weight configuration result and the data structure.

[0195] It should be noted that the user test requirement information may be information related to the user's test requirements for data leakage prevention security testing of security equipment, for example, the user test requirement information may include the user's demand information for data content, the user's security weight information for each data type, the user's selection information for data channels, etc. The above-mentioned data content elements may include identity card elements, bank card number elements, mobile phone number elements, etc.

[0196] It is understandable that the data structure can be the data composition structure of the leaked data to be detected. The above data characteristic parameters can be the data structure characteristic parameters of the leaked data to be detected. For example, users are sensitive to the security of their ID card numbers, so the data structure and data characteristic parameters are parameters related to the data composition of the ID card number.

[0197] It should be noted that the testing device determines at least one type of data that the user needs to test in this security test based on the user's testing requirement information, and determines the user's interest or sensitivity to each type of data, and weights each data type based on the interest or sensitivity, thereby determining the test weight corresponding to each data type, and configures content parameters for the template content of the blank data template based on the test weight and the data structure.

[0198] This embodiment determines the data source method according to the test instruction. If the data source method is the first data source method, the data type to be tested is determined based on the test instruction, a sample data template corresponding to the data type to be tested is obtained, and leakage data to be tested is generated based on the sample data template. This embodiment achieves high customization of test leakage data through data templates, realizes flexible configuration of security tests, improves test accuracy, and realizes diversified test design.

[0199] In addition, an embodiment of the present invention further proposes a computer-readable storage medium, on which a security testing program is stored. When the security testing program is executed by a processor, the steps of the security testing method described above are implemented.

[0200] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0201] The computer-readable storage medium may be included in the safety test device; or may exist independently without being assembled into the safety test device.

[0202] In addition, an embodiment of the present invention further provides a computer program product, including a security testing program, which implements the steps of the security testing method described above when executed by a processor.

[0203] The specific implementation of the computer program product of the present invention is basically the same as the above-mentioned embodiments of the security testing method, and will not be repeated here.

[0204] Reference Figure 7 , Figure 7 It is a structural block diagram of the first embodiment of the safety testing device of the present invention.

[0205] like Figure 7 As shown, the safety testing device proposed in the embodiment of the present invention includes:

[0206] A test connector acquisition module 10, configured to respond to a test instruction and acquire a connector to be tested based on the test instruction;

[0207] A test data acquisition module 20, used to acquire leakage data to be tested according to the test instruction;

[0208] A test case construction module 30, configured to construct at least one candidate case based on the connector to be tested and the leakage data to be tested;

[0209] The security testing module 40 is used to perform security testing on the security device to be tested according to the candidate use case.

[0210] Furthermore, the test connector acquisition module 10 is also used to respond to a test instruction and determine a connector source mode based on the test instruction; if the connector source mode is a first connector source mode, determine the type of leakage path to be tested based on the test instruction; obtain a connector target address according to the type of leakage path to be tested; and obtain a system built-in connector to be tested based on the connector target address.

[0211] Furthermore, the test connector acquisition module 10 is also used to determine the type of leakage path to be tested based on the test instruction if the connector source mode is the second connector source mode; obtain the connector template corresponding to the type of leakage path to be tested; obtain the connector configuration parameters of the connector template according to the test instruction; and construct the connector to be tested based on the connection template and the connector configuration parameters.

[0212] Furthermore, the test data acquisition module 20 is also used to determine the data source method according to the test instruction; if the data source method is the first data source method, determine the type of data to be tested based on the test instruction; obtain the sample data template corresponding to the type of data to be tested; and generate the leakage data to be tested based on the sample data template.

[0213] Furthermore, the test data acquisition module 20 is also used to determine the type of data to be tested based on the test instruction if the data source method is the second data source method; obtain a blank data template corresponding to the type of data to be tested; obtain data configuration parameters of the blank data template based on the test instruction; and generate leakage data to be tested according to the blank data template and the data configuration parameters.

[0214] Furthermore, the test data acquisition module 20 is also used to obtain user test requirement information based on the test instruction; determine the data structure and data characteristic parameters according to the user test requirement information, the data structure including at least one data content element; perform weight configuration on the data content elements based on the data characteristic parameters; and determine the data configuration parameters of the blank data template based on the weight configuration result and the data structure.

[0215] Furthermore, the security testing module 40 is also used to construct a use case set based on the candidate use cases; create a test scenario based on the test instructions; filter out target test cases from the use case set based on the test scenario; and perform security testing on the security device to be tested based on the target test case.

[0216] Furthermore, the security testing module 40 is also used to obtain test requirement information based on the test instructions; configure the attack plan according to the test requirement information to obtain plan configuration information; determine the use case type and test sequence required for the test based on the plan configuration information; generate a use case sequence according to the use case type and the test sequence; and create a test scenario based on the use case sequence.

[0217] Furthermore, the safety testing device further comprises:

[0218] The security assessment module 50 is used to monitor the alarm log of the security device to be tested; obtain the leakage attack log of the security test; match the alarm log with the leakage attack log; and perform security assessment on the security device to be tested based on the matching result.

[0219] Furthermore, the security assessment module 50 is also used to determine the test path type of the security test; determine the matching type based on the test path type; and match the alarm log with the leakage attack log according to the matching type.

[0220] Furthermore, the matching type includes at least one of the following:

[0221] Log name matching, hash value matching, string matching, character matching, request path matching, and email subject matching.

[0222] Furthermore, the security assessment module 50 is further configured to adjust the data security policy of the security device to be tested based on the security assessment result of the security device to be tested.

[0223] This embodiment responds to a test instruction, obtains a connector to be tested based on the test instruction, obtains leakage data to be tested according to the test instruction, constructs at least one candidate use case based on the connector to be tested and the leakage data to be tested, and performs a security test on the safety device to be tested according to the candidate use case; since this embodiment responds to a test instruction, obtains a connector to be tested and leakage data to be tested based on the test instruction, and constructs at least one candidate use case based on the connector to be tested and the leakage data to be tested, the test scheme can be flexibly and freely arranged by customizing the test case, and the safety test is performed on the safety device to be tested according to the candidate use case, thereby testing the safety device more flexibly, effectively verifying the safety performance of the device, and greatly improving the efficiency of security testing.

[0224] The present invention discloses A1, a safety testing method, the safety testing method comprising:

[0225] In response to a test instruction, obtaining a connector to be tested based on the test instruction;

[0226] Acquire the leakage data to be tested according to the test instruction;

[0227] Construct at least one candidate use case based on the connector to be tested and the leakage data to be tested;

[0228] A security test is performed on the security device to be tested according to the candidate use cases.

[0229] A2. The safety testing method as described in A1, wherein in response to a test instruction, obtaining a connector to be tested based on the test instruction comprises:

[0230] In response to a test instruction, determining a connector source mode based on the test instruction;

[0231] If the connector source mode is the first connector source mode, determining the type of leakage path to be tested based on the test instruction;

[0232] Obtaining a connector target address according to the leakage path type to be tested;

[0233] A connector to be tested built into the system is acquired based on the connector target address.

[0234] A3. The safety testing method as described in A2, wherein after determining the source mode of the connector based on the test instruction in response to the test instruction, the method further comprises:

[0235] If the connector source mode is the second connector source mode, determining the type of leakage path to be tested based on the test instruction;

[0236] Obtaining a connector template corresponding to the leakage path type to be tested;

[0237] Acquire connector configuration parameters of the connector template according to the test instruction;

[0238] A connector to be tested is constructed based on the connection template and the connector configuration parameters.

[0239] A4. The safety testing method as described in A1, wherein obtaining leakage data to be tested according to the test instruction comprises:

[0240] Determine the data source mode according to the test instruction;

[0241] If the data source mode is the first data source mode, determining the type of data to be tested based on the test instruction;

[0242] Obtain a sample data template corresponding to the data type to be tested;

[0243] Generate leakage data to be tested based on the sample data template.

[0244] A5. The security testing method as described in A4, after determining the data source mode according to the test instruction, further comprising:

[0245] If the data source mode is the second data source mode, determining the type of data to be tested based on the test instruction;

[0246] Obtain a blank data template corresponding to the data type to be tested;

[0247] Acquire data configuration parameters of the blank data template based on the test instruction;

[0248] The leakage data to be tested is generated according to the blank data template and the data configuration parameters.

[0249] A6. The security testing method as described in A5, wherein the step of obtaining the data configuration parameters of the blank data template based on the test instruction comprises:

[0250] Acquiring user test requirement information based on the test instruction;

[0251] Determine a data structure and data characteristic parameters according to the user test requirement information, wherein the data structure includes at least one data content element;

[0252] Performing weight configuration on the data content elements based on the data characteristic parameters;

[0253] The data configuration parameters of the blank data template are determined based on the weight configuration result and the data structure.

[0254] A7. The security testing method as described in A1, wherein the security testing of the security device to be tested according to the candidate use case comprises:

[0255] Building a use case set based on the candidate use cases;

[0256] Creating a test scenario based on the test instructions;

[0257] Filtering target test cases from the use case set based on the test scenario;

[0258] A security test is performed on the security device to be tested based on the target test case.

[0259] A8. The security testing method as described in A7, wherein creating a test scenario based on the test instruction comprises:

[0260] Acquire test requirement information based on the test instruction;

[0261] Configure an attack plan according to the test requirement information to obtain plan configuration information;

[0262] Determine the test case type and test sequence required for the test based on the solution configuration information;

[0263] Generate a use case sequence according to the use case type and the test sequence;

[0264] Create test scenarios based on the described use case sequences.

[0265] A9. The security testing method as described in any one of A1 to A8, after performing the security test on the security device to be tested according to the candidate use case, further comprising:

[0266] Monitoring the alarm log of the safety device to be tested;

[0267] Get leak attack logs for security testing;

[0268] Matching the alarm log with the leakage attack log;

[0269] A security assessment is performed on the safety device to be tested based on the matching result.

[0270] A10. The security testing method as described in A9, wherein matching the alarm log with the leakage attack log comprises:

[0271] determining a type of test approach for the security test;

[0272] determining a match type based on the test approach type;

[0273] The alarm log is matched with the leakage attack log according to the matching type.

[0274] A11. In the security testing method described in A10, the matching type includes at least one of the following:

[0275] Log name matching, hash value matching, string matching, character matching, request path matching, and email subject matching.

[0276] A12. The security testing method as described in A9, after performing security assessment on the security device to be tested based on the matching result, further comprising:

[0277] The data security policy of the security device to be tested is adjusted based on the security evaluation result of the security device to be tested.

[0278] The present invention also discloses B13, a safety testing device, the safety testing device comprising:

[0279] A test connector acquisition module, configured to respond to a test instruction and acquire a connector to be tested based on the test instruction;

[0280] A test data acquisition module, used to acquire leakage data to be tested according to the test instruction;

[0281] A test case construction module, used to construct at least one candidate case based on the connector to be tested and the leakage data to be tested;

[0282] The security testing module is used to perform security testing on the security device to be tested according to the candidate use case.

[0283] B14. In the safety testing device as described in B13, the test connector acquisition module is also used to respond to a test instruction and determine a connector source mode based on the test instruction; if the connector source mode is a first connector source mode, determine the type of leakage path to be tested based on the test instruction; acquire a connector target address according to the type of leakage path to be tested; and acquire a system built-in connector to be tested based on the connector target address.

[0284] B15. In the safety testing device as described in B14, the test connector acquisition module is also used to determine the type of leakage path to be tested based on the test instruction if the connector source mode is the second connector source mode; obtain the connector template corresponding to the type of leakage path to be tested; obtain the connector configuration parameters of the connector template according to the test instruction; and construct the connector to be tested based on the connection template and the connector configuration parameters.

[0285] B16. In the security testing device as described in B13, the test data acquisition module is also used to determine the data source method according to the test instruction; if the data source method is the first data source method, determine the type of data to be tested based on the test instruction; obtain the sample data template corresponding to the type of data to be tested; and generate the leakage data to be tested based on the sample data template.

[0286] B17. In the security testing device as described in B16, the test data acquisition module is also used to determine the type of data to be tested based on the test instruction if the data source method is the second data source method; obtain a blank data template corresponding to the type of data to be tested; obtain data configuration parameters of the blank data template based on the test instruction; and generate leakage data to be tested according to the blank data template and the data configuration parameters.

[0287] B18. In the security testing device as described in B17, the test data acquisition module is also used to obtain user test requirement information based on the test instruction; determine the data structure and data characteristic parameters according to the user test requirement information, the data structure including at least one data content element; perform weight configuration on the data content elements based on the data characteristic parameters; and determine the data configuration parameters of the blank data template based on the weight configuration result and the data structure.

[0288] In addition, the present invention also discloses C19, a security testing device, which includes: a memory, a processor, and a security testing program stored in the memory and executable on the processor, wherein the security testing program is configured to implement the security testing method as described above.

[0289] In addition, the present invention also discloses D20, a computer-readable storage medium, on which a security testing program is stored, and when the security testing program is executed by a processor, the security testing method as described above is implemented.

[0290] The safety test device provided by the present application adopts the safety test method in the above embodiment to solve the technical problems of safety testing. Compared with the prior art, the beneficial effects of the safety test device provided by the present application are the same as the beneficial effects of the safety test method provided by the above embodiment, and other technical features in the safety test device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0291] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0292] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0293] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0294] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A safety testing method, characterized in that: The safety testing method comprises: In response to a test instruction, obtaining a connector to be tested based on the test instruction; Acquire the leakage data to be tested according to the test instruction; Construct at least one candidate use case based on the connector to be tested and the leakage data to be tested; A security test is performed on the security device to be tested according to the candidate use cases.

2. The safety testing method according to claim 1, characterized in that: The step of obtaining the connector to be tested based on the test instruction in response to the test instruction includes: In response to a test instruction, determining a connector source mode based on the test instruction; If the connector source mode is the first connector source mode, determining the type of leakage path to be tested based on the test instruction; Obtaining a connector target address according to the leakage path type to be tested; A connector to be tested built into the system is acquired based on the connector target address.

3. The safety testing method according to claim 2, characterized in that: After the method responds to the test instruction and determines the connector source mode based on the test instruction, the method further includes: If the connector source mode is the second connector source mode, determining the type of leakage path to be tested based on the test instruction; Obtaining a connector template corresponding to the leakage path type to be tested; Acquire connector configuration parameters of the connector template according to the test instruction; A connector to be tested is constructed based on the connection template and the connector configuration parameters.

4. The safety testing method according to claim 1, characterized in that: The step of obtaining leakage data to be tested according to the test instruction includes: Determine the data source mode according to the test instruction; If the data source mode is the first data source mode, determining the type of data to be tested based on the test instruction; Obtain a sample data template corresponding to the data type to be tested; Generate leakage data to be tested based on the sample data template.

5. The safety testing method according to claim 4, characterized in that: After determining the data source mode according to the test instruction, the method further includes: If the data source mode is the second data source mode, determining the type of data to be tested based on the test instruction; Obtain a blank data template corresponding to the data type to be tested; Acquire data configuration parameters of the blank data template based on the test instruction; The leakage data to be tested is generated according to the blank data template and the data configuration parameters.

6. The safety testing method according to claim 5, characterized in that: The acquiring the data configuration parameters of the blank data template based on the test instruction includes: Acquiring user test requirement information based on the test instruction; Determine a data structure and data characteristic parameters according to the user test requirement information, wherein the data structure includes at least one data content element; Performing weight configuration on the data content elements based on the data characteristic parameters; The data configuration parameters of the blank data template are determined based on the weight configuration result and the data structure.

7. The safety testing method according to claim 1, characterized in that: The performing a security test on the security device to be tested according to the candidate use case comprises: Building a use case set based on the candidate use cases; Creating a test scenario based on the test instructions; Filtering target test cases from the use case set based on the test scenario; A security test is performed on the security device to be tested based on the target test case.

8. A safety testing device, characterized in that: The safety testing device comprises: A test connector acquisition module, configured to respond to a test instruction and acquire a connector to be tested based on the test instruction; A test data acquisition module, used to acquire leakage data to be tested according to the test instruction; A test case construction module, used to construct at least one candidate case based on the connector to be tested and the leakage data to be tested; The security testing module is used to perform security testing on the security device to be tested according to the candidate use case.

9. A safety testing device, characterized in that: The safety testing device comprises: a memory, a processor, and a safety testing program stored in the memory and executable on the processor, wherein the safety testing program is configured to implement the safety testing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a security testing program, and when the security testing program is executed by the processor, the security testing method according to any one of claims 1 to 7 is implemented.

Images