A system and method for secretly launching Cobalt Strike and maintaining permissions

Abstract

The present invention relates to the technical field of network security detection, and discloses a system and method for secretly launching Cobalt Strike and maintaining permissions. By pre-deploying an attack payload on each network device group of a target system, a Cobalt Strike server communicates with the attack payload to obtain a state information set of each target network device, and considering the execution ratio of executing all parsing and transmission of a target test file, the attack task on the target test file is divided into several sub-attack tasks of the attack payload corresponding to the Cobalt Strike client in accordance with the requirement of always maintaining the Cobalt Strike permission to execute the attack on the target test file. By calculating the execution time of the attack on the target test file, the defense and detection capability indicators of a security protection server when adopting different monitoring strategies in the same enterprise network environment are quantified, and the accuracy of detecting the network security defense capability of the enterprise security protection server by using the Cobalt Strike technology is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection, and in particular to a system and method for covertly launching Cobalt Strike and maintaining authority. Background Art

[0002] Cobalt Strike is an advanced interactive attack framework for security researchers and penetration testers. It provides a complete set of tools to help users simulate real-world network attacks to evaluate and improve network security defense capabilities.

[0003] In some scenarios, enterprises are equipped with independent security protection servers, which monitor the status indicators of other network devices in the enterprise network (such as CPU usage, memory usage or network traffic, etc.) to detect network attacks. In this scenario, when using Cobalt Strike technology to evaluate the network security defense capabilities of the security protection server, the existing technology cannot quantify the defense and detection capability indicators of the security protection server when using different monitoring strategies in the same enterprise network environment, and cannot accurately evaluate the defense capabilities of different monitoring strategies of the security protection server, and thus cannot help enterprises find the most suitable monitoring strategy for the target system, and cannot balance the contradiction between frequent false alarms of attacks caused by setting the critical value of status information monitoring too low and poor security caused by setting the critical value of status information monitoring too high.

[0004] Therefore, how to improve the accuracy of using Cobalt Strike technology to detect the network security defense capabilities of enterprise security protection servers, quantify the protection and detection capability indicators, and explore the optimal monitoring strategy for security protection servers in target systems is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present invention provides a system and method for covertly launching Cobalt Strike and maintaining authority, aiming to solve at least one of the above technical problems.

[0006] To achieve the above object, the present invention provides a method for secretly launching cobalt strike and maintaining authority, comprising:

[0007] Acquire a target test task of a target system, extract a target test file in the target test task and a device identification set of several network device groups of the target system;

[0008] Selecting a number of target device identifiers from the device identifier set of each network device group, determining the target network device corresponding to the target device identifier as the cobalt strike online target corresponding to the network device group and deploying the attack payload, and storing the target test file in the target network device determined as the cobalt strike online target corresponding to the network device group;

[0009] Receive the state information set corresponding to the attack payload feedback of the target network device in each network device group, and drive the cobalt strike server to generate an attack strategy for each network device group based on the state information set and the monitoring strategy of the security protection server for each network device;

[0010] Distribute several sub-attack strategies in the attack strategy to several cobalt strike clients connected to the cobalt strike server, so that several cobalt strike clients control the attack payloads of the corresponding target network devices and execute attack actions on the target test files;

[0011] Calculate the quantitative value of the network security defense capability of the security protection server against the target system based on the time taken by each network device group in the target system to complete the attack action of the target test file;

[0012] The network security defense capability quantified values ​​of the security protection server when executing different monitoring strategies are ranked from high to low, and the monitoring strategy with the highest network security defense capability quantified value in the network security defense capability ranking result with the attack false alarm rate within the allowable range is taken as the optimal monitoring strategy for the security protection server.

[0013] Optionally, the step of obtaining a target test task of a target system and extracting a target test file in the target test task and a device identification set of a plurality of network device groups of the target system specifically includes:

[0014] Accessing a system security test task library; wherein the system security test task library stores a number of test tasks to be executed in sequence, each test task including a target test file and a device identification set of network devices used by each network device group in the target system to perform network security testing;

[0015] The most forward test task in the system security test task library is taken as the target test task, and the target test file and the device identification sets of several network device groups in the target test task are extracted.

[0016] Optionally, before the step of obtaining a target test task of a target system and extracting a target test file in the target test task and a device identification set of a plurality of network device groups of the target system, the step further includes:

[0017] Obtaining a system security test request uploaded by the target system; wherein the system security test request includes attribute information of each network device group in the target system and a device identification set of each network device group used to perform network security testing;

[0018] Based on the attribute information, determine the target test file of each network device group in the target system; wherein the attribute information is configured as the domain or type to which the network device group in the target system belongs, and the target test file is configured as a test file in a test file library having a number of sub-files and a sub-file size corresponding to the domain or type;

[0019] According to the target test file of the target system and the device identification sets of several network device groups, the test tasks of the target system are generated and put into the system security test task library based on the generation time.

[0020] Optionally, a plurality of target device identifiers are selected from the device identifier set of each network device group, a target network device corresponding to the target device identifier is determined as a cobalt strike online target corresponding to the network device group and an attack payload is deployed, and a target test file is stored in the target network device determined as the cobalt strike online target corresponding to the network device group, specifically including:

[0021] Select several target device identifiers from the device identifier set of each network device group, and determine the target network device corresponding to the target device identifier as the cobalt strike online target corresponding to the network device group;

[0022] Utilizing the communication network within the target system, transmitting a pre-prepared attack payload to each target network device in the network device group, and deploying the attack payload on each target network device;

[0023] The target test file is sent to the target network device identified as the cobalt strike online target in each network device group and stored.

[0024] Optionally, a state information set corresponding to the attack payload feedback of the target network device in each network device group is received, and the cobalt strike server is driven to generate an attack strategy step for each network device group according to the state information set and the monitoring strategy of the security protection server for each network device, specifically including:

[0025] Receive a state information set fed back by the target network device in each network device group corresponding to the attack load; wherein the state information set is configured as a device operation parameter of the target network device collected by the attack load, and the device operation parameter includes at least one of a CPU usage rate, a memory occupancy rate, and an instantaneous flow value of the target network device;

[0026] The cobalt strike server is driven to generate an attack strategy for each network device group in each subsequent detection cycle based on the status information set of the past target number detection cycles and the status information monitoring critical value of each target network device in the target system.

[0027] Optionally, drive the cobalt strike server to generate attack strategy steps for each network device group in each subsequent detection cycle based on the status information set of the past target number detection cycles and the status information monitoring critical value of each target network device in the target system, including:

[0028] Drive the cobalt strike server to input the state information set of the past target number of detection cycles into the pre-built and trained state information set prediction model of the target network device, and predict the state information set of the target network device in each subsequent detection cycle;

[0029] Obtaining a state information monitoring critical value of each target network device in the target system, and calculating a device operation parameter redundancy of each target network device in each subsequent detection cycle based on the state information monitoring critical value and a state information set of the target network device in each subsequent detection cycle;

[0030] According to the number of sub-files and the size of sub-files assigned to execute the sub-file attack task of each network device, the device operation parameter consumption is determined according to the preset conversion rules, with the sum of the sub-file coverage of each network device in the network device group assigned to execute the target test file being not less than 1 as the first constraint condition, and the device operation parameter consumption of each network device in the network device group in the corresponding detection cycle being less than the device operation parameter redundancy as the second constraint condition, and with the goal of minimizing the sum of the parsing time and the transmission time of the sub-file of the target test file assigned to each network device in the network device group, the sub-file attack task of the target test file is assigned to each network device in the network device group, and an attack strategy for each network device group in each subsequent detection cycle is generated.

[0031] Optionally, driving the cobalt strike server to input the state information set of the past target number of detection cycles into a pre-built and trained state information set prediction model of the target network device, and predicting the state information set step of the target network device in each subsequent detection cycle, further includes:

[0032] Obtain the historical status information set of each network device in each network device group, extract the status information set of the past target number of detection cycles and the status information set of each subsequent detection cycle from the historical status information set, perform feature engineering, and construct training samples;

[0033] The training samples are input into a pre-built initial convolutional neural network model for training, and the output of the convolutional neural network model whose training times meet the requirements or the model converges is used as the state information set prediction model of the trained target network device.

[0034] Optionally, several sub-attack strategies in the attack strategy are distributed to several cobalt strike clients connected to the cobalt strike server, so that several cobalt strike clients control the attack payload of the corresponding target network device and execute the attack action steps on the target test file, specifically including:

[0035] Send each sub-attack strategy corresponding to the result that the sub-file attack task of the target test file is assigned to each network device in the network device group to several cobalt strike clients connected to the cobalt strike server;

[0036] Drive each cobalt strike client to control the attack payload of the corresponding target network device to execute the parsing and transmission actions of the corresponding sub-files of the target test file.

[0037] Optionally, the step of calculating the quantitative value of the network security defense capability of the security protection server for the target system according to the time taken by each network device group in the target system to complete the attack action of the target test file specifically includes:

[0038] Obtaining the total time consumed by each network device group in the target system to complete the parsing and transmission of the target test file and the preset weight value of each network device group in calculating the quantitative value of the network security defense capability of the target test file with the corresponding number of sub-files and sub-file size; wherein the network device group with fewer sub-files and larger sub-file sizes is pre-configured to have a smaller weight value;

[0039] The total time taken by each network device group to complete the parsing and transmission of the target test file and the weight value preset when calculating the network security defense capability quantification value of each network device group are determined as the network security defense capability quantification value of the security protection server for the target system.

[0040] In addition, in order to achieve the above-mentioned purpose, the present invention also provides a system for secretly launching cobalt strike and maintaining authority, including:

[0041] An extraction module, used to obtain a target test task of a target system, extract a target test file in the target test task and a device identification set of a plurality of network device groups of the target system;

[0042] A determination module is used to select a number of target device identifiers from the device identifier set of each network device group, determine the target network device corresponding to the target device identifier as the cobalt strike online target corresponding to the network device group and deploy the attack payload, and store the target test file to the target network device determined as the cobalt strike online target corresponding to the network device group;

[0043] A generation module is used to receive a state information set corresponding to the attack load feedback of the target network device in each network device group, and drive the cobalt strike server to generate an attack strategy for each network device group according to the state information set and the monitoring strategy of the security protection server for each network device;

[0044] An execution module is used to distribute several sub-attack strategies in the attack strategy to several cobalt strike clients connected to the cobalt strike server, so that the several cobalt strike clients control the attack payloads of the corresponding target network devices and execute the attack actions on the target test files;

[0045] A calculation module, used to calculate the quantitative value of the network security defense capability of the security protection server against the target system according to the time taken by each network device group in the target system to complete the attack action of the target test file;

[0046] The sorting module is used to sort the network security defense capability quantification values ​​of the security protection server when executing different monitoring strategies from high to low, and take the monitoring strategy with the highest network security defense capability quantification value in the network security defense capability sorting result with the attack false alarm rate within the allowable range as the optimal monitoring strategy for the security protection server.

[0047] The beneficial effects of the present invention are as follows: a system and method for secretly launching Cobalt Strike and maintaining permissions are proposed, by pre-deploying an attack payload on each network device group of the target system, using the Cobalt Strike server to communicate with the attack payload to obtain a state information set of each target network device, determining the attack strategy of the attack payload deployed by each target network device on the target test file according to the state information set, considering the execution ratio of all parsing and transmission of the target test file, and always maintaining the Cobalt Strike permissions to execute the target test file attack as a requirement, dividing the attack task on the target test file into several sub-attack tasks of the attack payload corresponding to the Cobalt Strike client, thereby quantifying the defense and detection capability indicators of the security protection server when adopting different monitoring strategies in the same enterprise network environment by calculating the execution time of completing the attack on the target test file, and finally helping the enterprise find the most suitable monitoring strategy for the target system, improving the accuracy of detecting the network security defense capability of the enterprise security protection server using Cobalt Strike technology, quantifying the protection and detection capability indicators, and exploring the best monitoring strategy of the security protection server in the target system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a flowchart of a method for secretly launching Cobalt Strike and maintaining authority in an embodiment of the present invention;

[0049] Figure 2 The present invention is a schematic diagram of the structure of a system for secretly launching Cobalt Strike and maintaining permissions in an embodiment of the present invention.

[0050] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0052] The embodiment of the present invention provides a method for secretly launching cobalt strike and maintaining permissions, referring to Figure 1 , Figure 1 The figure is a flow chart of an embodiment of a method for covertly launching Cobalt Strike and maintaining authority according to the present invention.

[0053] In this embodiment, the method for secretly launching Cobalt Strike and maintaining permissions includes the following steps:

[0054] S1: Obtain a target test task of a target system, extract a target test file in the target test task and a device identification set of several network device groups of the target system;

[0055] S2: Select several target device identifiers from the device identifier set of each network device group, determine the target network device corresponding to the target device identifier as the cobalt strike online target corresponding to the network device group and deploy the attack payload, and store the target test file to the target network device determined as the cobalt strike online target corresponding to the network device group;

[0056] S3: Receive the state information set corresponding to the attack payload feedback of the target network device in each network device group, and drive the cobalt strike server to generate an attack strategy for each network device group based on the state information set and the monitoring strategy of the security protection server for each network device;

[0057] S4: Distribute several sub-attack strategies in the attack strategy to several cobalt strike clients connected to the cobalt strike server, so that several cobalt strike clients control the attack payload of the corresponding target network device and execute the attack action on the target test file;

[0058] S5: Calculate the quantitative value of the network security defense capability of the security protection server against the target system according to the time taken by each network device group in the target system to complete the attack action of the target test file;

[0059] S6: rank the network security defense capability quantified values ​​of the security protection server when executing different monitoring strategies from high to low, and take the monitoring strategy with the highest network security defense capability quantified value whose attack false alarm rate is within the allowable range in the network security defense capability ranking result as the best monitoring strategy for the security protection server.

[0060] It should be noted that in some scenarios, enterprises are equipped with independent security protection servers, which monitor the status indicators of other network devices in the enterprise network (such as CPU usage, memory usage or network traffic, etc.) to detect network attacks. In this scenario, when using Cobalt Strike technology to evaluate the network security defense capabilities of the security protection server, the existing technology cannot quantify the defense and detection capability indicators of the security protection server when using different monitoring strategies in the same enterprise network environment, and cannot accurately evaluate the defense capabilities of different monitoring strategies of the security protection server, and thus cannot help enterprises find the most suitable monitoring strategy for the target system, and cannot balance the contradiction between frequent false alarms of attacks caused by too low a critical value for status information monitoring and poor security caused by too high a critical value for status information monitoring.

[0061] In order to solve the above problems, this embodiment deploys an attack payload on each network device group of the target system in advance, uses the cobalt strike server to communicate with the attack payload to obtain the status information set of each target network device, and determines the attack strategy of the attack payload deployed on each target network device on the target test file according to the status information set. Considering the execution ratio of all parsing and transmission of the target test file, the cobalt strike authority is always maintained to execute the target test file attack. The attack task on the target test file is divided into several sub-attack tasks of the attack payload corresponding to the cobalt strike client, so as to quantify the defense and detection capability indicators of the security protection server when different monitoring strategies are adopted in the same enterprise network environment by calculating the execution time of completing the attack on the target test file, and finally helps the enterprise find the most suitable monitoring strategy for the target system, improves the accuracy of detecting the network security defense capability of the enterprise security protection server using Cobalt Strike technology, quantifies the protection and detection capability indicators, and explores the optimal monitoring strategy of the security protection server in the target system.

[0062] In a preferred embodiment, the step of obtaining a target test task of a target system and extracting a target test file in the target test task and a device identification set of a plurality of network device groups of the target system specifically includes:

[0063] S11: Accessing a system security test task library; wherein the system security test task library stores a number of test tasks to be executed in sequence, each test task including a target test file and a device identification set of network devices used by each network device group in the target system to execute network security testing;

[0064] S12: The most forward test task in the system security test task library is used as the target test task, and the target test file and device identification sets of several network device groups in the target test task are extracted.

[0065] On this basis, before the step of obtaining the target test task of the target system and extracting the target test file in the target test task and the device identification set of several network device groups of the target system, it also includes:

[0066] S01: Obtain a system security test request uploaded by a target system; wherein the system security test request includes attribute information of each network device group in the target system and a device identification set of each network device group used to perform a network security test;

[0067] S02: Based on the attribute information, determine a target test file for each network device group in the target system; wherein the attribute information is configured as a domain or type to which the network device group in the target system belongs, and the target test file is configured as a test file in a test file library having a number of sub-files and a sub-file size corresponding to the domain or type;

[0068] S03: Generate a test task for the target system according to the target test file of the target system and the device identification sets of several network device groups, and put it into a system security test task library based on the generation time.

[0069] In this embodiment, the target system first uploads a system security test request, and then the cobalt strike server generates a test task for the target system based on the device identification set of each network device group used by the target system to perform network security testing in the system security test request and the attribute information of the target system (considering different network device groups, i.e., network devices in different departments or regions have different file sizes and quantities), and puts it into the system security test task library. After that, the target test file in the target test task and the device identification set of several network device groups are extracted by obtaining the test task that needs to be executed currently in the system security test task library.

[0070] In a preferred embodiment, a plurality of target device identifiers are selected from the device identifier set of each network device group, a target network device corresponding to the target device identifier is determined as a cobalt strike online target corresponding to the network device group and an attack payload is deployed, and a target test file is stored in the target network device determined as a cobalt strike online target corresponding to the network device group, specifically comprising:

[0071] S21: Selecting a number of target device identifiers from the device identifier set of each network device group, and determining the target network device corresponding to the target device identifier as the cobalt strike online target corresponding to the network device group;

[0072] S22: using the communication network within the target system, transmitting the pre-prepared attack payload to each target network device in the network device group, and deploying the attack payload on each target network device;

[0073] S23: Send the target test file to the target network device determined as the cobalt strike online target in each network device group and store it.

[0074] On this basis, the state information set corresponding to the attack payload feedback of the target network device in each network device group is received, and the cobalt strike server is driven to generate the attack strategy steps for each network device group according to the state information set and the monitoring strategy of the security protection server for each network device, including:

[0075] S31: receiving a state information set corresponding to the attack payload feedback from the target network device in each network device group; wherein the state information set is configured as the device operation parameters of the target network device collected by the attack payload, and the device operation parameters include at least one of the CPU usage rate, memory occupancy rate and instantaneous flow value of the target network device;

[0076] S32: Drive the cobalt strike server to generate an attack strategy for each network device group in each subsequent detection cycle based on the status information set of the past target number detection cycles and the status information monitoring critical value of each target network device in the target system.

[0077] Furthermore, the cobalt strike server is driven to generate attack strategy steps for each network device group in each subsequent detection cycle based on the status information set of the past target number detection cycles and the status information monitoring critical value of each target network device in the target system, including:

[0078] S321: driving the cobalt strike server to input the state information set of the past target number of detection cycles into the state information set prediction model of the target network device that has been built and trained in advance, and predicting the state information set of the target network device in each subsequent detection cycle;

[0079] S322: Obtain a state information monitoring critical value of each target network device in the target system, and calculate a device operation parameter redundancy of each target network device in each subsequent detection cycle based on the state information monitoring critical value and a state information set of the target network device in each subsequent detection cycle;

[0080] S323: Based on the number of sub-files and the size of sub-files assigned to execute the sub-file attack task of each network device and the device operation parameter consumption determined according to the preset conversion rules, with the sum of the sub-file coverage of each network device in the network device group assigned to execute the target test file being not less than 1 as the first constraint condition, with the device operation parameter consumption of each network device in the network device group in the corresponding detection cycle being less than the device operation parameter redundancy as the second constraint condition, with the goal of minimizing the sum of the parsing time and the transmission time of the sub-file of the target test file assigned to each network device in the network device group, the sub-file attack task of the target test file is assigned to each network device in the network device group, and generating an attack strategy for each network device group in each subsequent detection cycle.

[0081] Furthermore, the cobalt strike server is driven to input the state information set of the past target number of detection cycles into the pre-built and trained state information set prediction model of the target network device, and predict the state information set step of the target network device in each subsequent detection cycle, and also includes:

[0082] S3201: Obtain a historical status information set of each network device in each network device group, extract the status information sets of the past target number of detection cycles and the status information sets of each subsequent detection cycle from the historical status information set, perform feature engineering, and construct training samples;

[0083] S3202: Input the training samples into a pre-built initial convolutional neural network model for training, and output the convolutional neural network model whose training times meet the requirements or the model converges as the state information set prediction model of the trained target network device.

[0084] In this embodiment, by pre-deploying an attack payload on each network device group of the target system, using the cobalt strike server to communicate with the attack payload to obtain a state information set of each target network device, determining the attack strategy of the attack payload deployed on each target network device on the target test file according to the state information set, considering the execution ratio of all parsing and transmission of the target test file, and always maintaining the cobalt strike authority (that is, the device operation parameter consumption is always less than the device operation parameter redundancy, so that the attack payload maintains a reasonable parsing and transmission speed in the monitoring environment, and maintains the cobalt strike authority is not monitored) to execute the target test file attack as a requirement, the attack task on the target test file is divided into several sub-attack tasks of the attack payload corresponding to the cobalt strike client, so as to quantify the defense and detection capability indicators of the security protection server when adopting different monitoring strategies in the same enterprise network environment by calculating the execution time of completing the attack on the target test file.

[0085] In a preferred embodiment, several sub-attack strategies in the attack strategy are distributed to several cobalt strike clients connected to the cobalt strike server, so that several cobalt strike clients control the attack payload of the corresponding target network device and execute the attack action steps on the target test file, specifically including:

[0086] S41: sending each sub-attack strategy corresponding to the result that the sub-file attack task of the target test file is assigned to each network device in the network device group to several cobalt strike clients connected to the cobalt strike server;

[0087] S42: driving each cobalt strike client to control the attack payload of the corresponding target network device to execute the parsing and transmission actions of the sub-file corresponding to the target test file.

[0088] Furthermore, according to the time taken by each network device group in the target system to complete the attack action of the target test file, the steps of calculating the quantitative value of the network security defense capability of the security protection server against the target system specifically include:

[0089] S51: Obtaining the total time consumed by each network device group in the target system to complete the parsing and transmission of the target test file and the preset weight value of each network device group when calculating the quantitative value of the network security defense capability of the target test file having the corresponding number of sub-files and sub-file size; wherein the network device group with fewer sub-files and larger sub-file sizes is pre-configured to have a smaller weight value;

[0090] S52: The total time taken by each network device group to complete the parsing and transmission of the target test file and the weight value preset by each network device group when calculating the network security defense capability quantification value are determined as the network security defense capability quantification value of the security protection server for the target system.

[0091] In this embodiment, the network security defense capability quantified values ​​of the security protection server when executing different monitoring strategies are ranked from high to low for network security defense capability, and the monitoring strategy with the highest network security defense capability quantified value whose attack false alarm rate is within the allowable range in the network security defense capability ranking result is used as the optimal monitoring strategy for the security protection server, and the defense and detection capability indicators of the security protection server when adopting different monitoring strategies in the same enterprise network environment are quantified by calculating the execution time of the attack on the target test file, thereby ultimately helping the enterprise to find the most suitable monitoring strategy for the target system, improve the accuracy of detecting the network security defense capability of the enterprise security protection server using Cobalt Strike technology, quantify the protection and detection capability indicators, explore the optimal monitoring strategy for the security protection server in the target system, and solve the contradiction that the existing technology cannot balance the frequent attack false alarms caused by the too low setting of the status information monitoring critical value and the poor security caused by the too high setting of the status information monitoring critical value.

[0092] In addition, in order to achieve the above-mentioned purpose, the present invention also provides a system for secretly launching cobalt strike and maintaining authority, including:

[0093] Reference Figure 2 , Figure 2 The structure diagram of the system embodiment of the present invention for secretly launching Cobalt Strike and maintaining authority.

[0094] like Figure 2 As shown, the system for secretly launching Cobalt Strike and maintaining permissions proposed in an embodiment of the present invention includes:

[0095] An extraction module 10 is used to obtain a target test task of a target system, extract a target test file in the target test task and a device identification set of a plurality of network device groups of the target system;

[0096] A determination module 20 is used to select a number of target device identifiers from the device identifier set of each network device group, determine the target network device corresponding to the target device identifier as the cobalt strike online target corresponding to the network device group and deploy the attack payload, and store the target test file to the target network device determined as the cobalt strike online target corresponding to the network device group;

[0097] A generating module 30 is used to receive a state information set corresponding to an attack load feedback from a target network device in each network device group, and drive the cobalt strike server to generate an attack strategy for each network device group according to the state information set and a monitoring strategy of the security protection server for each network device;

[0098] The execution module 40 is used to distribute several sub-attack strategies in the attack strategy to several cobalt strike clients connected to the cobalt strike server, so that the several cobalt strike clients control the attack payload of the corresponding target network device and execute the attack action on the target test file;

[0099] A calculation module 50 is used to calculate the quantitative value of the network security defense capability of the security protection server for the target system according to the time taken by each network device group in the target system to complete the attack action of the target test file;

[0100] The sorting module 60 is used to sort the network security defense capability quantification values ​​of the security protection server when executing different monitoring strategies from high to low, and take the monitoring strategy with the highest network security defense capability quantification value in the network security defense capability sorting result with the attack false alarm rate within the allowable range as the optimal monitoring strategy for the security protection server.

[0101] Other embodiments or specific implementation methods of the system for covertly launching cobalt strike and maintaining authority of the present invention can refer to the above-mentioned method embodiments, which will not be repeated here.

[0102] It is understood that, in the description of this specification, the description with reference to the terms "one embodiment", "another embodiment", "other embodiments", or "first to Nth embodiments" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0103] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0104] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for secretly launching Cobalt Strike and maintaining authority, characterized in that: include: Acquire a target test task of a target system, extract a target test file in the target test task and a device identification set of several network device groups of the target system; Selecting a number of target device identifiers from the device identifier set of each network device group, determining the target network device corresponding to the target device identifier as the cobalt strike online target corresponding to the network device group and deploying the attack payload, and storing the target test file in the target network device determined as the cobalt strike online target corresponding to the network device group; Receive a state information set fed back by the attack load corresponding to the target network device in each network device group, and drive the cobaltstrike server to generate an attack strategy for each network device group according to the state information set and the monitoring strategy of the security protection server for each network device; specifically including: receiving a state information set fed back by the attack load corresponding to the target network device in each network device group; wherein the state information set is configured as the device operation parameters of the target network device collected by the attack load, and the device operation parameters include at least one of the CPU usage rate, memory occupancy rate and instantaneous traffic value of the target network device; drive the cobalt strike server to generate an attack strategy for each network device group in each subsequent detection cycle according to the state information set of the past target number of detection cycles and the state information monitoring critical value of each target network device in the target system; Among them, the cobalt strike server is driven to generate an attack strategy for each network device group in each subsequent detection cycle based on the status information set of the past target number detection cycles and the status information monitoring critical value of each target network device in the target system, specifically including: driving cobalt The strike server inputs the state information set of the past target number of detection cycles into the state information set prediction model of the target network device that has been built and trained in advance, and predicts the state information set of the target network device in each subsequent detection cycle; obtains the state information monitoring critical value of each target network device in the target system, and calculates the device operation parameter redundancy of each target network device in each subsequent detection cycle based on the state information monitoring critical value and the state information set of the target network device in each subsequent detection cycle; according to the number of sub-files and the size of the sub-files assigned to execute the sub-file attack task of each network device, the device operation parameter consumption is determined according to the preset conversion rule, with the sum of the sub-file coverage rate of each network device in the network device group assigned to execute the target test file being not less than 1 as the first constraint condition, and the device operation parameter consumption of each network device in the network device group in the corresponding detection cycle being less than the device operation parameter redundancy as the second constraint condition, and with the shortest sum of the parsing time and the transmission time of the sub-file of the assigned target test file executed by each network device in the network device group as the goal, the sub-file attack task of the target test file is assigned to each network device in the network device group, and the attack strategy of each network device group in each subsequent detection cycle is generated; Distribute several sub-attack strategies in the attack strategy to several cobaltstrike clients connected to the cobalt strike server, so that several cobalt strike clients control the attack payloads of the corresponding target network devices and execute attack actions on the target test files; Calculate the quantitative value of the network security defense capability of the security protection server against the target system based on the time taken by each network device group in the target system to complete the attack action of the target test file; The network security defense capability quantified values ​​of the security protection server when executing different monitoring strategies are ranked from high to low, and the monitoring strategy with the highest network security defense capability quantified value in the network security defense capability ranking result with the attack false alarm rate within the allowable range is taken as the optimal monitoring strategy for the security protection server.

2. The method for secretly launching Cobalt Strike and maintaining authority as claimed in claim 1, characterized in that: The step of obtaining a target test task of a target system and extracting a target test file in the target test task and a device identification set of a plurality of network device groups of the target system specifically includes: Accessing a system security test task library; wherein the system security test task library stores a number of test tasks to be executed in sequence, each test task including a target test file and a device identification set of network devices used by each network device group in the target system to perform network security testing; The most forward test task in the system security test task library is taken as the target test task, and the target test file and the device identification sets of several network device groups in the target test task are extracted.

3. The method for secretly launching Cobalt Strike and maintaining authority as claimed in claim 2, characterized in that: Before the step of obtaining the target test task of the target system and extracting the target test file in the target test task and the device identification set of several network device groups of the target system, the method further includes: Obtaining a system security test request uploaded by the target system; wherein the system security test request includes attribute information of each network device group in the target system and a device identification set of each network device group used to perform network security testing; Based on the attribute information, determine the target test file of each network device group in the target system; wherein the attribute information is configured as the domain or type to which the network device group in the target system belongs, and the target test file is configured as a test file in a test file library having a number of sub-files and a sub-file size corresponding to the domain or type; According to the target test file of the target system and the device identification sets of several network device groups, the test tasks of the target system are generated and put into the system security test task library based on the generation time.

4. The method for secretly launching Cobalt Strike and maintaining authority as claimed in claim 3, characterized in that: The steps of selecting a plurality of target device identifiers from the device identifier set of each network device group, determining the target network device corresponding to the target device identifier as the cobalt strike online target corresponding to the network device group and deploying the attack payload, and storing the target test file in the target network device determined as the cobalt strike online target corresponding to the network device group, specifically include: Select several target device identifiers from the device identifier set of each network device group, and determine the target network device corresponding to the target device identifier as the cobalt strike online target corresponding to the network device group; Utilizing the communication network within the target system, transmitting a pre-prepared attack payload to each target network device in the network device group, and deploying the attack payload on each target network device; The target test file is sent to the target network device identified as the cobalt strike online target in each network device group and stored.

5. The method for secretly launching Cobalt Strike and maintaining authority as claimed in claim 4, characterized in that: The cobalt strike server is driven to input the state information set of the target number of detection cycles in the past into the state information set prediction model of the target network device that has been built and trained in advance, and predict the state information set step of the target network device in each subsequent detection cycle, and also includes: Obtain the historical status information set of each network device in each network device group, extract the status information set of the past target number of detection cycles and the status information set of each subsequent detection cycle from the historical status information set, perform feature engineering, and construct training samples; The training samples are input into a pre-built initial convolutional neural network model for training, and the output of the convolutional neural network model whose training times meet the requirements or the model converges is used as the state information set prediction model of the trained target network device.

6. The method for secretly launching Cobalt Strike and maintaining authority as claimed in claim 5, characterized in that: Distribute several sub-attack strategies in the attack strategy to several cobaltstrike clients connected to the cobalt strike server, so that several cobalt strike clients control the attack payload of the corresponding target network device and execute the attack action steps on the target test file, including: Send each sub-attack strategy corresponding to the result that the sub-file attack task of the target test file is assigned to each network device in the network device group to several cobalt strike clients connected to the cobalt strike server; Drive each cobalt strike client to control the attack payload of the corresponding target network device to execute the parsing and transmission actions of the corresponding sub-files of the target test file.

7. The method for secretly launching Cobalt Strike and maintaining authority as claimed in claim 6, characterized in that: According to the time taken by each network device group in the target system to complete the attack action of the target test file, the steps of calculating the quantitative value of the network security defense capability of the security protection server against the target system specifically include: Obtaining the total time consumed by each network device group in the target system to complete the parsing and transmission of the target test file and the preset weight value of each network device group in calculating the quantitative value of the network security defense capability of the target test file with the corresponding number of sub-files and sub-file size; wherein the network device group with fewer sub-files and larger sub-file sizes is pre-configured to have a smaller weight value; The total time taken by each network device group to complete the parsing and transmission of the target test file and the weight value preset when calculating the network security defense capability quantification value of each network device group are determined as the network security defense capability quantification value of the security protection server for the target system.

8. A system for secretly launching Cobalt Strike and maintaining authority, characterized in that: include: An extraction module, used to obtain a target test task of a target system, extract a target test file in the target test task and a device identification set of several network device groups of the target system; A determination module is used to select a number of target device identifiers from the device identifier set of each network device group, determine the target network device corresponding to the target device identifier as the cobalt strike online target corresponding to the network device group and deploy the attack payload, and store the target test file to the target network device determined as the cobalt strike online target corresponding to the network device group; A generation module is used to receive a state information set fed back by an attack load corresponding to a target network device in each network device group, and drive a cobalt strike server to generate an attack strategy for each network device group according to the state information set and a monitoring strategy of a security protection server for each network device; specifically comprising: receiving a state information set fed back by an attack load corresponding to a target network device in each network device group; wherein the state information set is configured as a device operation parameter of the target network device collected by the attack load, and the device operation parameter includes at least one of a CPU usage rate, a memory occupancy rate, and an instantaneous flow value of the target network device; and driving a cobalt strike server to generate an attack strategy for each network device group in each subsequent detection cycle according to the state information set of the past target number of detection cycles and a state information monitoring critical value of each target network device in the target system; Among them, the cobalt strike server is driven to generate an attack strategy for each network device group in each subsequent detection cycle based on the status information set of the past target number detection cycles and the status information monitoring critical value of each target network device in the target system, specifically including: driving cobalt The strike server inputs the state information set of the past target number of detection cycles into the state information set prediction model of the target network device that has been built and trained in advance, and predicts the state information set of the target network device in each subsequent detection cycle; obtains the state information monitoring critical value of each target network device in the target system, and calculates the device operation parameter redundancy of each target network device in each subsequent detection cycle based on the state information monitoring critical value and the state information set of the target network device in each subsequent detection cycle; according to the number of sub-files and the size of the sub-files assigned to execute the sub-file attack task of each network device, the device operation parameter consumption is determined according to the preset conversion rule, with the sum of the sub-file coverage rate of each network device in the network device group assigned to execute the target test file being not less than 1 as the first constraint condition, and the device operation parameter consumption of each network device in the network device group in the corresponding detection cycle being less than the device operation parameter redundancy as the second constraint condition, and with the shortest sum of the parsing time and the transmission time of the sub-file of the assigned target test file executed by each network device in the network device group as the goal, the sub-file attack task of the target test file is assigned to each network device in the network device group, and the attack strategy of each network device group in each subsequent detection cycle is generated; An execution module is used to distribute several sub-attack strategies in the attack strategy to several cobalt strike clients connected to the cobalt strike server, so that the several cobalt strike clients control the attack payloads of the corresponding target network devices and execute the attack actions on the target test files; A calculation module, used to calculate the quantitative value of the network security defense capability of the security protection server against the target system according to the time taken by each network device group in the target system to complete the attack action of the target test file; The sorting module is used to sort the network security defense capability quantification values ​​of the security protection server when executing different monitoring strategies from high to low, and take the monitoring strategy with the highest network security defense capability quantification value in the network security defense capability sorting result with the attack false alarm rate within the allowable range as the optimal monitoring strategy for the security protection server.

Images