Method for dynamically distributing targets in network security target range

Abstract

The invention provides a method for dynamically distributing targets in a network security target range, which comprises the following steps of: randomly distributing a target for each team, and starting exercise; detecting whether the occupation time of each team on the distributed target ends or not; the access of the finished team to the distributed target is disconnected under the ending condition, a new target is applied for the distributed target under the non-ending condition and under the condition that the non-ending team completes penetration of the distributed target, and the access of the non-ending team to the distributed target is maintained under the condition that penetration is not completed. Breaking the access to the distributed target until the time is up; applying for a new target for a team in which access to the assigned target has been disconnected; the referee checks the new target applied by each team; if the audit is passed, the target range control end gives the access authority of the team passing the audit to the new target applied by the team, and if the audit is not passed, a new target is re-applied for the team not passing the audit after waiting for a preset time.

Description

Technical Field

[0001] The present invention relates to the field of automation and control, and in particular to a method, electronic equipment and storage medium for dynamically allocating targets in a network security target range. Background Art

[0002] With the rapid development of information technology, the information confrontation between countries has become more intense, and the problem of network security has become more serious. The essence of network security lies in confrontation, and the essence of confrontation is the contest between the offensive and defensive capabilities. In order to improve the competitiveness of network security, countries around the world have successively built network security target ranges for carrying out red-blue confrontation attack and defense drills, network security technology research and development, product security testing, and network security skills training.

[0003] Existing cybersecurity range technologies usually assign targets to different teams at the beginning of an exercise and keep the assignments fixed throughout the exercise. This fixed target assignment method lacks flexibility, leading to the following problems in actual operations:

[0004] Inability to flexibly switch targets: In existing technologies, once a target is assigned to a team, the connection between the target and the team is fixed, and the target cannot be flexibly switched during the entire exercise. This is particularly inconvenient in scenarios where frequent strategy adjustments are required or multiple teams participate.

[0005] Waste of resources: When an exercise team completes the infiltration or operation of a target, if there is no mechanism to reallocate the target to other teams, the target will be idle, resulting in a waste of resources. At the same time, since the allocation cannot be adjusted dynamically, in some cases, the problem of the mismatch between the number of targets and the number of teams cannot be solved.

[0006] Lack of support for complex scenarios: In some complex cybersecurity exercise scenarios, multiple teams need to infiltrate multiple targets at the same time, and need to flexibly adjust target allocation at different time periods. Such complex exercise requirements cannot be achieved with existing technologies, and can usually only be compensated by manually adjusting network connections offline, which is inefficient.

[0007] In order to overcome these defects, a more flexible and intelligent network security range technology is urgently needed, which can dynamically adjust the distribution of targets during the exercise, improve the realism and effectiveness of the exercise, and meet the needs of various complex scenarios. This is also the technical problem to be solved by the present invention. Summary of the invention

[0008] The embodiments of the present disclosure aim to solve at least one of the technical problems existing in the prior art, and provide a method for dynamically allocating targets in a network security target range, the method comprising:

[0009] Randomly assign each team a target and begin the exercise;

[0010] Check whether each team's possession time of the assigned target has ended;

[0011] In the case of completion, the access of the completed team to the assigned target is disconnected; in the case of incomplete completion, it is determined whether the incomplete team has completed the penetration of the assigned target;

[0012] If the unfinished team has completed the penetration of the assigned target, apply for a new target for it. If the unfinished team has not completed the penetration of the assigned target, maintain the unfinished team's access to the assigned target until the occupation time ends and its access to the assigned target is disconnected;

[0013] Request new targets for teams that have lost access to their assigned targets;

[0014] The referees review the new targets applied for by each team;

[0015] If the review is passed, the shooting range control terminal will grant the team that has passed the review access rights to the new targets that they have applied for. If the review is not passed, the range control terminal will reapply for new targets for the team that has not passed the review after waiting for a preset time.

[0016] In combination with the first aspect, the number of targets is greater than or equal to the number of teams.

[0017] In combination with the first aspect, the target can only be occupied by one team during a single occupation time.

[0018] In combination with the first aspect, the target becomes a vacant target after the team finishes occupying it, and is reallocated as a new target when the team applies for it.

[0019] In combination with the first aspect, when the referee approves the team's application for a new target, the team's access to the historically occupied targets is disconnected.

[0020] In combination with the first aspect, when the review is passed, the shooting range control end grants the team that has passed the review access rights to the new target that it has applied for, including granting the team that has passed the review access rights to the new target through a control program that modifies the virtual firewall rules through the shooting range control end.

[0021] In combination with the first aspect, one end of the virtual firewall interaction port is connected to the team's network, and the other end is connected to the shooting range's network.

[0022] In combination with the first aspect, in the case of failure in the review, after waiting for a preset time, reapplying for a new target for the team that failed the review includes:

[0023] If the review fails, the team that failed the review, the team whose occupation time has ended, and the team that has completed the penetration of the target will apply for a new target after waiting for a preset time.

[0024] According to a second aspect of the present disclosure, there is provided an electronic device, comprising:

[0025] one or more processors;

[0026] A storage unit is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors can implement any of the above-mentioned methods for dynamically allocating targets in a network security target field.

[0027] According to a third aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it can implement any of the above-mentioned methods for dynamically allocating targets in a network security target range.

[0028] The method, electronic device and storage medium for dynamically allocating targets in a network security target range provided by the present invention add a virtual firewall to the existing target range network, so that after the teams participating in the exercise complete the penetration task of a certain target, they can apply to replace a new target. The function of flexibly switching targets for different exercise teams during the network security exercise is realized. The flexibility of the exercise is improved, and the team can switch targets at any time during the exercise to avoid waste of resources; the utilization rate of target resources is optimized, complex exercise scenarios are supported, and the cost of manual intervention and management is significantly reduced, and the automation level and operation efficiency of the system are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A schematic diagram of a process for dynamically allocating targets in a network security target range according to an embodiment of the present disclosure;

[0030] Figure 2 A schematic diagram of the network topology in the network security target field of the embodiment of the present disclosure;

[0031] Figure 3 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of the present disclosure.

[0033] The terms used in the disclosed embodiments are only for the purpose of describing specific embodiments and are not intended to limit the disclosed embodiments. The singular forms of "a", "said" and "the" used in the disclosed embodiments and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0034] It should be understood that although the terms first, second, third, etc. may be used to describe various information in the disclosed embodiments, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the disclosed embodiments, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0035] like Figure 1 FIG. 1 is a flow chart of a method for dynamically allocating targets in a network security target field according to an embodiment of the present disclosure. The method includes the following steps:

[0036] Randomly assign each team a target and begin the exercise;

[0037] Check whether each team's possession time of the assigned target has ended;

[0038] In the case of completion, the access of the completed team to the assigned target is disconnected; in the case of incomplete completion, it is determined whether the incomplete team has completed the penetration of the assigned target;

[0039] If the unfinished team has completed the penetration of the assigned target, apply for a new target for it. If the unfinished team has not completed the penetration of the assigned target, maintain the unfinished team's access to the assigned target until the occupation time ends and its access to the assigned target is disconnected;

[0040] Request new targets for teams that have lost access to their assigned targets;

[0041] The referees review the new targets applied for by each team;

[0042] If the review is passed, the shooting range control terminal will grant the team that has passed the review access rights to the new targets that they have applied for. If the review is not passed, the range control terminal will reapply for new targets for the team that has not passed the review after waiting for a preset time.

[0043] Refer to the following Figure 2-Figure 3 The control method is described in detail.

[0044] like Figure 2 The figure shows a schematic diagram of the network topology in the network security target field of the embodiment of the present disclosure.

[0045] There are n exercise teams and m targets, where m is greater than or equal to n. Each target is electrically connected to a target range network, each team is electrically connected to a virtual firewall through a switch, and the target range network is electrically connected to the virtual firewall.

[0046] The range network is also electrically connected to the range control terminal, which sends a program to modify the virtual firewall policy through the range network, cuts off any exercise team's access rights to existing targets, and allocates access rights to newly applied targets to the exercise team.

[0047] Before the exercise begins, assign targets to each team.

[0048] Specifically, n targets are randomly selected from m targets, and these n targets are randomly assigned to n teams one by one, and each team has only one target.

[0049] After the targets are assigned, the exercise begins, and each team begins to "attack" the assigned targets. Each team has a limited time to access the assigned targets, which is called the possession time.

[0050] Preferably, the possession time is fixed, and before the possession time ends, some teams have already "captured" the target. In this case, it is called completing the penetration of the assigned target.

[0051] If the assigned target has been infiltrated before the possession time expires, a new target will be requested for this team.

[0052] If the assigned target has not been infiltrated before the possession time ends, continue the "attack" to maintain the team's access to the target until the possession time ends and a new target is requested for the team.

[0053] If some teams have not "captured" the assigned target after the occupation time ends, that is, they have not completed the infiltration of the assigned target, then the access rights of this team to the target will be cut off after the occupation time ends, and a new target will be applied for this team.

[0054] The referee reviews the new targets applied for by each team. The referee can review the application manually or automatically according to pre-set review rules.

[0055] The review content includes but is not limited to determining whether the new target applied for by the applicant team is vacant, whether the applicant team is allowed to continue the application, and prioritizing the applicant team's application based on the historical exercise results of each applicant team.

[0056] After the referee has approved the new targets applied for by each team, the control program of the virtual firewall rules is modified through the shooting range control end to grant the approved team access to the new targets.

[0057] Specifically, the range control end controls the control program that modifies the virtual firewall rules to cut off the team's network access rights to the previously occupied target, modifies the firewall rules of the virtual firewall, stops the communication between the team and the old target, and ensures that data traffic can no longer pass through the connection. The purpose of this step is to prevent the team from still being able to access the old target after occupying the new target, to ensure the fairness of the competition and the standardization of the exercise.

[0058] While disconnecting the old target, the rules of the virtual firewall will be updated to allow the approved team to access the new target assigned to it. The control program will dynamically generate a new firewall rule to specify the communication path between the team's IP address or network area and the network area of ​​the new target, thereby ensuring that the team can successfully establish a network connection with the new target and continue penetration testing or other exercise tasks.

[0059] This process does not require manual intervention and is completely dependent on the automated program interaction between the range control terminal and the virtual firewall, which greatly improves the efficiency and fluency of the exercise. Through this method of dynamically modifying firewall rules, multiple teams in the range can conduct flexible attack and defense exercises against different targets in different time periods, improving the flexibility and intelligence level of the network range.

[0060] If the referee fails to pass the review of the new targets applied for by each team, the team that failed the review will be required to wait for a preset time, which is not limited to a fixed time. Preferably, the preset time is the time when the next round of team exercises ends and applies for new targets, including the team that completes the infiltration ahead of schedule and the team whose occupation time has ended.

[0061] The method, electronic device, and storage medium for dynamically allocating targets in a network security target range provided by the embodiments of the present disclosure add a virtual firewall to the existing target range network, so that after the teams participating in the exercise complete the penetration task of a certain target, they can apply to replace a new target. The function of flexibly switching targets for different exercise teams during the network security exercise is realized. The flexibility of the exercise is improved, and the team can switch targets at any time during the exercise to avoid waste of resources; the utilization rate of target resources is optimized, complex exercise scenarios are supported, and the cost of manual intervention and management is significantly reduced, which improves the automation level and operation efficiency of the system.

[0062] The electronic device 300 may be a desktop computer, a notebook, a PDA, a cloud server, or other electronic device. The electronic device 300 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will appreciate that Figure 3 It is only an example of the electronic device 300 and does not constitute a limitation of the electronic device 300. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0063] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0064] The memory 302 may be an internal storage unit of the electronic device 300, for example, a hard disk or memory of the electronic device 300. The memory 302 may also be an external storage device of the electronic device 300, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 300. Further, the memory 302 may also include both an internal storage unit of the electronic device 300 and an external storage device. The memory 302 is used to store the computer program 303 and other programs and data required by the electronic device. The memory 302 may also be used to temporarily store data that has been output or is to be output.

[0065] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present disclosure. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0066] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0067] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0068] In the embodiments provided in the present disclosure, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of devices or units, which may be electrical, mechanical or other forms.

[0069] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0070] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0071] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present disclosure implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, and the computer program code may be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electric carrier signals and telecommunication signals.

[0072] The above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should all be included in the protection scope of the present disclosure.

Claims

1. A method for dynamically allocating targets in a network security target range, characterized in that: The method comprises: Randomly assign each team a target and begin the exercise; Check whether each team's possession time of the assigned target has ended; In the case of completion, the access of the completed team to the assigned target is disconnected; in the case of incomplete completion, it is determined whether the incomplete team has completed the penetration of the assigned target; If the unfinished team has completed the penetration of the assigned target, apply for a new target for it. If the unfinished team has not completed the penetration of the assigned target, maintain the unfinished team's access to the assigned target until the occupation time ends and its access to the assigned target is disconnected; Request new targets for teams that have lost access to their assigned targets; The referees review the new targets applied for by each team; If the review is passed, the shooting range control terminal will grant the team that has passed the review access to the new target it has applied for. If the review is not passed, the team that has not passed the review will reapply for a new target after waiting for a preset time.

2. The method according to claim 1, characterized in that The number of the targets is greater than or equal to the number of the teams.

3. The method according to claim 1, characterized in that The target can only be occupied by one team during a single occupation time.

4. The control method according to claim 1, characterized in that: The target becomes a vacant target after the team finishes occupying it, and is reallocated as a new target when the team applies for it.

5. The control method according to claim 1, characterized in that: When the referee approves the team's new target application, its access to historically occupied targets will be disconnected.

6. The control method according to claim 1, characterized in that: In the case of passing the review, the range control terminal grants the team that has passed the review access rights to the new target that it has applied for, including granting the team that has passed the review access rights to the new target through a control program that modifies the virtual firewall rules by the range control terminal.

7. The method according to claim 6, characterized in that One end of the virtual firewall interaction port is connected to the network of the team, and the other end is connected to the network of the shooting range.

8. The method according to claim 1, characterized in that In the case of failure to pass the review, after waiting for a preset time, the team that failed the review will reapply for a new target, including: If the review fails, the team that failed the review, the team whose occupation time has ended, and the team that has completed the penetration of the target will apply for a new target after waiting for a preset time.

9. An electronic device, characterized in that: include: one or more processors; A storage unit, used to store one or more programs, which, when executed by the one or more processors, enable the one or more processors to implement the method for dynamically allocating targets in a network security target range according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it can implement the method for dynamically allocating targets in a network security target range according to any one of claims 1 to 8.

Images