Vulnerability-customizable network attack exercise method, device, equipment, medium and program product

Abstract

The invention relates to a vulnerability-customizable network attack exercise method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring asset information of a to-be-simulated attack network space, and generating candidate simulated attack paths according to the asset information; determining a target asset according to the candidate simulation attack path, and generating a vulnerability simulation tool and a vulnerability utilization tool corresponding to the target asset; the vulnerability utilization tool is used for simulating vulnerabilities by using the vulnerability simulation tool; and under the condition that the vulnerability simulation tool is configured in the target asset, generating a simulation vulnerability through the vulnerability simulation tool, and generating a network attack maneuver scheme through the simulation vulnerability and the vulnerability utilization tool. By adopting the method, the attack intensity in the network attack exercise can be improved, and the comprehensiveness of the capability test of the defense party can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of network attack simulation, and in particular to a network attack exercise method, apparatus, computer equipment, computer-readable storage medium and computer program product with customizable vulnerabilities. Background Art

[0002] With the development of the Internet and information technology, the security of computer networks has received increasing attention. Currently, network attack and defense exercises are often used to test the security of computer systems. However, in actual network attack and defense exercises, it is uncertain what vulnerabilities exist in computer networks, and it is difficult to dig them out on site, especially for high-risk vulnerabilities at the bottom of the operating system, which are extremely difficult and there is almost no precedent for digging them out on site.

[0003] The traditional method of acquiring "zero-day vulnerabilities" through procurement is not only costly, but also difficult to match with various exercise scenarios. Summary of the invention

[0004] Based on this, it is necessary to provide a vulnerability-customizable network attack exercise method, apparatus, computer equipment, computer-readable storage medium and computer program product that can match a variety of exercise scenarios to address the above-mentioned technical problems.

[0005] In a first aspect, the present application provides a vulnerability customizable network attack exercise method, comprising:

[0006] Acquire asset information of the network space to be simulated attacked, and generate candidate simulated attack paths according to the asset information;

[0007] Determine the target asset according to the candidate simulated attack path, and generate a vulnerability simulation tool and a vulnerability exploitation tool corresponding to the target asset; the vulnerability exploitation tool is used to use the vulnerability simulated by the vulnerability simulation tool;

[0008] In the case where the vulnerability simulation tool is configured in the target asset, a simulated vulnerability is generated by the vulnerability simulation tool, and a network attack exercise plan is generated by the simulated vulnerability and the vulnerability exploitation tool.

[0009] In one embodiment, the candidate simulated attack path includes at least one of a network attack, a supply chain attack, a social engineering attack, a USB ferry attack, and an Internet of Things attack; and determining the target asset according to the candidate simulated attack path includes:

[0010] Determine a target simulated attack path according to the candidate simulated attack path, obtain relevant assets on the target simulated attack path, and use the relevant assets as target assets; the relevant assets include at least one of a firewall, a switch, a server, a terminal, and an isolation device.

[0011] In one embodiment, the vulnerability simulation tool includes vulnerability simulation software; the generating of the vulnerability simulation tool and the vulnerability exploitation tool corresponding to the target asset includes:

[0012] When the target asset meets the software installation conditions, the operating environment of the target asset and various permissions and data required for simulating vulnerabilities of the target asset are obtained, and vulnerability simulation software corresponding to the target asset and adapted to the operating environment is generated; the vulnerability simulation software is used to be legally installed on the target asset;

[0013] A vulnerability exploitation tool is generated according to the vulnerability simulation software.

[0014] In one of the embodiments, the vulnerability simulation software is used to simulate the harmful consequences and exploitation methods of existing vulnerabilities, and the harmful consequences include at least one of permission control, data leakage, and software and hardware function failure.

[0015] In one embodiment, the vulnerability simulation tool includes a vulnerability simulation device; the vulnerability simulation device includes a network port and a management port matching the target asset; the network port is used to connect to the network port of the target asset, and the management port is used to connect to the management port of the target asset;

[0016] The generating of the vulnerability simulation tool and the vulnerability exploitation tool corresponding to the target asset comprises:

[0017] In the case that the target asset does not have the software installation conditions, a vulnerability simulation device is obtained; and a vulnerability exploitation tool is generated according to the vulnerability simulation device.

[0018] In one embodiment, the vulnerability simulation device includes a first network port and a second network port, the first network port is used to connect to an input network port of the target asset, and the second network port is used to connect to an output network port of the target asset.

[0019] In a second aspect, the present application also provides a network attack exercise device, including:

[0020] A path generation module, used to obtain asset information of the network space to be simulated and attack, and generate candidate simulated attack paths according to the asset information;

[0021] A tool generation module, used to determine a target asset according to the candidate simulated attack path, and generate a vulnerability simulation tool and a vulnerability exploitation tool corresponding to the target asset; the vulnerability exploitation tool is used to use the vulnerability simulated by the vulnerability simulation tool;

[0022] The exercise plan generation module is used to generate a simulated vulnerability through the vulnerability simulation tool when the vulnerability simulation tool is configured in the target asset, and to generate a network attack exercise plan through the simulated vulnerability and the vulnerability exploitation tool.

[0023] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0024] Acquire asset information of the network space to be simulated attacked, and generate candidate simulated attack paths according to the asset information;

[0025] Determine the target asset according to the candidate simulated attack path, and generate a vulnerability simulation tool and a vulnerability exploitation tool corresponding to the target asset; the vulnerability exploitation tool is used to use the vulnerability simulated by the vulnerability simulation tool;

[0026] In the case where the vulnerability simulation tool is configured in the target asset, a simulated vulnerability is generated by the vulnerability simulation tool, and a network attack exercise plan is generated by the simulated vulnerability and the vulnerability exploitation tool.

[0027] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0028] Acquire asset information of the network space to be simulated attacked, and generate candidate simulated attack paths according to the asset information;

[0029] Determine the target asset according to the candidate simulated attack path, and generate a vulnerability simulation tool and a vulnerability exploitation tool corresponding to the target asset; the vulnerability exploitation tool is used to use the vulnerability simulated by the vulnerability simulation tool;

[0030] In the case where the vulnerability simulation tool is configured in the target asset, a simulated vulnerability is generated by the vulnerability simulation tool, and a network attack exercise plan is generated by the simulated vulnerability and the vulnerability exploitation tool.

[0031] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0032] Acquire asset information of the network space to be simulated attacked, and generate candidate simulated attack paths according to the asset information;

[0033] Determine the target asset according to the candidate simulated attack path, and generate a vulnerability simulation tool and a vulnerability exploitation tool corresponding to the target asset; the vulnerability exploitation tool is used to use the vulnerability simulated by the vulnerability simulation tool;

[0034] In the case where the vulnerability simulation tool is configured in the target asset, a simulated vulnerability is generated by the vulnerability simulation tool, and a network attack exercise plan is generated by the simulated vulnerability and the vulnerability exploitation tool.

[0035] The above-mentioned vulnerability-customizable network attack exercise method, device, computer equipment, computer-readable storage medium and computer program product obtain asset information of the network space to be simulated and attack, generate candidate simulated attack paths according to the asset information, and then determine the target asset according to the candidate simulated attack path, and then generate vulnerability simulation tools and vulnerability exploitation tools corresponding to the target asset, and then generate simulated vulnerabilities through the vulnerability simulation tool when the vulnerability simulation tool is configured in the target asset, and then generate a network attack exercise plan through the simulated vulnerability and the vulnerability exploitation tool; in the above-mentioned scheme, through the candidate simulated attack paths, vulnerability simulation tools and vulnerability exploitation tools, it is possible to realize the false "network security risks" required on any specified attack path, so that the network attack exercise plan obtained in this way is more realistic, can improve the attack intensity in the network attack exercise, and can improve the comprehensiveness of the defense capability test. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] FIG1 is a schematic diagram of a flow chart of a vulnerability-customizable network attack exercise method in one embodiment;

[0038] FIG2 is a schematic diagram of a process of generating a vulnerability simulation tool and a vulnerability exploitation tool corresponding to a target asset in one embodiment;

[0039] FIG3 is a schematic diagram of an installation environment of a vulnerability simulation device in one embodiment;

[0040] FIG4 is a structural block diagram of a network attack exercise device in one embodiment;

[0041] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0043] In actual network attack and defense exercises, it is uncertain what vulnerabilities exist in the network system, and it is difficult to dig them out on site, especially high-risk vulnerabilities at the bottom layer such as the operating system, which are extremely difficult and there is almost no precedent for digging them out on site. If "zero-day vulnerabilities" are obtained through procurement, it is not only costly, but also difficult to customize according to the exercise scenario, and it is easy for vulnerabilities to not match. Therefore, current exercises are difficult to simulate high-intensity attack scenarios such as large-scale use of "zero-day vulnerabilities", making it impossible to fully and comprehensively test the network security defense line and the handling capabilities of defenders. Therefore, a network attack and defense actual combat exercise method that can arbitrarily specify attack paths is needed.

[0044] In order to arbitrarily specify the attack path in the network attack and defense actual combat exercise, in an exemplary embodiment, as shown in FIG1 , a network attack exercise method with customizable vulnerabilities is provided, including the following steps S102 to S106. Among them:

[0045] Step S102, obtaining asset information of the network space to be simulated attacked, and generating candidate simulated attack paths based on the asset information.

[0046] The asset information may refer to the detailed data of various resources and services existing in the cyberspace to be simulated. The assets involved in the asset information may include software assets and hardware assets in the cyberspace. The aforementioned assets may specifically include firewalls, network equipment (switches, routers, etc.), servers, terminals, isolation devices, etc., and may also include workstations, databases, applications, etc.

[0047] Among them, the candidate simulated attack path can be based on the collected asset information, and the attack route or attack method against the specified assets in the current network system can be analyzed and designed from the attacker's perspective. For example, the attack path can be one of the multiple methods such as network attack, supply chain attack, social engineering attack, USB flash drive ferry attack, Internet of Things attack, etc., or any combination of the aforementioned multiple methods.

[0048] Step S104, determining the target asset according to the candidate simulated attack path, generating a vulnerability simulation tool and a vulnerability exploitation tool corresponding to the target asset, wherein the vulnerability exploitation tool is used to exploit the vulnerability simulated by the vulnerability simulation tool.

[0049] The target asset may refer to a specific resource selected as an attack target in the candidate simulated attack path. For example, the candidate simulated attack path includes attack path 1, and attack path 1 includes attack assets A, B, C, D, and E. Assuming that assets A and C are selected as specific attack targets in attack path 1, then assets A and C are target assets, and then vulnerability simulation tool A and vulnerability simulation tool C are generated for assets A and C respectively.

[0050] Among them, a vulnerability simulation tool can be a tool used to create specific simulated security vulnerabilities in cyberspace; a vulnerability exploitation tool can be used to exploit known security vulnerabilities and conduct attack tests. For example, in an exercise scenario, the vulnerability exploitation tool performs attack actions against the "simulated vulnerability" generated by the vulnerability simulation tool.

[0051] Step S106, when the vulnerability simulation tool is configured in the target asset, a simulated vulnerability is generated by the vulnerability simulation tool, and a network attack exercise plan is generated by the simulated vulnerability and the vulnerability exploitation tool.

[0052] Among them, simulated vulnerability can refer to a false security vulnerability deliberately created in a controlled environment, such as application vulnerability, operating system vulnerability, network protocol vulnerability, etc. A network attack exercise plan can be a plan that includes specific attack paths, specific attack targets, and corresponding vulnerability simulation tools and vulnerability exploitation tools for the network space to be simulated.

[0053] Exemplarily, an automated scanning tool can be used to conduct a comprehensive scan of the cyberspace to be simulated attacked, identify the assets and their corresponding attributes associated with the cyberspace to be simulated attacked, and then, based on the information of the aforementioned assets and attributes and in combination with preset exercise materials, construct multiple possible attack vectors as candidate simulated attack paths; then, the target assets on each path are determined from the aforementioned candidate simulated attack paths, that is, the assets to be specifically attacked on each path; then, a vulnerability simulation tool is generated for the target asset, and then a corresponding vulnerability exploitation tool is generated based on the vulnerability simulation tool, so as to use the vulnerability simulated by the aforementioned vulnerability simulation tool through the vulnerability exploitation tool; then, the vulnerability simulation tool can be deployed on the target asset, and a specific type of simulated vulnerability for the target asset can be generated on the target asset through the vulnerability simulation tool, and then the vulnerability exploitation tool can be used to launch an attack, and the above process is combined to obtain a network attack exercise plan.

[0054] In the above vulnerability customizable network attack drill method, by obtaining the asset information of the network space to be simulated attacked, generating candidate simulated attack paths according to the asset information, and then determining the target asset according to the candidate simulated attack paths, and then generating vulnerability simulation tools and vulnerability exploitation tools corresponding to the target asset, and then, when the vulnerability simulation tool is configured in the target asset, generating simulated vulnerabilities through the above vulnerability simulation tool, and then generating a network attack drill plan through the simulated vulnerabilities and vulnerability exploitation tools; in the above plan, through the candidate simulated attack paths, vulnerability simulation tools and vulnerability exploitation tools, it is possible to realize the false "network security risks" required on any specified attack path, so that the network attack drill plan obtained in this way is more realistic, can improve the attack intensity in the network attack drill, and can improve the comprehensiveness of the defense capability test.

[0055] In an exemplary embodiment, the candidate simulated attack paths include at least one of network attacks, supply chain attacks, social engineering attacks, USB ferry attacks, and Internet of Things attacks; the target assets determined according to the candidate simulated attack paths may specifically include:

[0056] Determine the target simulated attack path based on the above candidate simulated attack paths, obtain the relevant assets on the above target simulated attack path, and use the above relevant assets as target assets; the above relevant assets include at least one of firewalls, switches, servers, terminals, and isolation devices.

[0057] Among them, network attacks can refer to attacks launched directly against target networks or systems through public networks, such as DDoS attacks, Web application attacks, remote code execution, etc.

[0058] Among them, supply chain attacks can refer to attackers indirectly attacking end users or organizations by infiltrating a certain link in the software supply chain (such as suppliers or third-party services).

[0059] Among them, social engineering attacks can refer to the use of user character weaknesses (such as curiosity, trust, greed, etc.) to induce victims to disclose sensitive information or perform certain actions.

[0060] Among them, USB flash drive ferrying attack can refer to bringing malware into the target network through physical means (such as USB flash drives or other removable media). For example, an attacker may place a USB flash drive infected with malware in a public area of ​​the target organization and wait for an unsuspecting employee to insert it into a company computer.

[0061] Among them, IoT attacks can refer to attacks against IoT devices (such as smart cameras, smart home devices, etc.). These devices usually have low security and can easily become attack entry points.

[0062] Among them, a firewall can refer to a network security system that monitors and controls the inbound and outbound network traffic of simulated attack network space to prevent unauthorized access. A firewall can be a hardware device or a software application. For example, a hardware firewall can be a dedicated device that is set outside the network boundary and is responsible for monitoring and filtering the inbound and outbound network traffic. Hardware firewalls are usually deployed at the edge of the network to protect the internal network from external attacks and unauthorized access. For another example, a software firewall can be an application installed on a computer or server that can be used to monitor and control the network traffic of the installed device.

[0063] Among them, a switch may refer to a network device used to receive and forward data packets and connect different devices in the simulated attack network space.

[0064] The server may refer to various computers used to provide databases or other servers in the simulated attack network space.

[0065] Here, the terminal can refer to a computing device in the simulated attack network space, such as a desktop, laptop or other mobile device.

[0066] The isolation device may refer to a device used to divide a network into different security areas.

[0067] Exemplarily, multiple candidate simulated attack paths can be sent to the terminal of relevant personnel, and a selection operation triggered by the relevant personnel through the terminal can be received. The simulated attack path corresponding to the selection operation is determined as the target simulated attack path, and then based on the target simulated attack path, the key assets on the path are identified, such as firewalls, switches, servers, terminals, and isolation devices, and these related assets are used as target assets.

[0068] In this embodiment, target assets are determined by simulating different types of attack paths, including network attacks, supply chain attacks, social engineering attacks, USB flash drive propagation attacks, and Internet of Things attacks. According to the selected attack path, the target simulated attack path is determined and related assets are identified. These assets may include firewalls, switches, servers, terminal devices, or isolation devices. In this way, the vulnerability of the system to different types of attacks can be comprehensively evaluated, the security protection capability can be improved, and the attack intensity of the network attack exercise plan can be increased.

[0069] In an exemplary embodiment, the vulnerability simulation tool includes vulnerability simulation software; as shown in FIG2 , the vulnerability simulation tool and vulnerability exploitation tool corresponding to the target asset may specifically include:

[0070] Step S202, when the target asset has the software installation conditions, obtain the operating environment of the target asset and various permissions and data required for simulating vulnerabilities for the target asset, and generate vulnerability simulation software that is adapted to the operating environment and corresponds to the target asset. The vulnerability simulation software is used to be legally installed on the target asset.

[0071] Step S204, generating a vulnerability exploitation tool according to the vulnerability simulation software.

[0072] The target asset having the software installation condition may mean that the target asset can install the software, for example, assets such as servers and terminals can install the software.

[0073] The operating environment may refer to the operating system and environment in which the target asset runs, as well as information including its version, configuration, etc.

[0074] Exemplarily, through asset management tools or manual inspection, obtain the operating system type, version, configuration and other information of the target asset to confirm whether the target asset supports the installation of additional software; then, according to the operating environment of the target asset, obtain and simulate the various permissions and data required for the target asset to simulate the vulnerability, and then develop and generate vulnerability simulation software suitable for the environment based on the operating environment and various permissions and data; for example, if the target asset is a server running system A, you can choose vulnerability simulation software designed specifically for the system A environment; for example, use open source projects or custom-developed vulnerability simulation software, and in some examples, you can use Python scripts to simulate specific vulnerabilities. Install the obtained vulnerability simulation software on the target asset, configure the vulnerability simulation software to simulate a specific type of vulnerability, and then develop and generate the corresponding vulnerability exploit tool based on the simulated vulnerability type, and ensure that the vulnerability exploit tool can be used in conjunction with the vulnerability simulation software.

[0075] It should be noted that the installation of the vulnerability simulation software involved in the embodiments of the present application needs to be authorized by the user or fully authorized by all parties, the operation of the vulnerability simulation software needs to be authorized by the user or fully authorized by all parties, and the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the network attack exercise are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions.

[0076] In this embodiment, the operating environment of the target asset is acquired and vulnerability simulation software adapted to the environment is generated, thereby improving the applicability of the vulnerability simulation tool.

[0077] In an exemplary embodiment, the vulnerability simulation software is used to simulate the harmful consequences and exploitation methods of existing vulnerabilities, and the harmful consequences include at least one of permission control, data leakage, and software and hardware function failure. Among them, the exploitation method does not have to be the same as the exploitation details of the existing vulnerability.

[0078] Among them, the permission being controlled may mean that the attacker has obtained control of the system and can perform operations beyond his original permissions, such as upgrading to administrator permissions. Data leakage may refer to the unauthorized access or exposure of sensitive information to unauthorized individuals. Software and hardware failure may refer to the failure of software or hardware to work properly due to the existence of vulnerabilities. For example, certain vulnerabilities may cause the system to blue screen, crash or become unavailable. The exploitation method does not have to be the same as the exploitation details of the existing vulnerability, which may mean that the simulated exploitation method can be simplified or changed as long as the risk of the vulnerability can be effectively conveyed. In the embodiment of the present application, the simulated vulnerability is carried out in a controlled environment in order to fully conduct attack exercises against cyberspace and further improve security defense measures.

[0079] In an exemplary embodiment, the vulnerability simulation software remains active in the memory of the target asset.

[0080] Among them, the vulnerability simulation software remains active in the memory of the target asset. Specifically, it refers to referring to the existing software vulnerabilities, using the memory of the target asset, and hiding itself through memory persistence, so as to avoid being detected by the defender. For example, the vulnerability simulation software can be injected into the memory of the target asset through memory overflow and other methods by taking advantage of the memory vulnerabilities in the system or application to achieve continuous persistence and execution. Memory persistence and other methods can include memory injection, rootkit technology, dynamic loading, anti-debugging and anti-virtualization, persistence mechanism, etc.

[0081] In this embodiment, by keeping the vulnerability simulation software active in the memory of the above-mentioned target asset, the vulnerability simulation software can continue to run and hide itself in the memory of the target asset, preventing it from being detected and cleared by security defense mechanisms or analysis tools, thereby increasing the stealth and persistence of the simulated attack.

[0082] In an exemplary embodiment, the vulnerability simulation tool includes a vulnerability simulation device; the vulnerability simulation device includes a network port and a management port matching the target asset; the network port is used to connect to the network port of the target asset, and the management port is used to connect to the management port of the target asset; the generation of the vulnerability simulation tool and the vulnerability exploitation tool corresponding to the target asset includes:

[0083] In the case that the target asset does not have the conditions for software installation, a vulnerability simulation device is obtained; and a vulnerability exploitation tool is generated based on the vulnerability simulation device.

[0084] Among them, the target asset does not meet the software installation conditions, which may mean that the target asset cannot install software. For example, hardware assets such as switches and firewalls cannot install software. Therefore, a vulnerability simulation device can be used to perform vulnerability simulation on the target asset that cannot install software.

[0085] Exemplarily, when the target asset does not meet the software installation conditions, obtain a vulnerability simulation device that matches the target asset; then, connect the network port of the vulnerability simulation device to the network port of the target asset, and connect the management port of the vulnerability simulation device to the management port of the target asset to complete the deployment of the vulnerability simulation device for the target asset; then, based on the vulnerability type simulated by the vulnerability simulation device, develop and generate a corresponding vulnerability exploit tool, and ensure that the vulnerability exploit tool can be used in conjunction with the vulnerability simulation software.

[0086] In this embodiment, when the above-mentioned target assets do not meet the software installation conditions, a vulnerability simulation device matching the target assets is obtained. The vulnerability simulation device includes a network port and a management port, which can be connected to the target assets to implement vulnerability simulation for the target assets that do not meet the software installation conditions, thereby improving the flexibility and adaptability of the vulnerability simulation tool.

[0087] In an exemplary embodiment, as shown in FIG3 , the target asset may be a hardware asset such as an isolation device, the first end of the target asset is connected to network 1, and the second end is connected to network 2, the vulnerability simulation device includes a first network port and a second network port, the first network port is used to connect to the input network port (first end) of the target asset, and the second network port is used to connect to the output network port (second end) of the target asset; the management port of the vulnerability simulation device is connected to the management port of the target asset; wherein the vulnerability simulation device may include a development board with multiple network ports.

[0088] It should also be noted that the input network port and the output network port do not represent the actual network transmission method with Network 1 and Network 2. Both the input network port and the output network port have the function of two-way transmission. In some cases, the input network port can also be used as the output network port, and the output network port can also be used as the input network port. The function of the network port of the target asset is set according to actual needs and is not specifically restricted here.

[0089] In this embodiment, a vulnerability simulation device with multiple network ports is respectively connected to the input network port and the output network port of the target asset, that is, the vulnerability simulation device is connected in parallel with the target asset, and then the vulnerability is simulated by the vulnerability simulation device, so as to achieve the effect of failure of the isolation function of the target asset.

[0090] It should be noted that the installation and connection of the vulnerability simulation device involved in the embodiments of the present application need to be authorized by the user or fully authorized by all parties, and the operation of the vulnerability simulation device also needs to be authorized by the user or fully authorized by all parties. The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the network attack exercise are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0091] In an exemplary embodiment, the present application also provides a network attack and defense practice method for arbitrarily specifying an attack path, which may specifically include the following steps:

[0092] According to the characteristics of software and hardware assets in cyberspace (asset information of the cyberspace to be simulated for attack), design attack paths (candidate simulated attack paths), compile vulnerability simulation software, vulnerability simulation devices and their corresponding vulnerability exploitation tools for the assets involved in the attack path (target assets), and install the vulnerability simulation software and vulnerability simulation devices on designated assets while keeping it confidential to the defender, so as to realize network security risks such as "zero-day vulnerabilities" and "weak passwords" on any designated attack path, and more realistically simulate high-intensity network attack and defense confrontations, allowing the attacker to break through the attack target, thereby comprehensively testing the defender's capabilities.

[0093] Among them, attack paths are designed according to the software and hardware assets in cyberspace, including but not limited to network attacks, supply chain attacks, social engineering attacks, USB flash drive attacks, Internet of Things attacks and other methods and their combinations; after the attack path is designed, the assets involved in the attack path are sorted out, including but not limited to firewalls, switches, servers, terminals, isolation devices, etc., to indicate the direction for vulnerability simulation.

[0094] Among them, for hardware assets that can install software independently, such as servers and terminals, vulnerability simulation software is written: according to the operating system and other environments on the hardware assets, software that can be run on them is developed to simulate vulnerabilities, simulate the vulnerabilities of any operating system, database, browser and various middleware, and customize the vulnerability triggering method to achieve consequences such as permission control, data leakage and functional failure. By manually and actively installing the above-mentioned vulnerability simulation software on the specified assets, the specified assets have vulnerabilities of specified types; write vulnerability exploitation tools corresponding to the vulnerability simulation software to achieve vulnerability exploitation. For example, assuming that the vulnerability is a weak password, then as long as the attacker knows this password, he can log in to the system normally, which is a vulnerability exploitation; for another example, assuming that the vulnerability is a permission vulnerability, the vulnerability has a specific exp (vulnerability exploitation code), and sending this exp to the asset where the vulnerability is located can achieve the exploitation of the vulnerability.

[0095] Among them, for hardware assets that cannot install software independently, such as switches and firewalls, a vulnerability simulation device is developed: a development board with a network port and a designated hardware asset management port is selected to develop a vulnerability simulation device, and the vulnerabilities of hardware assets such as switches are simulated on the development board. The network port of the development board is connected to the same local area network as the switch and other hardware, and even shares the same IP address with the switch. Another interface of the development board is connected to the management port of the switch and other hardware assets. At the same time, a vulnerability exploitation tool corresponding to the vulnerability is developed. Through the vulnerability exploitation, the development board is controlled to achieve the effect of controlling the switch and other hardware, thereby simulating the consequences of a vulnerability in the switch.

[0096] Among them, the vulnerability simulation software refers to the existing software vulnerability situation and adopts memory residence and other methods to hide itself, so as to prevent being monitored by the defender. Among them, the monitoring in the existing technology is carried out through features. When the security software cannot scan the features, it will not be found, that is, it cannot be monitored; when the security software does not monitor these ranges, it will not be monitored. For example, security software usually only monitors the hard disk and does not monitor the memory, so the malicious code (vulnerability simulation software) in the memory cannot be monitored.

[0097] Among them, the vulnerability simulation device refers to the existing hardware vulnerabilities, selects a development board with multiple network ports, and connects them to the input and output network ports of hardware such as isolation devices, that is, the development board is connected in parallel with hardware such as isolation devices, and the isolation function is disabled by simulating the vulnerability on the development board. Specifically, the vulnerability of the hardware asset is simulated by the vulnerability simulation device, and the vulnerability simulation device provides a network entrance for the vulnerability exploitation. When the vulnerability simulation device is exploited, it is equivalent to the vulnerability simulation device being controlled by the attacker. The attacker can use the vulnerability simulation device to modify the configuration of hardware assets such as isolation devices, thereby achieving the effect that vulnerabilities exist in hardware assets such as isolation devices and are exploited.

[0098] The above-mentioned network attack and defense actual combat exercise method for any designated attack path is to write vulnerability simulation software, vulnerability simulation device and its corresponding vulnerability exploitation tool, and install the vulnerability simulation software and vulnerability simulation device on the designated attack path. By artificially setting vulnerabilities and keeping them confidential to the defender, it is possible to create any "zero-day vulnerability", "weak password" and other network security risks. The attack team uses the vulnerability exploitation tool to attack, thereby more realistically simulating high-intensity network attack and defense actual combat confrontation.

[0099] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0100] Based on the same inventive concept, the embodiment of the present application also provides a network attack exercise device for implementing the above-mentioned vulnerability-customizable network attack exercise method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more network attack exercise device embodiments provided below can refer to the limitations of the vulnerability-customizable network attack exercise method above, and will not be repeated here.

[0101] In an exemplary embodiment, as shown in FIG. 4 , a network attack exercise device 900 is provided, comprising: a path generation module 901, a tool generation module 902 and an exercise plan generation module 903, wherein:

[0102] The path generation module 901 is used to obtain the asset information of the network space to be simulated attacked, and generate candidate simulated attack paths according to the asset information.

[0103] The tool generation module 902 is used to determine the target asset according to the candidate simulated attack path, and generate a vulnerability simulation tool and a vulnerability exploitation tool corresponding to the target asset; the vulnerability exploitation tool is used to use the vulnerability simulated by the vulnerability simulation tool.

[0104] The exercise plan generation module 903 is used to generate simulated vulnerabilities through the vulnerability simulation tool when the vulnerability simulation tool is configured in the target asset, and to generate a network attack exercise plan through the simulated vulnerability and vulnerability exploitation tool.

[0105] In an exemplary embodiment, the candidate simulated attack paths include at least one of network attacks, supply chain attacks, social engineering attacks, USB ferry attacks, and Internet of Things attacks; the tool generation module 902 is also used to determine the target simulated attack path based on the candidate simulated attack paths, obtain the relevant assets on the target simulated attack path, and use the relevant assets as target assets; the relevant assets include at least one of firewalls, switches, servers, terminals, and isolation devices.

[0106] In an exemplary embodiment, the vulnerability simulation tool includes vulnerability simulation software; the exercise plan generation module 903 is also used to obtain the operating environment of the target asset when the target asset has the software installation conditions, and generate vulnerability simulation software corresponding to the target asset that is adapted to the operating environment; the vulnerability simulation software is used to be legally installed on the target asset; and a vulnerability exploitation tool is generated based on the vulnerability simulation tool.

[0107] In an exemplary embodiment, the vulnerability simulation tool includes a vulnerability simulation device; the vulnerability simulation device includes a network port and a management port matching the target asset; the network port is used to connect to the network port of the target asset, and the management port is used to connect to the management port of the target asset; the exercise plan generation module 903 is also used to obtain the vulnerability simulation device when the target asset does not have the software installation conditions; and generate a vulnerability exploitation tool based on the vulnerability simulation device.

[0108] Each module in the above network attack exercise device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0109] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network attack exercise method with customizable vulnerabilities is implemented.

[0110] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0111] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0112] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0113] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0114] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0115] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0116] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A vulnerability customizable network attack exercise method, characterized in that: The method comprises: Acquire asset information of the network space to be simulated attacked, and generate candidate simulated attack paths according to the asset information; Determine the target asset according to the candidate simulated attack path, and generate a vulnerability simulation tool and a vulnerability exploitation tool corresponding to the target asset; the vulnerability exploitation tool is used to use the vulnerability simulated by the vulnerability simulation tool; In the case where the vulnerability simulation tool is configured in the target asset, a simulated vulnerability is generated by the vulnerability simulation tool, and a network attack exercise plan is generated by the simulated vulnerability and the vulnerability exploitation tool.

2. The method according to claim 1, characterized in that The candidate simulated attack paths include at least one of network attacks, supply chain attacks, social engineering attacks, USB ferry attacks, and Internet of Things attacks; and determining the target assets according to the candidate simulated attack paths includes: Determine a target simulated attack path according to the candidate simulated attack path, obtain relevant assets on the target simulated attack path, and use the relevant assets as target assets; the relevant assets include at least one of a firewall, a switch, a server, a terminal, and an isolation device.

3. The method according to claim 1, characterized in that The vulnerability simulation tool includes vulnerability simulation software; the generation of the vulnerability simulation tool and vulnerability exploitation tool corresponding to the target asset includes: When the target asset meets the software installation conditions, the operating environment of the target asset and various permissions and data required for simulating vulnerabilities of the target asset are obtained, and vulnerability simulation software corresponding to the target asset and adapted to the operating environment is generated; the vulnerability simulation software is used to be legally installed on the target asset; A vulnerability exploitation tool is generated according to the vulnerability simulation software.

4. The method according to claim 3, characterized in that The vulnerability simulation software is used to simulate the harmful consequences and exploitation methods of existing vulnerabilities, and the harmful consequences include at least one of permission control, data leakage, and software and hardware function failure.

5. The method according to claim 1, characterized in that The vulnerability simulation tool includes a vulnerability simulation device; the vulnerability simulation device includes a network port and a management port matching the target asset; the network port is used to connect to the network port of the target asset, and the management port is used to connect to the management port of the target asset; The generating of the vulnerability simulation tool and the vulnerability exploitation tool corresponding to the target asset comprises: When the target asset does not have the software installation conditions, obtaining a vulnerability simulation device; A vulnerability exploitation tool is generated according to the vulnerability simulation device.

6. The method according to claim 5, characterized in that The vulnerability simulation device includes a first network port and a second network port, the first network port is used to connect to the input network port of the target asset, and the second network port is used to connect to the output network port of the target asset.

7. A network attack exercise device, characterized in that: The device comprises: A path generation module, used to obtain asset information of the network space to be simulated and attack, and generate candidate simulated attack paths according to the asset information; A tool generation module, used to determine a target asset according to the candidate simulated attack path, and generate a vulnerability simulation tool and a vulnerability exploitation tool corresponding to the target asset; the vulnerability exploitation tool is used to use the vulnerability simulated by the vulnerability simulation tool; The exercise plan generation module is used to generate a simulated vulnerability through the vulnerability simulation tool when the vulnerability simulation tool is configured in the target asset, and to generate a network attack exercise plan through the simulated vulnerability and the vulnerability exploitation tool.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images