Simulation deduction method and device applied to network target range, equipment and medium

Abstract

The invention provides a simulation deduction method applied to a network target range, which can be applied to the technical field of information security. The method comprises the following steps: acquiring access information, wherein the access information comprises information of a starting network asset and a target network asset of access; network on-off information of all network assets in the target environment is obtained, and the network on-off information comprises on-off conditions of one network asset and other network assets and a connection direction when one network asset is connected with another network asset; and drawing a network topological graph from the initial network asset to the target network asset by taking the initial network asset as a starting point and the target network asset as a terminal point according to the network on-off information of all the network assets in the target environment so as to obtain a network access path. The invention further provides a simulation deduction device and equipment arranged in the network target range, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology and can be used in the financial field or other fields. More specifically, it relates to a simulation deduction method, device, equipment, medium and program product applied to a network target range. Background Art

[0002] With the continuous development of information technology, potential hacker attacks and security incidents have an increasing impact on business systems. Organizations usually improve their network environment's ability to protect against various network attacks by conducting attack and defense simulations of various security incidents. Since network attacks are destructive and pose potential security risks to the real network environment, they are usually simulated in the form of attack and defense drills in a network range.

[0003] At present, when conducting simulations in a network range, in order to achieve a realistic and reliable simulation effect and discover potential security vulnerabilities, it is often necessary to first build a simulation system corresponding to the real network environment in the network range, and then conduct attack and defense drills in the simulation system. This simulation method requires a lot of resources to build a simulation system, which takes a long time to prepare. In addition, once the real network environment is upgraded, the simulation system needs to be upgraded synchronously, which increases the cost of building the simulation system and makes the simulation less flexible. Summary of the invention

[0004] In view of the above problems, the embodiments of the present disclosure provide a simulation and deduction method, device, equipment, medium and program product applied to a network target range, which can use real network data collected from the target environment to quickly simulate and deduce the security attack and defense performance of the target environment without building a simulation system.

[0005] The first aspect of the disclosed embodiment provides a simulation deduction method applied to a network range. The method includes: obtaining access information to the target environment, the access information includes information of the starting network asset and the target network asset, wherein the starting network asset and the target network asset are network assets in the target environment; obtaining network connectivity information of all network assets in the target environment, wherein the network connectivity information includes the connectivity of a network asset with other network assets, and the connectivity direction when a network asset is connected to another network asset; then taking the starting network asset as the starting point and the target network asset as the end point, drawing a network topology diagram from the starting network asset to the target network asset according to the network connectivity information of all network assets in the target environment to obtain a network access path.

[0006] According to an embodiment of the present disclosure, the method also includes: obtaining a vulnerability information table, which records at least the communication address of the host with a vulnerability in the target environment; matching the communication addresses of all network assets in the network access path with the communication address of the host with a vulnerability in the vulnerability information table; wherein the network on / off information also includes the communication address of the network asset; if the match is successful, determining that the access information is aggressive; otherwise, determining that the access information is not aggressive.

[0007] According to an embodiment of the present disclosure, the method also includes: if the match is successful, the network assets in the network access path that successfully match the vulnerability information table, the starting network assets and the target network assets are all determined as reserved nodes; each reserved node except the starting network assets and the target network assets is traversed, wherein, when traversing each reserved node, the connection path between the reserved node and another reserved node closest to it is filtered out from the network access path along the upstream direction and the downstream direction respectively to obtain the reserved path; all paths other than the reserved path are removed from the network access path to obtain a simplified access path; and the simplified access path is displayed.

[0008] According to an embodiment of the present disclosure, the data in the vulnerability information table is extracted from the host monitoring data and vulnerability scanning data of the target environment. The host monitoring data is data obtained by real-time monitoring of each host in the target environment. The vulnerability scanning data is data obtained by performing vulnerability scanning on each host in the target environment.

[0009] According to an embodiment of the present disclosure, the network connectivity information of all network assets in the target environment is extracted from network scanning data and network traffic data, wherein the network scanning data is data obtained by performing a network scan on the network assets in the target environment; and the network traffic data is data extracted from the access traffic of the target environment.

[0010] According to an embodiment of the present disclosure, obtaining network connectivity information of all network assets in the target environment includes: obtaining a network asset table, wherein the network asset table records the communication attribute information of all network assets in the target environment, wherein the communication attribute information includes the communication address and survival status information of the network assets; and obtaining a network connectivity table, wherein the network connectivity table records the connection relationship and connection direction between different network assets in the target environment.

[0011] According to an embodiment of the present disclosure, taking the starting network asset as the starting point and the target network asset as the end point, drawing a network topology diagram from the starting network asset to the target network asset according to the network connectivity information of all network assets in the target environment to obtain a network access path includes: starting from the starting network asset, traversing the network assets in the target environment according to the network connectivity information, wherein: each time a network asset is traversed, connecting the network asset with other network assets that are connected to the network asset and located downstream of the network asset in the connection direction.

[0012] According to a second aspect of an embodiment of the present disclosure, a simulation and deduction device is provided in a network target range. The device includes: a first acquisition module, a second acquisition module and a path analysis module. The first acquisition module is used to obtain access information to the target environment, and the access information includes information about the starting network asset and the target network asset, wherein the starting network asset and the target network asset are network assets in the target environment. The second acquisition module is used to obtain network connectivity information of all network assets in the target environment, wherein the network connectivity information includes the connectivity status of a network asset with other network assets, and the connectivity direction when a network asset is connected to another network asset. The path analysis module is used to take the starting network asset as the starting point and the target network asset as the end point, and draw a network topology map from the starting network asset to the target network asset according to the network connectivity information of all network assets in the target environment to obtain a network access path.

[0013] According to an embodiment of the present disclosure, the device further includes an intelligent deduction module. The intelligent deduction module is used to: obtain a vulnerability information table, which records at least the communication address of the host with a vulnerability in the target environment; match the communication addresses of all network assets in the network access path with the communication address of the host with a vulnerability in the vulnerability information table; wherein the network connection and disconnection information also includes the communication address of the network asset; if the match is successful, determine that the access information is offensive; otherwise, determine that the access information is not offensive.

[0014] According to an embodiment of the present disclosure, the device also includes a visualization module. The intelligent deduction module is also used to: if the match is successful, determine the network assets in the network access path that successfully match the vulnerability information table, the starting network assets, and the target network assets as reserved nodes; traverse each reserved node except the starting network assets and the target network assets, wherein when traversing each reserved node, filter out the connection path between the reserved node and another reserved node closest to it from the network access path along the upstream direction and the downstream direction respectively, to obtain a reserved path; and remove all paths other than the reserved path from the network access path to obtain a simplified access path. The visualization module is also used to display the simplified access path.

[0015] In a third aspect of an embodiment of the present disclosure, an electronic device is provided. The electronic device includes one or more processors and a memory. The memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned simulation deduction method applied to a network target range.

[0016] In a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is further provided, on which executable instructions are stored. When the instructions are executed by a processor, the processor executes the above-mentioned simulation and deduction method applied to a network target range.

[0017] In a fifth aspect of an embodiment of the present disclosure, a computer program product is also provided, including a computer program, which, when executed by a processor, implements the above-mentioned simulation and deduction method applied to a network target range. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0019] Figure 1 The application scenario diagram schematically shows the simulation deduction method, device, equipment, medium and program product applied to the network target range according to the embodiment of the present disclosure;

[0020] Figure 2 A flowchart of a simulation deduction method applied to a network target range according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 3 The processing flow after obtaining the network access path in the simulation deduction method applied to the network target range according to another embodiment of the present disclosure is schematically shown;

[0022] Figure 4A block diagram of a simulation deduction device disposed in a network target range according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 5 A framework diagram of a simulation deduction device disposed in a network target range according to another embodiment of the present disclosure is schematically shown;

[0024] Figure 6 Schematically shows Figure 5 The simulation flow chart of the simulation device set in the network target range is shown;

[0025] Figure 7 Schematically shows Figure 5 A framework diagram of a data acquisition module in the device shown;

[0026] Figure 8 Schematically shows Figure 5 A framework diagram of a data analysis module in the device shown;

[0027] Fig. 9 Schematically shows Figure 5 A framework diagram of the deduction module in the device shown; and

[0028] Fig.10 A block diagram of an electronic device suitable for implementing the simulation deduction method applied to a network target range according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0029] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0030] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0031] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0032] The embodiments of the present disclosure provide a simulation deduction method, device, equipment, medium and program product applied to a network target range. According to the embodiments of the present disclosure, when the network connectivity information of all network assets in the target environment is obtained, for any access information, according to the connectivity and connectivity direction of each network asset with other network assets in the network connectivity information, other network assets connected to each network asset and located downstream can be found and connected starting from the accessed starting network asset until they are connected to the accessed target network asset. In this way, a network access path corresponding to the access information can be formed. After having a network access path, it is only necessary to analyze whether there are vulnerabilities or exploitable points in the network assets in the network access path, so as to know whether the access information is offensive, and where the weak points attacked when it is offensive are, and how to protect it. In this way, potential dangers in the target environment can be quickly found without building a simulation system and without bringing risks to the real network environment, so as to take targeted protective measures.

[0033] Figure 1 The application scenario diagram of the simulation deduction method, device, equipment, medium and program product applied to a network target range according to an embodiment of the present disclosure is schematically shown.

[0034] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a target environment 10, a terminal device 101, a network 102 and a server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc. The server 103 is a hardware component of the network range and can provide related services in the network range.

[0035] Various data collection devices are provided in the target environment 10. Among them, these data collection devices can communicate with the server 103 through the network 102. For example, the data collection device can transmit various types of data collected from the target environment 10 to the server 103 through the network 102, and the server 103 processes the data to obtain various data required for simulating the target environment 10, such as network connection and disconnection information, vulnerability information table, host information table or network asset table.

[0036] The terminal device 101 can communicate with the server 103 through the network 102. For example, the terminal device 101 can upload the collected access information to the server 103, thereby triggering the server 103 to perform simulation deduction. Correspondingly, the server 103 can also feed back the simulation deduction results, such as network access path and other information to the terminal device 101, and provide it to the user of the terminal device 101 for viewing.

[0037] It should be noted that the simulation deduction method applied to the network range provided in the embodiment of the present disclosure can generally be executed by the server 103. Accordingly, the simulation deduction device, equipment, medium and program product provided in the network range provided in the embodiment of the present disclosure can generally be set in the server 103. The simulation deduction method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 103 and can communicate with the terminal device 101 and / or the server 103. Correspondingly, the simulation deduction device, equipment, medium and program product provided in the network range provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 103 and can communicate with the terminal device 101 and / or the server 103.

[0038] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0039] It should be noted that the simulation and deduction method, device, equipment, medium and program product applied to the network target range provided by the embodiments of the present disclosure can be used in the financial field, and can also be used in any field other than the financial field. The present disclosure does not limit the application field.

[0040] The following will be based on Figure 1 The application scenario described by Figure 2-Figure 3 The simulation deduction method applied to a network target range in an embodiment of the present disclosure is described in detail.

[0041] Figure 2 A flowchart of a simulation deduction method applied to a network target range according to an embodiment of the present disclosure is schematically shown.

[0042] like Figure 2 As shown, the simulation deduction method applied to a network target range according to this embodiment may include operations S201 to S203.

[0043] In operation S201 , access information to the target environment 10 is obtained, and the access information includes information of the starting network asset and the target network asset. The starting network asset and the target network asset are network assets in the target environment 10 .

[0044] Specifically, the access information at least includes the starting point and the target point of the access. Therefore, the information of the starting network asset and the target network asset refers to the address information, device identification or device name of the starting point and the target point indicated in the access information.

[0045] In operation S202, network connectivity information of all network assets in the target environment 10 is obtained, wherein the network connectivity information includes connectivity status of a network asset with other network assets, and a connection direction when a network asset is connected to another network asset.

[0046] In some embodiments, Figure 1 As shown, when data is collected from the target environment 10 and network scanning data and network flow data of the target environment 10 are collected, network connectivity information of all network assets in the target environment 10 can be extracted from the network scanning data and network flow data.

[0047] The network scanning data is data obtained by performing a network scan on the network assets in the target environment 10. For example, the network assets in the target environment 10 can be scanned regularly or irregularly to obtain information such as the IP address, port data, address survival status, connectivity between addresses, or upstream and downstream connectivity directions of the network assets.

[0048] The network traffic data is data extracted from the access traffic of the target environment 10. For example, the traffic data accessing the target environment 10 can be intercepted in real time, and information such as the sending address and destination address IP and port, and the address access direction in the traffic can be extracted.

[0049] Compared with network scanning data, network flow data has better real-time performance. Therefore, network scanning data can be verified or updated in combination with network flow data, which can reduce the possibility that changes or updates within the target environment 10 are not reflected in the network scanning data in a timely manner.

[0050] Compared with network traffic data, network scanning data has a more comprehensive coverage. The network communication information involved in network traffic data is affected by external access conditions and is uncertain. Moreover, external access is often uneven, which easily causes network traffic data to fail to cover the on / off information of all assets in the target environment 10.

[0051] Therefore, the network scanning data and network traffic data of the target environment 10 are combined to extract the network connectivity information of all network assets in the target environment 10. This can not only ensure that the extracted network connectivity information has comprehensive coverage to a large extent, but also improve the real-time performance of the network connectivity information to a certain extent.

[0052] In operation S203, taking the starting network asset as the starting point and the target network asset as the end point, a network topology diagram from the starting network asset to the target network asset is drawn according to the network connectivity information of all network assets in the target environment 10 to obtain a network access path.

[0053] When drawing, it is possible to start from the starting network asset and traverse the network assets in the target environment 10 according to the network connectivity information until the target network asset is traversed, wherein each time a network asset is traversed, the network asset is connected to other network assets that are connected to the network asset and located downstream of the network asset in the connection direction. The order of traversal is to first traverse the starting network asset and connect the starting network asset to other network assets that are connected to it and may be located downstream of it. Next, traverse the other network assets connected to the starting network asset. In this way, the network assets at the end of the connection are traversed one by one along the drawing of the connection path until the target network asset is traversed.

[0054] It can be seen that when the embodiment of the present disclosure performs simulation deduction in the target environment 10, the security protection effect of the target environment 10 can be deduced based on the network connectivity information of all network assets in the target environment 10, without affecting the operation of the target environment 10 and without building a simulation system, so as to discover potential weak links and facilitate timely repairs. Among them, as long as the authenticity of the acquired network connectivity information of the target environment is high enough, the real-time performance is good enough, and the coverage is comprehensive enough through means such as information collection and monitoring, the simulation deduction of the target environment 10 can be made to fit the actual production system to the greatest extent. This can avoid the time-consuming and labor-intensive construction of the simulation system, and will not bring any risks to the real system, effectively improving the efficiency of the deduction.

[0055] Figure 3 The present invention schematically illustrates the processing flow after obtaining the network access path in the simulation deduction method applied to a network target range according to another embodiment of the present invention.

[0056] like Figure 3 As shown, according to the simulation deduction method applied to a network target range according to this embodiment, after operations S201 to S203, operations S301 to S309 may also be included.

[0057] In operation S301 , a vulnerability information table is obtained, in which at least the communication address (eg, IP address) of a host with a vulnerability in the target environment 10 is recorded.

[0058] In operation S302, when the network connection and disconnection information also includes the communication address of the network asset, the communication addresses of all network assets in the network access path are matched with the communication address of the host with the vulnerability in the vulnerability information table.

[0059] In operation S303, it is determined whether the matching in operation S302 is successful. If not, operation S304 is executed; if yes, operation S305 is executed.

[0060] In operation S304, if no match is successful, it means that there are no vulnerabilities in the network assets in the network access path and there are no points that can be exploited by attacks, so it can be determined that the access information is not offensive.

[0061] In operation S305, if the match is successful, it is determined that the access information is offensive.

[0062] In one embodiment, when it is determined in operation S305 that the access information is offensive, the network access path can be output to the terminal device 101, and the information of the network assets in the network access path that successfully match the vulnerability information table can also be output to the terminal device 101 to help the user analyze the specific threat content in the access information so as to select a targeted protection strategy.

[0063] In another embodiment, the network access path may also be simplified through operations S306 to S309 and output to the terminal device 101 .

[0064] Specifically, in operation S306, the network assets, the starting network assets, and the target network assets in the network access path that are successfully matched with the vulnerability information table are all determined as reserved nodes.

[0065] In operation S307, each reserved node except the starting network asset and the target network asset is traversed, wherein when each reserved node is traversed, the connection path between the reserved node and another reserved node closest to it is filtered out from the network access path along the upstream direction and the downstream direction respectively to obtain the reserved path.

[0066] In operation S308, all paths other than the reserved paths are removed from the network access paths to obtain a simplified access path.

[0067] Then in operation S309, the simplified access path is displayed.

[0068] Through further analysis and processing by operations S306 to S308, the paths connecting all hosts with vulnerabilities can be screened out from the network access path, and the branches that are not connected to the hosts with vulnerabilities can be eliminated. The simplified access path obtained in this way has reduced redundant information, and the simplified access path is provided to the user, so that the user can more accurately and efficiently analyze the weak links in the target environment, and then more accurately perform security protection.

[0069] Based on the simulation deduction method applied to the network range in the above-mentioned embodiments, the embodiment of the present disclosure also provides a simulation deduction device set in the network range. Figure 4 The device is described in detail.

[0070] Figure 4The structural block diagram of a simulation and deduction device 400 disposed in a network target range according to an embodiment of the present disclosure is schematically shown.

[0071] like Figure 4 As shown, according to some embodiments of the present disclosure, the device 400 may include a first acquisition module 410, a second acquisition module 420 and a path analysis module 430. According to other embodiments of the present disclosure, the device 400 may further include an intelligent deduction module 440 and / or a visualization module 450.

[0072] The first acquisition module 410 is used to acquire access information to the target environment, wherein the access information includes information of the starting network asset and the target network asset, wherein the starting network asset and the target network asset are network assets in the target environment. In one embodiment, the first acquisition module 410 may perform the operation S201 described above.

[0073] The second acquisition module 420 is used to acquire network connectivity information of all network assets in the target environment 10, wherein the network connectivity information includes connectivity status of a network asset with other network assets, and the connection direction when a network asset is connected to another network asset. In one embodiment, the second acquisition module 420 may perform the operation S202 described above.

[0074] The path analysis module 430 is used to draw a network topology diagram from the starting network asset to the target network asset based on the network connectivity information of all network assets in the target environment 10, so as to obtain a network access path. In one embodiment, the path analysis module 430 can perform the operation S203 described above.

[0075] The intelligent deduction module 440 is used to: obtain a vulnerability information table, which records at least the communication address of the host with a vulnerability in the target environment 10; match the communication addresses of all network assets in the network access path with the communication address of the host with a vulnerability in the vulnerability information table; wherein the network connection and disconnection information also includes the communication address of the network asset; if the match is successful, determine that the access information is offensive; otherwise, determine that the access information is not offensive. In one embodiment, the intelligent deduction module 440 can perform the operations S301 to S305 described above.

[0076] The intelligent deduction module 440 is also used to: if the match is successful, determine the network assets, starting network assets and target network assets that successfully match the vulnerability information table in the network access path as reserved nodes; traverse each reserved node except the starting network assets and the target network assets, wherein when traversing each reserved node, filter out the connection path between the reserved node and another reserved node closest to it from the network access path along the upstream direction and the downstream direction respectively, and obtain the reserved path; and remove all paths other than the reserved path from the network access path to obtain a streamlined access path. In one embodiment, the intelligent deduction module 440 can also perform operations S307 to S308 described above.

[0077] The visualization module 450 is used to display the simplified access path. In one embodiment, the visualization module 450 may perform the operation S309 described above.

[0078] The apparatus 400 may perform a reference Figure 2-Figure 3 For details on the method, please refer to the previous article and will not be repeated here.

[0079] The following Figures 5 to 9 Another embodiment of the present disclosure is a simulation deduction device 500 disposed in a network target range. It is understood that the following description is exemplary and does not constitute a limitation on the present disclosure.

[0080] Figure 5 A framework diagram of a simulation and deduction device 500 disposed in a network target range according to another embodiment of the present disclosure is schematically shown.

[0081] like Figure 5 As shown, the device 500 includes a data acquisition module 501 , a data analysis module 502 , a deduction module 503 , a visualization module 450 and an asset library module 505 .

[0082] Figure 6 Schematically shows Figure 5 The simulation flow chart of the simulation device 500 set in the network target range is shown.

[0083] like Figure 6As shown, the process of simulation deduction by each module in the device 500 is as follows: first, the data acquisition module 501 completes the collection of environmental information of the target environment 10 and temporarily stores it (for example, in the system asset library); then, the data analysis module 502 analyzes it according to the data analysis strategy, and reconstructs it into the data required for deduction (such as the network channel information and vulnerability information table mentioned above), and stores it in the asset library module 505. After completing the data preparation, the deduction module 503 deduces the network access path in the target environment 10 according to the input access information. This process can be repeated according to the deduction requirements of the data, and finally the visualization module 450 displays the deduction results. Among them, the specific functions of each module are as follows.

[0084] Data collection module 501: has the ability to actively or passively collect data information of the target environment 10. For example, it can automatically collect data results of the collection equipment deployed in the target environment 10 according to the setting parameters, and can pre-process the collected information through pre-configuration, or directly import the sorted data through a standardized template table.

[0085] Data analysis module 502: can analyze the data collected by the data collection module 501 according to the configuration strategy, mark the analysis results, reconstruct the data based on the marked results to form the data required in the deduction process, and store it in the asset library module 505.

[0086] Deduction module 503: can determine the starting network assets and target network assets of the access according to the information of the starting point and the target point in the input access information, and then call the information of the network asset table and the network on-off table in the asset library module 505 to automatically generate a network access path, and automatically find out whether there are exploitable vulnerabilities in the network access path by associating the information of each host, vulnerability, etc. in the vulnerability information table in the asset library module 505, so as to deduce the access path in this way.

[0087] Visualization module 450: displays the simulation results of the simulation module 503 through information visualization technology, and can control the simulation process through triggering, pausing, replaying, etc. of instructions. For example, the visualization module 450 displays the drawing process of the network access path.

[0088] Asset library module 505: is a data storage unit that can provide temporary storage for data collected by the data collection module 501, provide database storage services for data reconstructed after analysis by the data analysis module 502, and provide relevant data asset data for the deduction process of the deduction module 503.

[0089] Figure 7 Schematically shows Figure 5 The framework diagram of the data acquisition module 501 in the device 500 is shown.

[0090] like Figure 7 As shown, the data acquisition module 501 may include a data acquisition submodule 511 and a data update submodule 512 .

[0091] Data collection submodule 511: can be interconnected with various data collection devices set in the target environment 10 through a standardized data input and output interface. Various data collection devices include but are not limited to: network scanning devices, traffic mirroring devices, host monitoring devices, etc. The data collection submodule 511 can receive the collected data of the above-mentioned various data collection devices, or directly receive the templated and sorted asset information table. The received data can be temporarily stored in the temporary data table of the asset library module 505, and the collected information can be pre-processed through pre-configured collection parameters, such as merging and deleting duplicate data.

[0092] Data update submodule 512: If the data acquisition submodule 511 collects data in the target environment 10 by connecting to an external device, the data update submodule 512 can automatically obtain the latest data from the external device regularly according to the set time parameters and mark the data status as updated. If a full update is required, the information acquisition module 511 is called to perform full data acquisition.

[0093] Figure 8 Schematically shows Figure 5 A framework diagram of a data analysis module 502 in the device 500 is shown.

[0094] like Figure 8 As shown, the data analysis module 502 may include a structure analysis module 521 and an asset construction module 522. When the structure analysis module 521 detects that data is stored in the temporary data table in the asset library module 505, it analyzes the data in the temporary data table and marks the data. The analysis and marking process of different data is exemplified as follows.

[0095] For network traffic data, extract the sending address and destination address IP and port in the traffic, and mark the address access direction.

[0096] Monitor the host data, extract the host name and the corresponding IP address and port, mark the host survival status, and simultaneously extract the operating system version, installed middleware, application software, etc., names and related version numbers (if any).

[0097] For the network scanning data, extract the network IP address and port data, and mark the address survival status. Since the network scanning data is usually non-real-time data, and the host monitoring data can be real-time collected data, the IP address information extracted from the network scanning data can be compared with the host monitoring data, and the data with surviving IP addresses in the host monitoring data can be retained, and the non-surviving network address information of the IP address in the host monitoring data can be deleted. In addition, the information with surviving IP addresses but not recorded in the host monitoring data can be retained. In this way, the information of the network scanning data can be updated using the host monitoring data.

[0098] For vulnerability scanning data, extract the vulnerability name, host IP address and host name, and mark the corresponding relationship between the vulnerability and the host. Similarly, since vulnerability scanning data is usually non-real-time data, the IP address information extracted from the vulnerability scanning data can also be compared with the IP address information in the host monitoring data, and the IP address and its corresponding vulnerability information that are consistent with the host monitoring data are retained. In addition, vulnerability scanning data can also be compared with network scanning data, and consistent IP addresses and related data are retained, and inconsistent information is deleted. In this way, information in data collected by different devices or different methods can be compared and verified to improve the accuracy and real-time nature of the information.

[0099] The asset construction module 522 is used to use the data extracted and the marking results of the structure analysis module 521 in the above manner as input information to automatically generate various formal asset library tables required in the simulation process in the target environment 10, including but not limited to: host information table, network asset table, vulnerability information table and network connection table, etc. The asset construction module 522 can update the corresponding data in various formal tables according to the update mark of the data by the structure analysis module 521.

[0100] The host information table records the host names and corresponding IP addresses and ports, survival status, operating system versions, installed middleware, application software and other information of all hosts in the target environment 10.

[0101] The network asset table records the communication attribute information of all network assets in the target environment 10, and the communication attribute information includes the communication address and survival status information of the network assets.

[0102] The vulnerability information table records the communication addresses of hosts with vulnerabilities in the target environment 10, such as IP addresses and ports, and may also include the corresponding relationship between vulnerability information and hosts, etc. The data in the vulnerability information table may be extracted from the host monitoring data and vulnerability scanning data of the target environment 10.

[0103] The network connection table records information such as the connection relationship and connection direction between different network assets in the target environment 10.

[0104] Fig. 9 Schematically shows Figure 5 A framework diagram of the deduction module 503 in the device 500 is shown.

[0105] like Fig. 9 As shown, the deduction module 503 may include a path analysis module 430 and an intelligent deduction module 440 .

[0106] The path analysis module 430 receives access information input from the outside. The access information includes information of the starting point and the target point of the network simulation (such as an IP address), wherein, according to the information of the starting point and the target point, the starting network asset and the target network asset can be located from the network asset table, and then according to the information in the network connection table, the network topology diagram from the starting network asset to the target network asset can be automatically drawn, thereby generating a network access path.

[0107] The intelligent deduction module 440 can extract the information of all host nodes in the network access path obtained by the path analysis module 430, and match the vulnerability information table in the asset library module 505 according to the host node information (such as IP address). If the host information in the network access path is matched in the vulnerability information table, it is determined that this node can be used. Then it is transferred to the subsequent node through this node, and the target network asset is reached according to the above judgment mode. If there is a branch in the network access path that does not query the node host information in the vulnerability information table, the branch can be deleted to simplify the network access path.

[0108] The simulation conducted in this way can be as close to the actual production system as possible without bringing any risks to the real system because it uses the information data actually collected from the target environment 10 for simulation.

[0109] Moreover, compared with the method of building a simulation system for simulation and deduction in related technologies, the simulation and deduction of the embodiment of the present invention can improve the efficiency of the deduction, and when the target environment 10 changes, such changes can be quickly captured through the collection of information data, thereby making the effect of the simulation and deduction adapt to the changed target environment 10, which has considerable flexibility.

[0110] Furthermore, compared to the deduction method in which the target environment 10 is abstracted or idealized in paper deduction or script deduction, the description of the target environment 10 in the simulation deduction of the embodiment of the present disclosure comes from the real data collected from the target environment 10, which can greatly avoid the defect that the reference significance of the deduction result is reduced because the deduction process is separated from the actual system.

[0111] It can be seen that the embodiment of the present disclosure can quickly form various data required for simulation and deduction based on the data collected from the target environment 10, effectively simulate and deduce the access behavior in the target environment, reduce the deduction preparation time, and form an intuitive and visual network access path and display it.

[0112] According to the embodiments of the present disclosure, intelligent analysis can be performed in combination with the real environment of the target environment 10, and network simulation deduction can be automatically completed, which can improve the efficiency of the deduction and reduce the manual input in the deduction process. Without affecting the real network environment, system protection capability testing, penetration deduction and other services can be provided to personnel from all parties.

[0113] According to an embodiment of the present disclosure, any multiple modules among the first acquisition module 410, the second acquisition module 420, the path analysis module 430, the intelligent deduction module 440, the visualization module 450, the data acquisition module 501, the data analysis module 502, the deduction module 503 and the asset library module 505 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first acquisition module 410, the second acquisition module 420, the path analysis module 430, the intelligent deduction module 440, the visualization module 450, the data acquisition module 501, the data analysis module 502, the deduction module 503 and the asset library module 505 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or by any one of the three implementation methods of software, hardware and firmware or by an appropriate combination of any of them. Alternatively, at least one of the first acquisition module 410, the second acquisition module 420, the path analysis module 430, the intelligent deduction module 440, the visualization module 450, the data acquisition module 501, the data analysis module 502, the deduction module 503 and the asset library module 505 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be performed.

[0114] Fig.10 A block diagram of an electronic device suitable for implementing the simulation deduction method applied to a network target range according to an embodiment of the present disclosure is schematically shown.

[0115] like Fig.10As shown, the electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage part 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include an onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0116] In RAM 1003, various programs and data required for the operation of electronic device 1000 are stored. Processor 1001, ROM 1002 and RAM 1003 are connected to each other via bus 1004. Processor 1001 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1002 and / or RAM 1003. It should be noted that the program can also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0117] According to an embodiment of the present disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to the bus 1004. The electronic device 1000 may further include one or more of the following components connected to the I / O interface 1005: an input portion 1006 including a keyboard, a mouse, etc.; an output portion 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1008 including a hard disk, etc.; and a communication portion 1009 including a network interface card such as a LAN card, a modem, etc. The communication portion 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed, so that a computer program read therefrom is installed into the storage portion 1008 as needed.

[0118] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0119] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1002 and / or RAM 1003 described above and / or one or more memories other than ROM 1002 and RAM 1003.

[0120] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the simulation deduction method applied to the network range provided by the embodiment of the present disclosure.

[0121] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1001. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0122] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1009, and / or installed from the removable medium 1011. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0123] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the processor 1001, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0124] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0125] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0126] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0127] The embodiments of the present disclosure are described above. However, these embodiments are only for the purpose of illustration and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A simulation method applied to a network range, comprising: Acquire access information to a target environment, the access information including information of a starting network asset and a target network asset, wherein the starting network asset and the target network asset are network assets in the target environment; Acquiring network connectivity information of all network assets in the target environment, wherein the network connectivity information includes connectivity status of a network asset with other network assets, and a connection direction when a network asset is connected to another network asset; and Taking the starting network asset as the starting point and the target network asset as the end point, a network topology diagram from the starting network asset to the target network asset is drawn according to the network connectivity information of all network assets in the target environment to obtain a network access path.

2. The method according to claim 1, wherein: The method further comprises: Obtaining a vulnerability information table, wherein the vulnerability information table at least records the communication address of a host having a vulnerability in the target environment; Matching the communication addresses of all network assets in the network access path with the communication addresses of the hosts with vulnerabilities in the vulnerability information table; wherein the network connection and disconnection information also includes the communication addresses of the network assets; If the match is successful, it is determined that the access information is offensive; otherwise, it is determined that the access information is not offensive.

3. The method according to claim 2, wherein: The method further comprises: If the match is successful, the network assets in the network access path that are successfully matched with the vulnerability information table, the starting network assets, and the target network assets are all determined as reserved nodes; Traversing each reserved node except the starting network asset and the target network asset, wherein when traversing each reserved node, filtering out a connection path between the reserved node and another reserved node closest to the reserved node in an upstream direction and a downstream direction from the network access path, respectively, to obtain a reserved path; Eliminating all paths other than the reserved path from the network access path to obtain a simplified access path; and The simplified access path is displayed.

4. The method according to claim 2, wherein: The data in the vulnerability information table is extracted from the host monitoring data and vulnerability scanning data of the target environment. The host monitoring data is data obtained by real-time monitoring of each host in the target environment; The vulnerability scanning data is data obtained by performing a vulnerability scan on each host in the target environment.

5. The method according to claim 1, wherein: The network connectivity information of all network assets in the target environment is extracted from network scanning data and network traffic data; wherein, The network scanning data is data obtained by performing a network scan on network assets in the target environment; The network traffic data is data extracted from the access traffic of the target environment.

6. The method according to claim 1 or 5, wherein: The obtaining of network connectivity information of all network assets in the target environment includes: Acquire a network asset table, wherein the network asset table records communication attribute information of all network assets in the target environment, wherein the communication attribute information includes communication addresses and survival status information of the network assets; and A network connection table is obtained, wherein the network connection table records the connection relationship and connection direction between different network assets in the target environment.

7. The method according to claim 1, wherein: The method of taking the starting network asset as the starting point and the target network asset as the end point, and drawing a network topology diagram from the starting network asset to the target network asset according to the network connectivity information of all network assets in the target environment to obtain a network access path includes: Starting from the starting network asset, the network assets in the target environment are traversed according to the network connectivity information, wherein: Each time a network asset is traversed, the network asset is connected to other network assets that are connected to the network asset and located downstream of the network asset in the connection direction.

8. A simulation device arranged in a network range, comprising: A first acquisition module is used to acquire access information to a target environment, wherein the access information includes information of a starting network asset and a target network asset, wherein the starting network asset and the target network asset are network assets in the target environment; A second acquisition module is used to acquire network connectivity information of all network assets in the target environment, wherein the network connectivity information includes connectivity between one network asset and other network assets, and a connection direction when one network asset is connected to another network asset; and The path analysis module is used to draw a network topology diagram from the starting network asset to the target network asset based on the network connectivity information of all network assets in the target environment, with the starting network asset as the starting point and the target network asset as the end point, so as to obtain a network access path.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, The one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images