Endogenous safe mimicry range implementation method, system, device, medium and program

Abstract

The invention discloses an endogenous security mimicry range implementation method, system, device, medium and program, and relates to the technical field of network security, the method is applied to an endogenous security mimicry system, and at least comprises an input agent, a heterogeneous executor pool, a mimicry arbiter and a control scheduler, the method comprises the following steps: obtaining range selection information through the input agent, starting a mimicry white-box container of the heterogeneous executor pool by utilizing a control scheduler, and loading a mimicry white-box executor mirror image in the mimicry white-box container; the heterogeneous executor pool is used for feeding back executor information of the mimicry white-box executor mirror image; acquiring attack data of the user corresponding to the executor information through the input agent; and generating an attack score according to the system disturbance condition of the attack data by using a mimicry arbiter. According to the invention, target drone equipment is simulated based on the container, the influence of a user attack test on a white-box target drone is reduced, rapid recovery can be realized, the labor cost and time overhead of the attack test are reduced, and the user experience can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system, device, medium and program for realizing an endogenous security mimicry target range. Background Art

[0002] The cyber range is a virtualization technology that can simulate and reproduce the operating status and operating environment of the network architecture, system equipment, and business processes in the real cyberspace, and more effectively assist users in learning, researching, testing, competing, and exercising related to cybersecurity, thereby improving the cybersecurity confrontation level of personnel and institutions. The target machine is a virtual device in the cyber range, which can be divided into black box and white box. The black box range is not open to attackers, allowing attackers to attack from the outside. The white box range is open to attackers, who can remotely enter the interior to conduct a series of attack operations.

[0003] For the white box range, attackers can perform a series of attack operations on the white box range, and the attack may even directly shut down or completely destroy the white box range. Traditional white box ranges can be implemented through real devices or virtual devices, but these two ways of building white box ranges cannot completely reset the environment after an attack, which will affect the next user. In addition, in the case of an attack that cannot be restarted and recovered, it is necessary to reinstall the system and restore the environment configuration, which consumes a lot of manpower and time. Summary of the invention

[0004] The present invention provides a method, system, device, medium and program for realizing an intrinsically secure mimetic target range, so as to realize an intrinsically secure mimetic white box, simulate the actual white box target device based on the container, reduce the influence of the user attack test on the operation of the white box target device, realize rapid recovery, reduce the manpower cost and time expenditure of the attack test process, and improve the user experience.

[0005] According to one aspect of the present invention, a method for implementing an endogenous safety mimic range is provided, wherein the method applies an endogenous safety mimic system, the endogenous safety mimic system at least includes an input agent, a heterogeneous executor pool, a mimic arbiter, and a control scheduler, and the method includes:

[0006] The target range selection information is obtained through the input agent, the mimetic white box container of the heterogeneous executor pool is started by the control scheduler, and the mimetic white box executor image is loaded into the mimetic white box container;

[0007] Feedback the executable information of the mimetic white box executable image by using the heterogeneous executable pool;

[0008] Acquire attack data of the user corresponding to the executable information through the input agent;

[0009] The mimic arbiter is used to generate an attack score according to the system disturbance of the attack data.

[0010] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0011] at least one processor; and

[0012] a memory communicatively connected to the at least one processor; wherein,

[0013] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for implementing the intrinsically safe simulated shooting range described in any embodiment of the present invention.

[0014] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for implementing an intrinsically safe simulated shooting range as described in any embodiment of the present invention when executed.

[0015] The technical solution of the embodiment of the present invention realizes the target range through the endogenous security mimicry system, and the endogenous security mimicry system at least includes an input agent, a heterogeneous executor pool, a mimicry arbiter, and a control scheduler. The input agent receives the target range selection information, and uses the control scheduler to start the mimicry white box container of the heterogeneous executor pool, loads the mimicry white box executor image to the mimicry white box container, calls the heterogeneous executor pool to feedback the executor information containing the executor image, receives the user's attack data on the executor information through the input agent, and determines the attack score based on the system disturbance of the attack data through the mimicry arbiter. The embodiment of the present invention constructs a mimicry white box target machine through the endogenous security mimicry system, isolates the attack resource data based on the container, prevents the user's attack test from affecting the underlying operating environment of the mimicry white box, can realize the rapid reset of the mimicry white box target machine, and realizes the rapid recovery of the system after the attack test. According to the mimicry arbiter, the user's attack effect on the mimicry white box target machine can be accurately judged, and the attack evaluation is more objective and accurate, which can improve the accuracy of the attack test.

[0016] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 is a flow chart of a method for realizing an intrinsically safe mimic shooting range provided according to Embodiment 1 of the present invention;

[0019] Figure 2 is a flowchart of another method for realizing an intrinsically safe simulated shooting range provided according to the second embodiment of the present invention;

[0020] Figure 3 is a flowchart of another method for implementing an intrinsically safe mimic shooting range provided according to Embodiment 3 of the present invention;

[0021] Figure 4 is a flowchart of another method for implementing an intrinsically safe mimic shooting range provided according to a fourth embodiment of the present invention;

[0022] Figure 5 is a flowchart of a method for implementing an intrinsically safe simulated shooting range according to Embodiment 5 of the present invention;

[0023] Figure 6 This is a system architecture diagram of a shooting range implementation provided by Embodiment 5 of the present invention;

[0024] Figure 7 is a system architecture diagram of an intrinsically safe mimic shooting range implementation system provided according to Embodiment 5 of the present invention;

[0025] Figure 8 is a structural schematic diagram of a shooting range realization device based on intrinsic safety mimicry provided according to Embodiment 6 of the present invention;

[0026] Fig. 9 It is a structural schematic diagram of an electronic device for implementing a method for implementing a shooting range based on intrinsic safety mimicry according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 is a flowchart of a method for implementing an intrinsically safe mimicry range according to the first embodiment of the present invention. This embodiment is applicable to the construction of a white-box range. The range implementation method can be implemented in the form of hardware and / or software, and can be implemented by an intrinsically safe mimicry system. Figure 1 , the method comprising:

[0031] Step 110: Obtain the target range selection information through the input agent, use the control scheduler to start the mimetic white box container of the heterogeneous executor pool, and load the mimetic white box executor image in the mimetic white box container.

[0032] Among them, the input agent is mainly responsible for receiving external input signals in the intrinsic security mimicry system, and copying the received signals and sending them to the heterogeneous execution body pool, which acts as a bridge connecting the external and internal execution of the system. The range selection information can be information for selecting a white box range. The range selection information can select a specific type of range, which can include different scenes, different environments, etc. The range selection information can be triggered by the user. For example, the user can connect to the intrinsic security mimicry system through a personal terminal, and the user can send the range selection information to the intrinsic security mimicry system through a personal terminal, or the user can send the range selection information to the intrinsic security mimicry system through the range management platform.

[0033] Specifically, the control scheduler can be a module for managing, scheduling and managing the heterogeneous executor pool in the endogenous security mimicry system. The control scheduler can pre-configure certain strategies, which can be used to select a suitable combination of executors to process input data and dynamically adjust the working state of the executor during operation. The control scheduler can have functions such as executor selection, dynamic scheduling, feedback and optimization. The heterogeneous executor pool is a set of executors that can include multiple specific different internal structures, implementation methods and characteristics. The heterogeneous executor pool can include one or more executors for attack testing, and the heterogeneous executor pool includes at least one executor corresponding to the test function of the white box target machine. The mimetic white box container can be a container environment built in the heterogeneous executor pool. The mimetic white box container can isolate the running resources of different executors to avoid the related influence between different heterogeneous executors, so as to perform security analysis and detection. The mimetic white box container can be implemented through container technologies such as Docker and Kubernetes. The corresponding container runtime environment can be installed in the endogenous security system through the selected container technology, and the container runtime parameters such as memory limit and CPU quota can be configured, and the mimetic white box container can be deployed through container orchestration attack. The mimetic white box container can load the mimetic white box executable image into the created mimetic white box container by controlling the scheduler, thereby running the executable that implements the white box target machine test function. The mimetic white box executable image can include the necessary components and dependencies of the executable in the heterogeneous executable pool. The mimetic white box executable image can include the executable program, dependent libraries, and configuration files.

[0034] In an embodiment of the present invention, a user may trigger a range selection information. When the input agent receives the range selection information, it may call a control scheduler to start a mimetic white box container in a heterogeneous executor pool. The mimetic white box container may be pre-configured in the heterogeneous executor pool. After starting the mimetic white box container, the control scheduler may load a mimetic white box executor image. The loaded mimetic white box executor image may be pre-configured. When it is determined that the range selection information is received, the control scheduler directly loads the pre-configured mimetic white box executor image into the mimetic white box container.

[0035] Step 120: Use the heterogeneous executor pool to feed back the executor information of the pseudo white box executor image.

[0036] The executable information may include attribute information related to the executable, the executable information includes information for opening the executable for use, and the executable information may include an executable port and an executable identifier.

[0037] Specifically, after the executable image is loaded into the mimetic white box in the heterogeneous executable pool, the attribute information of the generated executable can be obtained. The attribute information may include the executable port and the executable identifier, etc. The heterogeneous executable pool can feedback the executable information, so that the user can obtain the executable information to perform attack tests on the executable in the mimetic white box.

[0038] Step 130: Obtain attack data of the user's corresponding executable information through the input agent.

[0039] Among them, the attack data may be information about attacks on the executable body in the mimetic white box, and the attack data may include but is not limited to network traffic data, system log data, vulnerability exploitation data, and malware sample data.

[0040] In an embodiment of the present invention, the user's attack data can be connected through an input agent, and the intrinsic security system can input the attack data corresponding to the executable information into the heterogeneous execution pool through the input agent, thereby performing an attack test on the executable corresponding to the executable information in the mimetic white box based on the attack data.

[0041] Step 140: Generate an attack score based on the system disturbance of the attack data using a mimicking arbitrator.

[0042] Among them, the mimetic arbitrator can judge the output information of the executable body, and can compare and determine each output information through multiple selection, consistency comparison, weight judgment and other methods to determine the system disturbance situation. The system disturbance situation can include the interference or change of the normal operating state of the endogenous safety system caused by the attack. The system disturbance situation can be quantified by a normalized value. The system disturbance situation can be evaluated by the mimetic arbitrator from the aspects of performance degradation, functional abnormality, and increased security risk. The attack score can be a quantified value output by the mimetic arbitrator. The attack score can be determined by the system disturbance situation. There can be a corresponding relationship between the attack score and the system disturbance situation. The mimetic arbitrator can determine the attack score by the system disturbance situation. For example, the mimetic arbitrator can count the evaluation indicators such as the proportion of executable bodies that output correct results in the mimetic white box, the number of executable bodies that output normal results, and the number of scripts injected into the executable body, and use the above evaluation indicators together as the system disturbance situation. The mimetic arbitrator can use the weighted sum of each evaluation indicator as the attack score. It can be understood that the weight coefficients of different evaluation indicators can be different.

[0043] In an embodiment of the present invention, a target range is realized through an endogenous security mimicry system, and the endogenous security mimicry system at least includes an input agent, a heterogeneous executor pool, a mimicry arbiter, and a control scheduler. The input agent receives the target range selection information, and uses the control scheduler to start the mimicry white box container of the heterogeneous executor pool, load the mimicry white box executor image to the mimicry white box container, call the heterogeneous executor pool to mimic the executor information containing the executor image for feedback, receive the user's attack data on the executor information through the input agent, and determine the attack score based on the system disturbance of the attack data through the mimicry arbiter. In an embodiment of the present invention, a mimicry white box target is constructed through an endogenous security mimicry system, and the attack resource data is isolated based on the container to prevent the user's attack test from affecting the underlying operating environment of the mimicry white box, so that the mimicry white box target can be quickly reset, and the system can be quickly restored after the attack test. According to the mimicry arbiter, the user's attack effect on the mimicry white box target can be accurately judged, and the attack evaluation is more objective and accurate, which can improve the accuracy of the attack test.

[0044] Furthermore, based on the above-mentioned embodiments of the invention, the present invention further includes:

[0045] Create a mimic white box executor image according to the mimic white box executor configured in the heterogeneous executor pool.

[0046] In an embodiment of the present invention, an executable body can be configured for a test point or function of an attack test in a heterogeneous executable body pool. The executable body configured in the heterogeneous executable body pool can be located in an image repository of a mimetic white box. The executable body configured in the image repository can be read to obtain program files, library files, and tools of the executable body. The environment variables of the executable body can be configured based on the library files and tools, and the environment variables and the executable body can be added to the execution directory of the mimetic white box, thereby realizing the construction of the mimetic white box executable body image.

[0047] For example, taking the construction of a white box container through Docker container technology as an example, you can obtain an executable body that is customized or built by other developers, and you can use RUN, COPY, WORKDIR, etc. to build the Dockerfile file corresponding to the executable body. Save the Dockerfile file and the executable body to the project directory of the mimetic white box in the heterogeneous executable body pool, and use the docerbuid command to build the executable body into a mimetic white box executable body image.

[0048] In some other embodiments of the invention, the method further includes: reconstructing the mimetic white box container according to the control scheduler, and reloading the mimetic white box executable image into the mimetic white box container.

[0049] In an embodiment of the present invention, the mimetic white box container can be reconstructed by controlling the scheduler, and the mimetic white box executable image can be loaded after the mimetic white box container is restarted, so as to realize the recovery of the executable body. By restarting the white box container to realize the recovery of the executable body running environment, it can be convenient for the next user to use.

[0050] Embodiment 2

[0051] Figure 2 is a flowchart of another method for implementing an endogenous security mimic range according to the second embodiment of the present invention, which describes the loading process of the mimic white box execution body image. Figure 2 The method provided in the embodiment of the present invention specifically includes the following steps:

[0052] Step 210: Receive range selection information through an input agent.

[0053] The range selection information may at least include selection information of the actuator, and the selection information may indicate the type of the actuator or the test point. The selection information may indicate the actuator in one of numbers, letters and special symbols.

[0054] In an embodiment of the present invention, a user can input range selection information through an input agent, and the range selection information can be used to indicate at least one executor in a heterogeneous executor pool, and the range constructed by the endogenous security mimicry system can receive the range selection information through the input agent.

[0055] In some embodiments, the range selection information may be directly obtained by the control scheduler, and the range selection information for the external mimetic white box container may be obtained by configuring a request interface for data interaction with the outside in the control scheduler.

[0056] Step 220: Use the control scheduler to extract the target executable body included in the range selection information, and search for the pseudo white box executable body image corresponding to the target executable body in the heterogeneous executable body pool.

[0057] Among them, the target executable body may be a selected executable body, the target executable body may correspond to the target range selection information, the number of target executable bodies may include one or more, and exemplarily, the target range selection information includes a test point, and the test point may correspond to at least one group of heterogeneous executable bodies, and the group of heterogeneous executable bodies may include at least two executable bodies composed of different languages ​​or development environments. The above group of heterogeneous executable bodies corresponding to the target range selection information can be used as the target executable body.

[0058] In an embodiment of the present invention, the target range selection information can be extracted by the control scheduler, one or more target executables required by the user can be determined according to the target range selection information, and the control scheduler can be used to query the mimetic white box executable image in the heterogeneous executable pool according to the target executable. The mimetic white box executable image can be an image file of the target executable. It can be understood that the way in which the control scheduler searches for the mimetic white box executable image can include searching and obtaining it in the image library configured in the heterogeneous executable pool through the executable name or executable identifier of the target executable.

[0059] Step 230: Use the control scheduler to call the container engine of the heterogeneous executor pool, control the container engine through the control scheduler to start the mimetic white box container according to the mimetic white box executor image, and configure the container parameters of the mimetic white box container.

[0060] Among them, the container engine can be a software tool for managing and running containers. The container engine can be configured in a heterogeneous executor pool. The container engine can manage the resources of the mimetic white box container in the heterogeneous executor pool. The container engine can include Docker, Kubernets, and Containerd, etc.

[0061] In an embodiment of the present invention, the container engine of the heterogeneous executor pool can be called by controlling the scheduler, and the container engine can be controlled to start the mimetic white box container of the mimetic white box executor image, and configure the container parameters of the mimetic white box container to provide attack testing to the outside. The container parameters can be information that is open to the mimetic white box container. The container parameters can include container name, port mapping, environment variables, and mounted volumes, etc., so as to start the mimetic white box container to run the mimetic white box container executor image.

[0062] Step 240: Use the heterogeneous executor pool to feed back the executor information of the pseudo white box executor image.

[0063] Specifically, after the heterogeneous executable body pool loads the executable body image into the mimetic white box, the generated executable body information can be obtained, and the executable body information may include the executable body port and the executable body identifier, etc. The heterogeneous executable body pool may feedback the executable body information, so that the user can obtain the executable body information to perform attack tests on the executable body in the mimetic white box. It is understandable that the feedback may include the heterogeneous executable body feedback to the terminal device used by the user or feedback to the range management platform used by the user.

[0064] Step 250: Obtain attack data of the user's corresponding executable information through the input agent.

[0065] Step 260: Generate an attack score based on the system disturbance of the attack data using the mimic arbitrator.

[0066] In an embodiment of the present invention, a shooting range is realized through an intrinsically safe mimicry system. The intrinsically safe mimicry system at least includes an input agent, a heterogeneous executor pool, a mimicry arbiter, and a control scheduler. The shooting range selection information is received through the input agent, the control scheduler is called to parse the shooting range selection information, and the target executor corresponding to the shooting range selection information is determined. The mimicry white box executor image of the target executor is determined in the heterogeneous executor pool by the control scheduler, the container engine is loaded by the control scheduler and the container engine is controlled to start the mimicry white box container of the mimicry white box executor image, and the container parameters of the mimicry white box container are configured, the heterogeneous executor pool is called to mimic the executor information containing the executor image for feedback, the user's attack data on the executor information is received through the input agent, and the attack score is determined based on the system disturbance of the attack data by the mimicry arbiter. The embodiment of the present invention constructs a mimetic white-box target machine through an endogenous security mimetic system, isolates attack resource data based on containers, prevents user attack tests from affecting the underlying operating environment of the mimetic white-box, can realize rapid resetting of the mimetic white-box target machine, and realizes rapid recovery of the system after attack testing. Based on the container engine, the target execution body corresponding to the target range selection information is loaded, which is convenient for realizing rapid configuration of the target machine in the target range, can reduce the deployment time of the target range, and improve the user experience. The attack effect of the mimetic white-box target machine is evaluated by the mimetic judge, which improves the objectivity of the attack evaluation and the accuracy of the attack test.

[0067] Further, based on the above-mentioned embodiment of the invention, the container parameters include a container name, a port mapping, an environment variable, and a mounted volume.

[0068] In an embodiment of the present invention, the container name is a string used to identify and distinguish different mimetic white box containers. It can help users more easily identify and locate specific mimetic white box containers when managing multiple mimetic white box containers. The container names of mimetic white box containers corresponding to different mimetic white box executable images may be different. Port mapping can be mapping the port used by the service running inside the mimetic white box container to the port of the host machine. The port mapping can be used to access the executable body in the mimetic white box container through the mapped port of the host machine. Environment variables are variables that can be passed to the executable body in the mimetic white box container when the mimetic white box container is running. They can be used to configure the behavior of the application, provide connection information, set parameters, etc. Mounting a volume is to mount a directory or file on the host machine to a specified path in the mimetic white box container, so that the mimetic white box container can access the file system resources on the host machine.

[0069] In some inventive embodiments, the heterogeneous executor pool includes at least one pair of heterogeneous executors.

[0070] In the embodiment of the present invention, the number of executable bodies constructed by the mimetic white box executable body mirror in the heterogeneous executable body can be multiple, and there is at least one pair of heterogeneous executable bodies among the multiple executable bodies, and the heterogeneous executable bodies have multiple execution units with differences in structure, function, implementation method, etc. These execution units are usually used to jointly complete a task or realize a specific function of a system. The above heterogeneous executable bodies can facilitate the mimetic arbitrator to evaluate the system disturbance of the attack data.

[0071] Embodiment 3

[0072] Figure 3 is a flowchart of another method for implementing an endogenous safety mimic range according to the third embodiment of the present invention. The feedback process of the executive information is described in the embodiment of the present invention. Figure 3 The method provided in the embodiment of the present invention specifically includes the following steps:

[0073] Step 310: Obtain the target range selection information through the input agent, use the control scheduler to start the mimetic white box container of the heterogeneous executor pool, and load the mimetic white box executor image in the mimetic white box container.

[0074] Step 320: Determine the port mapping and image name of the mimic white box executive image through the heterogeneous executive pool as executive information.

[0075] In an embodiment of the present invention, the heterogeneous executor pool can collect the port mapping and image name of the mimetic white box executor image, and can use the collected information as the executor information of each mimetic white box executor image. The heterogeneous executor pool can feedback the collected executor information, so that the user can obtain the executor information for accessing the executor in the mimetic white box container to perform attack testing.

[0076] Step 330: Use the heterogeneous executor pool to feed back the executor information to the range management platform that is connected to the intrinsic safety mimicry system.

[0077] Among them, the range management platform can be a software system for managing and controlling the cybersecurity range. The range management platform provides a series of functions, including range resource management, user management, task allocation, and result evaluation. The range management platform can be implemented through cloud technology, and users can access and control the endogenous security mimicry system through the range management platform.

[0078] In an embodiment of the present invention, the intrinsic security mimicry system can be communicatively connected to a range management platform, and users can access and conduct attack tests on the range implemented by the intrinsic security mimicry system through the range management platform. After obtaining the executor information, the heterogeneous executor pool can directly feed back the executor information to the range management platform, so that users can continue to receive the executor information through the range management platform for attack testing.

[0079] Step 340: Obtain attack data of the user's corresponding executable information through the input agent.

[0080] Step 350: Generate an attack score based on the system disturbance of the attack data using a mimicking arbitrator.

[0081] In an embodiment of the present invention, a shooting range is realized through an intrinsic security mimicry system. The intrinsic security mimicry system at least includes an input agent, a heterogeneous executor pool, a mimicry arbiter and a control scheduler. The input agent is called to receive shooting range selection information, the control scheduler is used to start the mimicry white box container of the heterogeneous executor pool, the mimicry white box executor image is loaded into the mimicry white box container, the heterogeneous executor pool is called to obtain the port mapping and the image name of the mimicry white box executor image as the executor information, the executor information is fed back to the shooting range management platform that is communicated with the intrinsic security mimicry system through the heterogeneous executor pool, the user's attack data on the executor information is received through the input agent, and the attack score is determined based on the system disturbance of the attack data through the mimicry arbiter. The embodiment of the present invention implements a white box target machine through an endogenous security mimicry system, and constructs an executable body through a white box mimicry container, which is convenient for users to perform attack tests. The resource data between the executable bodies are isolated from each other to prevent the user's attack test from affecting the underlying operating environment of the mimicry white box, thereby reducing the impact of the attack test on the stability of the target range system. The mimicry white box target machine is quickly reset through the container image, and the system is quickly restored after the attack test. The user's attack effect on the mimicry white box target machine can be accurately judged according to the mimicry arbitrator, and the attack evaluation is more objective and accurate, which can improve the accuracy of the attack test.

[0082] Figure 4 is a flowchart of another method for implementing an endogenous security mimicry range according to Embodiment 4 of the present invention. The present invention describes the process of generating an attack score. Figure 4 The method provided in the embodiment of the present invention specifically includes the following steps:

[0083] Step 410: Obtain the range selection information through the input agent, use the control scheduler to start the mimetic white box container of the heterogeneous executor pool, and load the mimetic white box executor image in the mimetic white box container.

[0084] Step 420: Use the heterogeneous executor pool to feed back the executor information of the pseudo white box executor image.

[0085] Step 430: Obtain attack data of the user's corresponding executable information through the input agent.

[0086] Step 440: Determine a mimetic white box container through a mimetic arbitrator, wherein the white box executable corresponding to the mimetic white box executable image loaded in the mimetic white box container is a heterogeneous executable.

[0087] The white box executable body may be an executable body in a heterogeneous executable body pool for providing attack testing, the white box executable body may have a heterogeneous executable body, and the image corresponding to the white box executable body may be recorded as a target mimic white box executable body image.

[0088] Specifically, the mimetic arbiter may determine a mimetic white box container for running at least one pair of heterogeneous executors, where the at least one pair of heterogeneous executors runs in different mimetic white box containers. The mimetic arbiter may determine a mimetic white box container for running at least one pair of heterogeneous executors.

[0089] Step 450: Use the mimic arbitrator to determine the output result of the white box executable executing the attack data.

[0090] In an embodiment of the present invention, the mimicry arbiter can monitor the determined white box executor and obtain the output result of each white box executor for the attack data, which may include the data processing result of the normal working state or the abnormal error information of the abnormal working state.

[0091] Step 460: Compare the output results through the mimic arbiter, obtain the difference degree of the output results as the system disturbance situation, and determine the attack score corresponding to the system disturbance situation.

[0092] Among them, the degree of difference in output results refers to the degree of difference between the output results generated by different executors or systems under the same input conditions. This difference can be reflected in many aspects, such as the size of the value, the content of the text, the characteristics of the image, etc. The degree of difference in the output results can be achieved through qualitative evaluation and / or quantitative evaluation. Quantitative evaluation can refer to the use of numerical indicators to evaluate the degree of difference in the output results. For example, the distance, similarity, error and other indicators between two output results can be calculated. Common distance indicators include Euclidean distance, Manhattan distance, cosine distance, etc.; similarity indicators include Pearson correlation coefficient, cosine similarity, etc.; error indicators include mean square error, mean absolute error, etc. Qualitative evaluation can determine the degree of difference in output results through statistical analysis or model processing. For example, the visualization effects, text descriptions, logical reasoning and other aspects of different output results can be compared to determine the degree of difference between them. This can be achieved through expert systems, natural language models or multimodal large models.

[0093] Specifically, the mimetic arbiter can obtain the output results belonging to heterogeneous executors, and make quantitative or qualitative comparisons of these output results to determine the degree of difference in the output results. The degree of difference between different output results can be determined, and the degree of difference can be used as a system disturbance condition, and an attack score can be determined based on the system disturbance condition. For example, a mapping relationship can be configured between the system disturbance condition and the attack score, and the system disturbance condition can be mapped to the attack score according to the mapping relationship.

[0094] In an embodiment of the present invention, a shooting range is realized through an intrinsically safe mimicry system, which includes at least an input agent, a heterogeneous executor pool, a mimicry arbiter, and a control scheduler. The shooting range selection information is received through the input agent, and the mimicry white box container of the heterogeneous executor pool is started by the control scheduler, the mimicry white box executor image is loaded into the mimicry white box container, the heterogeneous executor pool is called to mimic the executor information containing the executor image for feedback, the user's attack data on the executor information is received through the input agent, at least one group of mimicry white box containers with heterogeneous executors is determined through the mimicry arbiter, and the output results of the white box executors in the mimicry white box container are determined, the output results are compared through the mimicry arbiter, the difference degree is obtained as the system disturbance situation, and the attack score corresponding to the system disturbance situation is determined. The embodiment of the present invention constructs a mimetic white box target machine through an endogenous security mimetic system, isolates attack resource data based on containers, prevents user attack tests from affecting the underlying operating environment of the mimetic white box, can quickly reset the mimetic white box target machine, and quickly recover the system after the attack test. The mimetic judge can accurately judge the effect of the user's attack on the mimetic white box target machine, and the attack evaluation is more objective and accurate, which can improve the accuracy of the attack test.

[0095] Further, based on the above-mentioned embodiment of the invention, comparing each output result by the mimic arbiter includes at least one of the following:

[0096] Compare the ratio of the number of identical output results in each output result to the total number of each output result; output the similarity value of each output result based on the pre-trained machine learning model.

[0097] In an embodiment of the present invention, the comparison of output results can be achieved through preset rules or machine learning models. The preset rules may include comparing the ratio of the number of identical output results in the output results to the total number of each output result, or pre-training a machine learning model to determine the similarity values ​​of all output results through the machine learning model. The machine learning model may include a support vector machine model, a convolutional neural network model, a natural language model, etc.

[0098] Furthermore, based on the above-mentioned embodiment of the invention, the white box executable bodies included in the heterogeneous executable body pool are stored in the same file system directory.

[0099] In the embodiment of the present invention, in order to facilitate the management of the executable body, the executable body used to implement the attack test can be stored in the same file system target of the heterogeneous executable body pool.

[0100] Furthermore, based on the above-mentioned embodiments of the invention, it also includes: determining that the system disturbance situation is greater than the system disturbance threshold, destroying the mimetic white box container by controlling the scheduler, and rebuilding the mimetic white box container according to the mimetic white box execution body image.

[0101] Among them, the system disturbance threshold can be a quantitative value, which can represent the upper limit threshold of the destruction of the attack data. When the system disturbance of the attack data is greater than the system disturbance threshold, it can be determined that the white box target range is completely destroyed. The complete destruction will map the subsequent attack tests. The system disturbance threshold can be set according to experience or experiments.

[0102] In an embodiment of the present invention, when the quantized value of the system disturbance condition of the acquired attack data is greater than a pre-configured system disturbance threshold, the mimetic white box container can be destroyed by calling a control scheduler, and the mimetic white box container is regenerated after being destroyed, thereby achieving rapid recovery of the target machine of the attack test.

[0103] Embodiment 5

[0104] In an embodiment of the present invention, in order to overcome the problem that the existing technology is difficult to quickly restore the simulated white box target environment, an embodiment of the present invention provides a target range implementation method based on intrinsic security mimicry. This method simulates actual equipment through containers, and transplants key service programs in actual equipment into containers for operation. When the container is damaged or the game enters the next round of reset and recovery, the container destruction and image initialization restart mechanism can be used to achieve rapid recovery. The problem of large maintenance manpower requirements and long recovery time during the competition is solved, and batch management can be achieved using container management technology, which can truly achieve one-click recovery and improve the efficiency of game environment configuration. See Figure 5 as well as Figure 6 The method for implementing a shooting range based on intrinsic safety mimicry provided by an embodiment of the present invention may include the following steps:

[0105] Step 1: Containerize the executable body of the intrinsic security system and generate a container image.

[0106] Among them, the containerization transformation of the executor of the intrinsic security system may include the following:

[0107] 1. Determine the file system location of all storage data of the intrinsic security system and write all output data of the executable to the same directory of the file system;

[0108] 2. Extract the environment configuration parameters in the executable and set them as environment variables; the environment configuration parameters may include but are not limited to database configuration, server configuration, log level, storage location, and authentication credentials;

[0109] 3. Shut down or migrate services that are not related to the attack test.

[0110] 4. Create an image of the executable based on Dockerfile;

[0111] 5. Generate a startup script for configuration.

[0112] Furthermore, the containerization of the intrinsic safety system executor can ensure the heterogeneous characteristics by implementing the executor services in languages ​​such as Java, C, C++, and Go, and encapsulating them into container images. In addition, the scheduling controller of the intrinsic safety system can also be transformed to receive requests from the range management platform, report competition results, and manage containers.

[0113] Step 2: The player / team logs into the range management platform and selects the intrinsic security system to be attacked. The range management platform requests white box resources from the corresponding intrinsic security system.

[0114] Step three: The endogenous security system schedules the executor, sends a request to the container management, creates a mimetic white box container, and generates a mimetic white box executor (target machine).

[0115] For example, Figure 7 The following is an example of the architecture of an intrinsic safety system, where the number of executive bodies E i ={D1,D2,…,D n |R1,R2,…,R n}, that is, the number of executable bodies is equal to the sum of the number of executable bodies in the container plus the number of executable bodies outside the container. After receiving the pseudo white box request from the range management platform, the control scheduler of the intrinsic safety system schedules and controls its own executable body, loads the executable body image into the container through container management, and sets the necessary port mapping, etc., opens the container as a white box, and generates a pseudo white box target (executor D1); the control scheduler of the intrinsic safety system can also notify the range management platform of the information parameters of the pseudo white box creation and white box opening.

[0116] Step 4: After the mimic white box is created, the contestant can conduct an attack test on the target machine.

[0117] Step 5: After the contestant finishes the competition, the endogenous safety system will judge the effectiveness of the attack and feed the results back to the range management platform for statistics.

[0118] Furthermore, step five specifically includes the following process:

[0119] Step 5.1: The mimicry adjudication module in the intrinsic safety system monitors the player’s attack in real time. If it causes disturbance or breaches the intrinsic safety system, the result needs to be reported to the range management platform immediately.

[0120] Step 5.2: The mimetic white box executor that causes the disturbance is taken offline according to the debugging mechanism of the intrinsic security system, that is, the container is destroyed.

[0121] In step 5.3, if the contestant does not cause effective disturbance or attack, the mimetic white box executor container also needs to be destroyed. When the next round of competition is carried out, the container is rebuilt from the original image to provide a mimetic white box with exactly the same initial environment to prevent the contestant in the previous round from causing environmental pollution or interference to the contestant in the next round.

[0122] Embodiment 6

[0123] Figure 8 : is a structural schematic diagram of an endogenous security mimicry range implementation device provided according to Embodiment 6 of the present invention, the device is applied to an endogenous security mimicry system, the endogenous security mimicry system includes at least an input agent, a heterogeneous executor pool, a mimicry arbiter and a control scheduler, the device includes:

[0124] The container startup module 501 is used to obtain the target range selection information through the input agent, start the mimetic white box container of the heterogeneous executor pool by using the control scheduler, and load the mimetic white box executor image in the mimetic white box container.

[0125] The information feedback module 502 is used to feedback the executable information of the pseudo white box executable image by using the heterogeneous executable pool.

[0126] The attack response module 503 is used to obtain the attack data of the user's corresponding executable information through the input agent.

[0127] The score processing module 504 is used to generate an attack score according to the system disturbance of the attack data by using the mimic arbitrator.

[0128] In some embodiments of the invention, the apparatus further comprises: an image creation module, configured to create a mimetic white box executable image according to the mimetic white box container executable configured in the heterogeneous executable pool.

[0129] In some other embodiments of the invention, the apparatus further includes: a container restart module, configured to reconstruct the mimetic white box container according to the control scheduler, and reload the mimetic white box executable image into the mimetic white box container.

[0130] In some inventive embodiments, the container startup module 501 includes:

[0131] The information receiving unit is used to receive the shooting range selection information through the input agent.

[0132] The image search unit is used to use the control scheduler to extract the target executable body included in the target range selection information, and search for the mimetic white box executable body image corresponding to the target executable body in the heterogeneous executable body pool.

[0133] The image encapsulation unit is used to use the control scheduler to call the container engine of the heterogeneous executor pool, control the container engine through the control scheduler to start the mimetic white box container according to the mimetic white box executor image, and configure the container parameters of the mimetic white box container.

[0134] In some inventive embodiments, container parameters include container name, port mappings, environment variables, and mounted volumes.

[0135] In some inventive embodiments, the heterogeneous executor pool includes at least one pair of heterogeneous executors.

[0136] In some inventive embodiments, the information feedback module 502 includes:

[0137] The information collection unit is used to determine the port mapping and image name of the mimic white box executor image as the executor information through the heterogeneous executor pool.

[0138] The information feedback unit is used to utilize the heterogeneous executor pool to feed back the executor information to the range management platform that is connected to the intrinsic safety mimicry system.

[0139] In some other inventive embodiments, the scoring processing module 504 includes:

[0140] The heterogeneous selection unit is used to determine the mimetic white box container through the mimetic arbiter, wherein the white box executable corresponding to the mimetic white box executable image loaded in the mimetic white box container is a heterogeneous executable.

[0141] The result monitoring unit is used to determine the output result of the white box execution body executing the attack data by using the mimic arbitrator.

[0142] The scoring generating unit is used to compare the output results through the mimicking arbitrator, obtain the difference degree of the output results as the system disturbance situation, and determine the attack score corresponding to the system disturbance situation.

[0143] In some embodiments of the invention, comparing the output results by the mimic judge in the score generation unit includes at least one of the following:

[0144] Compare the ratio of the number of identical output results in each output result to the total number of each output result;

[0145] Outputs the similarity value of each output result based on the pre-trained machine learning model.

[0146] In some inventive embodiments, the white-box executables included in the heterogeneous executable pool are stored in the same file system directory.

[0147] In some inventive embodiments, the device further includes: a destruction recovery module, configured to determine that a system disturbance condition is greater than a system disturbance threshold, destroy the mimetic white box container by controlling the scheduler, and rebuild the mimetic white box container according to the mimetic white box execution body image.

[0148] The shooting range realization device based on intrinsic safety mimicry provided in the embodiment of the present invention can execute the shooting range realization method based on intrinsic safety mimicry provided in any embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method.

[0149] Embodiment 7

[0150] Fig. 9 It is a structural schematic diagram of an electronic device for implementing the method for implementing the intrinsic safety mimic range of an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0151] like Fig. 9 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0152] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0153] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the endogenous safety mimic range implementation method.

[0154] In some embodiments, the method for implementing a range based on intrinsic security mimicry may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for implementing a range based on intrinsic security mimicry described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the method for implementing an intrinsic security mimicry range by any other appropriate means (e.g., by means of firmware).

[0155] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0156] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0157] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0158] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0159] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0160] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0161] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0162] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for realizing an endogenous safety mimicry shooting range, characterized in that: Applied to an intrinsically safe mimicry system, the intrinsically safe mimicry system includes at least an input agent, a heterogeneous executor pool, a mimicry arbitrator, and a control scheduler, and the method includes: The target range selection information is obtained through the input agent, the mimetic white box container of the heterogeneous executor pool is started by the control scheduler, and the mimetic white box executor image is loaded into the mimetic white box container; Feedback the executable information of the mimetic white box executable image by using the heterogeneous executable pool; Acquire attack data of the user corresponding to the executable information through the input agent; The mimic arbiter is used to generate an attack score according to the system disturbance of the attack data.

2. The method according to claim 1, characterized in that: Also includes: The mimic white box container executable body is configured according to the heterogeneous executable body pool to create the mimic white box executable body image.

3. The method according to claim 1, characterized in that: Also includes: The mimetic white box container is reconstructed according to the control scheduler, and the mimetic white box executable image is reloaded into the mimetic white box container.

4. The method according to claim 1, characterized in that: The step of obtaining the range selection information through the input agent, starting the mimetic white box container of the heterogeneous executor pool by using the control scheduler, and loading the mimetic white box executor image in the mimetic white box container includes: receiving the range selection information via the input agent; Utilizing the control scheduler to extract the target executable body included in the range selection information, and searching the heterogeneous executable body pool for the mimetic white box executable body image corresponding to the target executable body; The control scheduler is used to call the container engine of the heterogeneous execution body pool, and the control scheduler controls the container engine to start the mimetic white box container according to the mimetic white box execution body image, and configures the container parameters of the mimetic white box container.

5. The method according to claim 4, characterized in that: The container parameters include container name, port mapping, environment variables, and mounted volumes.

6. The method according to claim 4, characterized in that: The heterogeneous executor pool includes at least one pair of heterogeneous executors.

7. The method according to claim 1, characterized in that: The using the heterogeneous executor pool to feed back the executor information of the mimetic white box executor image includes: Determine the port mapping and the image name of the mimetic white box executor image as the executor information through the heterogeneous executor pool; The heterogeneous executor pool is used to feed back the executor information to a range management platform that is communicatively connected to the intrinsic safety mimicry system.

8. The method according to claim 1, characterized in that: The using the mimic arbiter to generate an attack score according to the system disturbance of the attack data includes: Determining the mimetic white box container by the mimetic arbiter, wherein the white box executable corresponding to the mimetic white box executable image loaded in the mimetic white box container is a heterogeneous executable; Determine, by using the mimic arbitrator, an output result of the white-box executive executing the attack data; The output results are compared by the mimicking arbitrator to obtain the difference between the output results as the system disturbance situation, and the attack score corresponding to the system disturbance situation is determined.

9. The method according to claim 1, characterized in that: Also includes: It is determined that the system disturbance condition is greater than a system disturbance threshold, the mimetic white box container is destroyed by the control scheduler, and the mimetic white box container is rebuilt according to the mimetic white box execution volume image.

10. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for implementing an intrinsically safe simulated shooting range as described in any one of claims 1-9.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for realizing an intrinsically safe simulated shooting range according to any one of claims 1 to 9 when executed.

12. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the method for realizing an intrinsically safe simulated shooting range according to any one of claims 1 to 9.

Images