Network security test and evaluation system and working method

Abstract

The invention provides a network security test and evaluation system. The system comprises a data volume debugging module, a test data planning module, an information stealing module, an evaluation module, an encryption module and a correction module. According to the invention, the test data is divided into independent test units through the test data planning module, and the volume of the test data is adjusted according to the difference value between the maximum load and the application load of the network system through the data volume debugging module. According to the method, the test unit is selected according to the volume required by the test data to attack the network system, so that the channel of the network system can be prevented from being excessively occupied, the network system can be prevented from changing a card during the security test, and the normal use of the network system is ensured; and the stolen information and the information imported into the evaluation module by the network system are encrypted through the encryption software, so that the security of the information in the network system is ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a network security testing and evaluation system and a working method. Background Art

[0002] Network security includes network software security, network equipment security and network information security. It refers to protecting the hardware, software and data in the network system from accidental or malicious changes, destruction or leakage, so that the system can run reliably, continuously and normally, and network services are uninterrupted. Network security testing and evaluation refers to testing network security and evaluating network security through test results; at the same time, network security testing can also disclose system vulnerabilities, making it easier for managers to correct the system.

[0003] In the prior art, network security testing usually adopts penetration testing, which simulates hacker attacks on network systems after obtaining authorization to discover deep-seated security issues; a large amount of test data will be generated during the testing process, and the crowding out of test data will cause the data transmission speed in the network system to slow down, and then cause the network system to become stuck, which will affect the normal use of the network system; when conducting penetration testing, the test system will obtain data in the network system, and in this process, the data in the network system may be stolen. Summary of the invention

[0004] The purpose of the present invention is to provide a network security test evaluation system and a working method thereof, which can reasonably allocate the test data volume and evaluate the network security test while ensuring the normal operation of the network system, so as to solve the problem that the network system proposed in the above background technology is prone to jamming and data is prone to theft during security testing.

[0005] The present invention provides a network security testing and evaluation system, comprising:

[0006] The data volume debugging module is used to monitor the application load of the network system in real time and adjust the volume of test data according to the difference between the maximum load of the network system and the application load;

[0007] The test data planning module is used to classify the prepared test data, divide the test data into several test units according to their functionality, calculate the volume of different types of test units, and then select the test unit to attack the network system according to the required volume of the test data;

[0008] An information stealing module is used to steal information stored in the network system and encrypt and transmit the stolen information;

[0009] The evaluation module is used to insert the evaluation template and, after the test is completed, to compare the authenticity of the encrypted stolen information with the encrypted data imported by the network system, and to substitute the comparison result into the evaluation template to obtain the security evaluation of the network system;

[0010] An encryption module, used to insert encryption software and encrypt the information stolen by the information stealing module and the information imported into the evaluation module by the network system through the encryption software;

[0011] The correction module is used to count the intrusion situations of test data and the weak defense areas of the network system and display them.

[0012] Preferably, the data volume debugging module also includes a data stabilization module, which is used to count the fluctuation frequency k of the difference between the maximum load of the network system and the application load, and when the absolute value of the fluctuation frequency k is greater than the safety threshold, triggers the data volume debugging module to adjust the volume of the test data in advance.

[0013] Preferably, after dividing the test data into test units, the test data planning module tests the interference degree of the test units under the change of the test limit, and reclassifies the test units based on the interference degree; then the interference degree of the reclassified test units is associated with the absolute value of the fluctuation frequency k, and when selecting the test units under known volume, the test units are preferentially selected according to the absolute value of the fluctuation frequency k.

[0014] Preferably, the information theft module also includes a theft restriction module, which is used to select a storage range of stealable information in the network system and define the information stored in the stealable information storage range as test information; when stealing information stored in the network system, the information theft module only steals test information; the encrypted data imported into the evaluation module is also test information.

[0015] Preferably, the information theft module also includes a confidentiality setting module, which is used to set the importance of the test information and import the importance of the test information into the evaluation module as a scoring coefficient; when scoring, the evaluation module uses the result calculated by the evaluation template multiplied by the scoring coefficient to obtain the actual score of network security.

[0016] Preferably, it also includes an error reporting module, which is used to monitor the source of the stolen data by the information theft module, the encryption status of the stolen information, and the encryption status of the test information of the evaluation module imported by the network system; and to issue an alarm when the source of the stolen data is wrong, the stolen information is not encrypted, or the test information imported by the network system is not encrypted.

[0017] Preferably, the correction module also includes an estimation module, which is used to monitor the volume of test data during invasion and the call degree of computing power during network system defense, and analyze the test units that restrain the network system based on the ratio of the call degree of computing power during network system defense to the volume of test data during invasion; and mobilize the test units in the test data planning module, giving priority to planning this type of test units.

[0018] The present invention provides a working method of a network security testing and evaluation system, comprising the following steps:

[0019] (1) Use the difference between the maximum load of the network system and the application load to adjust the volume of test data;

[0020] (2) Divide the test data into several test units according to their functionality, and select the test units to attack the network system according to the required volume of test data;

[0021] (3) After breaking into the network system, steal the information stored in the network system and transmit it in encrypted form;

[0022] (4) Compare the authenticity of the stolen information with the encrypted data imported into the network system, and substitute the comparison results into the evaluation template for security assessment;

[0023] (5) Collect statistics on intrusions into test data and weak areas of network system defense and display them.

[0024] The beneficial effects of the present invention are as follows:

[0025] 1. The present invention divides the test data into individual test units through the test data planning module, and then adjusts the volume of the test data according to the difference between the maximum load of the network system and the application load through the data volume debugging module. When testing the network security, the test unit is selected according to the required volume of the test data to attack the network system, which can avoid the channel of the network system from being too crowded, and further can make the network system not become stuck during the security test, thereby ensuring the normal use of the network system;

[0026] 2. The present invention encrypts the stolen information and the information imported into the evaluation module by the network system through encryption software; thus, even if the information stolen by the present system is stolen, the information in the network system will not be leaked, thereby ensuring the security of the information in the network system;

[0027] 3. The present invention inserts external encryption software through the encryption module, and customers can choose different encryption software according to their own needs, thereby increasing the confidentiality of the password and protecting the security of network information. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings constituting a part of the present application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention:

[0029] Figure 1 is a schematic diagram of the composition of a network security testing and evaluation system according to an embodiment of the present invention;

[0030] Figure 2 It is a schematic diagram of a working method of a network security testing and evaluation system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] The present invention provides a network security testing and evaluation system. Figure 1 As shown, it includes: a data volume debugging module, a test data planning module, an information stealing module, an evaluation module, an encryption module, a correction module and an error reporting module.

[0033] When conducting network security testing, the commonly used test data volume is huge. Directly using all the test data for the entire volume test will cause the network system to become stuck, which will affect the normal use of the network system. If the test is performed when the network system is shut down, it will cause a lot of downtime losses. To avoid downtime losses, the network system can only be tested while it is running. In this process, if you want to ensure that the network system is not stuck, you need to measure the application load of the network system during operation and ensure that the difference between the application load and the maximum load of the network system is greater than a stable threshold, that is, the difference between the maximum load and the sum of the volume of the test data and the application load is greater than the stable threshold, in order to ensure that the network system can operate normally. We use the data volume debugging module to perform real-time detection of the application load of the network system. During the operation of the network system, the application load will continue to change, so the difference between the maximum load and the application load is also a fluctuating value. To ensure that the network system is not stuck, it is necessary to adjust the volume of the test data when the difference between the maximum load and the application load changes, so that the volume of the test data does not interfere with the normal operation of the network system.

[0034] Due to changes in the number of people logging into the network, the difference between the maximum load and the application load may fluctuate greatly, and the moment of large fluctuations will also cause the volume of test data to exceed the standard, thereby affecting the normal operation of the network system; therefore, when mobilizing test data, the difference between the maximum load of the network system and the sum of the test data volume and the application load needs to be much larger than the stability threshold, but this will occupy too much volume of test data; therefore, we use the data stability module in the data volume debugging module to calculate the fluctuation frequency k of the difference between the maximum load and the application load of the network system, and then count the unstable interval of the fluctuation frequency k, and set the safety threshold according to the unstable interval of the fluctuation frequency k. When the absolute value of the fluctuation frequency k is greater than the safety threshold, it indicates that there will be a sudden change between the maximum load and the application load. At this time, space needs to be reserved in advance. Therefore, it is necessary to trigger the data volume debugging module through the data stability module, and the data volume debugging module will adjust the volume of test data in advance to reduce the volume of test data, thereby preventing the network system from becoming stuck.

[0035] The overall volume of test data is large, so the test data can be classified according to the functionality of the test data, and then divided into several test units, such as interference test units, destruction test units, etc. The actual number of test units is related to the functional type of the test data, and then the volume of each test unit is calculated. When mobilizing the test unit, the test unit is selected according to the required volume of the test data, and a single test unit is tried to perform a complete test. The test units are not separated to avoid interference with the use of the test units; then all the selected test units are used to attack the network system to find vulnerabilities in the network system.

[0036] After the test data planning module divides the test data into test units according to functionality, the volume of some test units is too large and may not be able to be fully uploaded. When conducting tests, all test data needs to be used for safety testing, so there will be a situation where the test units are used in limited quantities; therefore, the test data planning module needs to test in advance the degree of interference to the test units under the condition of limited changes, and reclassify the test units based on the degree of interference; then the degree of interference corresponding to the reclassified test units is associated with the absolute value of the fluctuation frequency k. If the absolute value of the fluctuation frequency k is small, it indicates that the volume of the test unit does not need to be adjusted too much, and a test unit with a large degree of interference can be used at this time; conversely, if the absolute value of the fluctuation frequency k is large, it indicates that the volume of the test unit needs to be adjusted too much, and a test unit with a small degree of interference can be used at this time; to ensure that the normal function of the test unit is not affected when the test unit is used in limited quantities.

[0037] After the test data breaks through the security protection of the network system, it is necessary to steal the data in the network system. At this time, the information theft module is used to steal the information stored in the network system. In order to prevent the information stored in the network system from being leaked after the theft, we encrypt the stolen information for transmission, so that even if the data is stolen again, there will be no data leakage. In order to further ensure the security of the information stored in the network system, we set up a theft restriction module in the information theft module. Before conducting a security test, the theft restriction module is used to select the storage range of stealable information in the network system. In this way, the information theft module will only steal information within the information storage range when stealing information; customers can first convert the information within the storage range of stealable information into useless test information, so that even if the test information is leaked, the confidential information in the network system will not be leaked. A confidentiality setting module is also set up in the information theft module. The confidentiality setting module is used to set the importance of the test information. The importance of the test information is classified through the confidentiality setting module. According to the importance of the test information, the strength of the network system's protection capabilities for information of different levels can also be tested. The importance of the test information is then imported into the evaluation module as a scoring coefficient. When the evaluation module is scoring, the normal result score calculated using the evaluation template is used, and then the normal result score is multiplied by the scoring coefficient to obtain the actual network security score.

[0038] The evaluation module is used to evaluate the results of network security tests. Different evaluation templates can be inserted here according to the business direction of the enterprise, so as to have more accurate evaluation results for different enterprises. After the security test is completed, the encrypted stolen information is imported into the evaluation module, and then the evaluation module test information imported by the network system is encrypted to form encrypted data. At this time, the encrypted data is encrypted in the same way as the encrypted stolen information. At this time, the encrypted data and the encrypted stolen information can be compared for authenticity, and then the authenticity comparison results of the encrypted data and the encrypted stolen information are substituted into the evaluation template to obtain the security evaluation of the network system.

[0039] Encryption software is required when encrypting data. The encryption module is set here to encrypt the information stolen by the information theft module and the information imported into the evaluation module by the network system. At the same time, the encryption module can also use encryption software inserted from the outside. When conducting network security testing, customers can choose the inserted encryption software themselves, that is, this system does not select the encryption method of the encryption software, thereby avoiding the possibility of this system leaking network security information.

[0040] After the test evaluation is completed, it is also necessary to display the intrusion situation of the test data and the weak defense areas of the network system to facilitate customers to correct the security defense of the network system. Here, the correction module is used to count the intrusion situation of the test data and the weak defense areas of the network system, and display them.

[0041] Since the present invention only uses the test unit to perform network security testing, when defending the test unit, the higher the computing power used, the easier it is to defend against the attack of the test unit. Therefore, by analyzing the ratio of the calling degree of computing power during network system defense to the volume of test data during invasion, it can be calculated which type of test order the network system needs to call more computing power. Calling computing power indicates that this type of test unit has a certain restraint on the network system. By calling this type of test unit that restrains the network system, it is easier to find loopholes in the network system, thereby obtaining test results more quickly.

[0042] The operation of the system of the present invention may be abnormal, so it is necessary to report an error to prevent the system from leaking information of the network system; an error reporting module is provided here to issue an alarm when the system is abnormal; the source of the stolen data by the information stealing module, the encryption status of the stolen information, and the encryption status of the test information of the evaluation module imported by the network system are detected through the error reporting module; when the data stolen by the information stealing module exceeds the storage range of the stolen information, an alarm notification is issued to prevent other information from being accidentally leaked; when the stolen information is not encrypted or is encrypted using inserted encryption software, an alarm notification is issued to prevent information leakage; when the test information imported into the network system is not encrypted, an alarm notification is issued to prevent the test information imported into the network system from being incomparable with the stolen information. The alarm forms of the three situations are different to facilitate the test personnel to distinguish, and can be distinguished by sound or by text.

[0043] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. For those skilled in the art, it is obvious that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention; therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is limited by the attached claims rather than the above description. Therefore, it is intended to include all changes within the meaning and scope of the equivalent elements of the claims in the present invention, and any figure marks in the claims should not be regarded as limiting the claims involved.

[0044] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network security testing and evaluation system, characterized in that: include: The data volume debugging module is used to monitor the application load of the network system in real time and adjust the volume of test data according to the difference between the maximum load of the network system and the application load; The test data planning module is used to classify the prepared test data, divide the test data into several test units according to their functionality, calculate the volume of different types of test units, and then select the test unit to attack the network system according to the required volume of the test data; An information stealing module is used to steal information stored in the network system and encrypt and transmit the stolen information; The evaluation module is used to insert the evaluation template and, after the test is completed, to compare the authenticity of the encrypted stolen information with the encrypted data imported by the network system, and to substitute the comparison result into the evaluation template to obtain the security evaluation of the network system; An encryption module, used to insert encryption software and encrypt the information stolen by the information stealing module and the information imported into the evaluation module by the network system through the encryption software; The correction module is used to count the intrusion situations of test data and the weak defense areas of the network system and display them.

2. A network security testing and evaluation system according to claim 1, characterized in that: The data volume debugging module also includes a data stabilization module, which is used to count the fluctuation frequency k of the difference between the maximum load of the network system and the application load, and when the absolute value of the fluctuation frequency k is greater than the safety threshold, trigger the data volume debugging module to adjust the volume of the test data in advance.

3. A network security testing and evaluation system according to claim 2, characterized in that: After dividing the test data into test units, the test data planning module tests the interference degree of the test units under the change of the test limit and reclassifies the test units based on the interference degree; then the interference degree of the reclassified test units is associated with the absolute value of the fluctuation frequency k. When selecting the test units under known volume, the test units are preferentially selected according to the absolute value of the fluctuation frequency k.

4. A network security testing and evaluation system according to claim 1, characterized in that: The information stealing module also includes a theft restriction module, which is used to select a storage range of stealable information in the network system and define the information stored in the stealable information storage range as test information; when stealing information stored in the network system, the information stealing module only steals test information; the encrypted data imported into the evaluation module is also test information.

5. A network security testing and evaluation system according to claim 4, characterized in that: The information stealing module also includes a confidentiality setting module, which is used to set the importance of the test information and import the importance of the test information into the evaluation module as a scoring coefficient; when scoring, the evaluation module uses the result calculated by the evaluation template multiplied by the scoring coefficient to obtain the actual score of network security.

6. A network security testing and evaluation system according to claim 4, characterized in that: It also includes an error reporting module, which is used to monitor the source of the stolen data by the information theft module, the encryption status of the stolen information, and the encryption status of the test information of the evaluation module imported by the network system; and to issue an alarm when the source of the stolen data is wrong, the stolen information is not encrypted, or the test information imported by the network system is not encrypted.

7. A network security testing and evaluation system according to claim 1, characterized in that: The correction module also includes an estimation module, which is used to monitor the volume of test data during invasion and the call degree of computing power during network system defense, and analyze the test units that restrain the network system based on the ratio of the call degree of computing power during network system defense to the volume of test data during invasion; and mobilize the test units in the test data planning module, giving priority to planning this type of test units.

8. A method for operating a network security testing and evaluation system according to any one of claims 1 to 7, comprising the following steps: (1) Use the difference between the maximum load of the network system and the application load to adjust the volume of test data; (2) Divide the test data into several test units according to their functionality, and select the test units to attack the network system according to the required volume of test data; (3) After breaking into the network system, steal the information stored in the network system and transmit it in encrypted form; (4) Compare the authenticity of the stolen information with the encrypted data imported into the network system, and substitute the comparison results into the evaluation template for security assessment; (5) Collect statistics on intrusions into test data and weak areas of network system defense and display them.

Images